CVEs published December 12, 2024
149 CVEs were published on December 12, 2024: 13 critical, 24 high.
- Published
- 149
- Critical
- 13
- High
- 24
- Medium
- 111
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 49
Most affected products
- Huawei HarmonyOS
- 18
- GitLab
- 9
- Image Access Scan2Net
- 9
- Huawei HarmonyOS · Huawei EMUI
- 6
- arenaim Arena.IM – Live Blogging for real-time events
- 3
- LearnPress
- 2
- Paid Membership Plugin, Ecommerce, User Registration Form,…
- 2
- AI Engine
- 1
- Ajax Search Lite
- 1
- aliakro Snippet Shortcodes
- 1
Critical 13
- CVE-2024-55879XWiki allows RCE from script right in configurable sectionsxwiki-platform · org.xwiki.platform:xwiki-platform-administ…
- CVE-2024-55877XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosListxwiki-platform · org.xwiki.platform:xwiki-platform-help-ui
- CVE-2024-49147Microsoft Update Catalog Elevation of Privilege VulnerabilityMicrosoft Update Catalog
- CVE-2024-55875http4k has a potential XXE (XML External Entity Injection) vulnerabilityhttp4k · org.http4k:http4k-format-xml
- CVE-2024-55662XWiki allows remote code execution through the extension sheetxwiki-platform · org.xwiki.platform:xwiki-platform-reposito…
- CVE-2024-21575ComfyUI-Impact-Pack is vulnerable to Path Traversal.ltdrdata ComfyUI-Impact-Pack
- CVE-2024-21574The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install customltdrdata ComfyUI-Manager
- CVE-2024-10124Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce <= 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activationthemehunk Vayu Blocks – Website Builder for the Block Editor
- CVE-2024-11015Sign In With Google <= 1.8.0 - Authentication Bypass in authenticate_usertarecord Sign In With Google
- CVE-2024-54810A SQL Injection vulnerability was found in /preschool/admin/password-recovery.php in PHPGurukul Pre-School Enrollment System Project v1.0, w
- CVE-2024-54811A SQL injection vulnerability in /index.php in PHPGurukul Park Ticketing Management System v1.0 allows an attacker to execute arbitrary SQL
- CVE-2024-54842A SQL injection vulnerability was found in phpgurukul Online Nurse Hiring System v1.0 in /admin/password-recovery.php via the mobileno param
- CVE-2024-55099A SQL Injection vulnerability was found in /admin/index.php in phpgurukul Online Nurse Hiring System v1.0, which allows remote attackers to
High 24
- CVE-2024-55888Content Security Policy appears to be missing in software and production setupscidsg hushline
- CVE-2024-55663XWiki Platform has an SQL injection in getdocuments.vm with sort parameterxwiki-platform · org.xwiki.platform:xwiki-platform-distribu…
- CVE-2024-47238Dell Client Platform BIOS contains an Improper Input Validation vulnerability in an externally developed component.Dell Client Platform BIOS
- CVE-2024-55633Apache Superset: SQLLab Improper readonly query validation allows unauthorized write accessApache Software Foundation Apache Superset · apache-superset
- CVE-2024-28143Insecure Password Change FunctionImage Access Scan2Net
- CVE-2024-28146Hardcoded credentialsImage Access Scan2Net
- CVE-2024-8233Inefficient Algorithmic Complexity in GitLabGitLab
- CVE-2024-11274URL Redirection to Untrusted Site ('Open Redirect') in GitLabGitLab
- CVE-2024-54107Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability.Huawei HarmonyOS
- CVE-2024-54106Null pointer dereference vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availaHuawei HarmonyOS
- CVE-2024-54098Service logic error vulnerability in the system service module Impact: Successful exploitation of this vulnerability may affect service inteHuawei HarmonyOS · Huawei EMUI
- CVE-2024-54097Security vulnerability in the HiView module Impact: Successful exploitation of this vulnerability may affect feature implementation and inteHuawei HarmonyOS · Huawei EMUI
- CVE-2024-12397Io.quarkus.http/quarkus-http-core: quarkus http cookie smugglingquarkus-http · Red Hat Cryostat 4 on RHEL +13
- CVE-2024-12312Print Science Designer <= 1.3.152 - Unauthenticated PHP Object Injectionjohnwwweissberg Print Science Designer
- CVE-2024-10499AI-Engine < 2.6.5 - Admin+ SQLiAI Engine
- CVE-2024-11052Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.19 - Unauthenticated Stored Cross-Site Scripting via Form Calculationskstover Ninja Forms – The Contact Form Builder That Grows W…
- CVE-2024-12172WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses <= 3.2.21 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Meta Updatehookandhook WP Courses LMS – Online Courses Builder, eLearn…
- CVE-2024-12040Product Carousel Slider & Grid Ultimate for WooCommerce <= 1.9.10 - Authenticated (Contributor+) Local File Inclusion via 'theme'wpwax Product Carousel Slider & Grid Ultimate for WooCommer…
- CVE-2024-10590Opt-In Downloads <= 4.07 - Authenticated (Subscriber+) Arbitrary File Uploadhalfdata Opt-In Downloads
- CVE-2024-10910Grid Plus – Unlimited grid layout <= 1.3.5 - Unauthenticated Arbitrary Shortcode Execution via grid_plus_load_by_categoryg5theme Grid Plus – Unlimited grid layout
- CVE-2024-10111OAuth Single Sign On – SSO (OAuth Client) <= 6.26.3 - Authentication Bypasscyberlord92 OAuth Single Sign On – SSO
- CVE-2024-11443de:branding <= 1.0.2 - Authenticated (Subscriber+) Arbitrary Options Updatedecollete de:branding
- CVE-2024-11689HQ Rental Software <= 1.5.29 - Cross-Site Request Forgery to Arbitrary Options Updatecaagsoftware HQ Rental Software
- CVE-2024-42407Insertion of Sensitive Information into Log File (CWE-532) in the Gallagher Command Centre Alarm Transmitter feature could allow an authentiGallagher Command Centre Server
Medium, low and unrated 112
- CVE-2024-12289Boundary Controller Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of ServiceHashiCorp Boundary · github.com/hashicorp/boundary
- CVE-2024-55886OpenTelemetry Logs source may lack authentication with some custom pluginsopensearch-project data-prepper
- CVE-2024-55885Beego Vulnerable to Collision Hazards of MD5 in Cache Key Filenamesbeego · github.com/beego/beego +1
- CVE-2024-55878Cross-site Scripting vulnerability in SimpleXLSXEx::readXfs and SimpeXLSX::toHTMLExshuchkin simplexlsx · shuchkin/simplexlsx
- CVE-2024-49071Windows Defender Information Disclosure VulnerabilityMicrosoft Defender for Endpoint for Windows
- CVE-2024-55876XWiki's scheduler in subwiki allows scheduling operations for any main wiki userxwiki-platform · org.xwiki.platform:xwiki-platform-schedule…
- CVE-2024-52901IBM InfoSphere Information Server denial of serviceIBM InfoSphere Information Server
- CVE-2024-50584SQL InjectionImage Access Scan2Net
- CVE-2024-28145Unauthenticated SQL InjectionImage Access Scan2Net
- CVE-2024-28144Broken Access ControlImage Access Scan2Net
- CVE-2024-36494Reflected Cross Site ScriptingImage Access Scan2Net
- CVE-2024-36498Stored cross site scriptingImage Access Scan2Net
- CVE-2024-12271360 Javascript Viewer <= 1.7.29 - Authenticated (Administrator+) Stored Cross-Site Scriptingjtermaat 360 Javascript Viewer
- CVE-2024-47947Stored cross site scriptingImage Access Scan2Net
- CVE-2024-28142Stored cross site scriptingImage Access Scan2Net
- CVE-2024-54122Concurrent variable access vulnerability in the ability module Impact: Successful exploitation of this vulnerability may affect availabilityHuawei HarmonyOS
- CVE-2024-54119Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service Huawei HarmonyOS
- CVE-2024-54117Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service Huawei HarmonyOS
- CVE-2024-54116Out-of-bounds read vulnerability in the M3U8 module Impact: Successful exploitation of this vulnerability may cause features to perform abnoHuawei HarmonyOS
- CVE-2024-54115Out-of-bounds read vulnerability in the DASH module Impact: Successful exploitation of this vulnerability will affect availability.Huawei HarmonyOS
- CVE-2024-54114Out-of-bounds access vulnerability in playback in the DASH module Impact: Successful exploitation of this vulnerability will affect availabiHuawei HarmonyOS
- CVE-2024-54113Process residence vulnerability in abnormal scenarios in the print module Impact: Successful exploitation of this vulnerability may affect pHuawei HarmonyOS
- CVE-2024-54112Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service Huawei HarmonyOS
- CVE-2024-54111Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability.Huawei HarmonyOS
- CVE-2024-54110Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service Huawei HarmonyOS
- CVE-2024-54109Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability.Huawei HarmonyOS
- CVE-2024-54108Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability.Huawei HarmonyOS
- CVE-2024-8179Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2024-8647Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLabGitLab
- CVE-2024-9367Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2024-9387URL Redirection to Untrusted Site ('Open Redirect') in GitLabGitLab
- CVE-2024-10043Incorrect Authorization in GitLabGitLab
- CVE-2024-54105Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability.Huawei HarmonyOS
- CVE-2024-54104Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service Huawei HarmonyOS
- CVE-2024-54103Vulnerability of improper access control in the album module Impact: Successful exploitation of this vulnerability may affect service confidHuawei HarmonyOS
- CVE-2024-54102Race condition vulnerability in the DDR module Impact: Successful exploitation of this vulnerability may affect service confidentiality.Huawei HarmonyOS
- CVE-2024-54101Denial of service (DoS) vulnerability in the installation module Impact: Successful exploitation of this vulnerability will affect availabilHuawei HarmonyOS · Huawei EMUI
- CVE-2024-12570Privilege Context Switching Error in GitLabGitLab
- CVE-2024-12292Insertion of Sensitive Information into Log File in GitLabGitLab
- CVE-2024-54100Vulnerability of improper access control in the secure input module Impact: Successful exploitation of this vulnerability may cause featuresHuawei HarmonyOS · Huawei EMUI
- CVE-2024-54099File replacement vulnerability on some devices Impact: Successful exploitation of this vulnerability will affect integrity and confidentialiHuawei HarmonyOS · Huawei EMUI
- CVE-2024-54096Vulnerability of improper access control in the MTP module Impact: Successful exploitation of this vulnerability may affect integrity and acHuawei HarmonyOS · Huawei EMUI
- CVE-2024-12401Cert-manager: potential dos when parsing specially crafted pem inputscert-manager · Red Hat Cryostat +7
- CVE-2024-12160Seraphinite Bulk Discounts for WooCommerce <= 2.4.6 - Reflected Cross-Site Scriptingseraphinitesoft Seraphinite Bulk Discounts for WooCommerce
- CVE-2024-11760Currency Converter Widget ⚡ PRO <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scriptingfalselight Currency Converter Widget ⚡ PRO
- CVE-2024-12333WoodMart <= 8.0.3 - Unauthenticated Arbitrary Shortcode ExecutionxTemos Woodmart
- CVE-2024-12564Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ODA CDE inWEB SDK before 2025.3Open Design Alliance CDE inWEB SDK
- CVE-2024-12329Essential Real Estate <= 5.1.6 - Missing Authorization to Authenticated (Contributor+) Information Exposureg5theme Essential Real Estate
- CVE-2024-11724Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) <= 3.6.5 - Missing Authorization to Authenticated (Subscriber+) Whitelist Scriptwplegalpages Cookie Banner for GDPR / CCPA – WPLP Cookie Co…
- CVE-2024-12201Hash Form <= 1.2.1 - Missing Authorization to Authenticated (Contributor+) Form Style Creationhashthemes Hash Form – Drag & Drop Form Builder
- CVE-2024-10583Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder <= 1.20.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingdanieliser Popup Maker – Boost Sales, Conversions, Optins,…
- CVE-2024-11727NotificationX – Live Sales Notification, WooCommerce Sales Popup, FOMO, Social Proof, Announcement Banner & Floating Notification Top Bar <= 2.9.3 - Authenticated (Admin+) Stored Cross-Site Scriptingwpdevteam NotificationX – FOMO, Live Sales Notification, Wo…
- CVE-2024-11181Greenshift – animation and page builder blocks <= 9.9.9.3 - Authenticated (Contributor+) Post Disclosurewpsoul Greenshift – animation and page builder blocks
- CVE-2024-10784Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.126 - Authenticated (Contributor+) Stored Cross-Site Scriptingunitecms Unlimited Elements For Elementor
- CVE-2024-9881LearnPress < 4.2.7.2 - Admin+ Stored XSSLearnPress
- CVE-2024-9641LuckyWP Table of Contents < 2.1.7 - Admin+ Stored XSSLuckyWP Table of Contents
- CVE-2024-9428Popup Builder < 4.3.5 - Admin+ Stored XSSPopup Builder
- CVE-2024-10637Kadence Blocks < 3.2.54 - Admin+ Stored XSSGutenberg Blocks with AI by Kadence WP
- CVE-2024-10568Ajax Search Lite < 4.12.4 - Admin+ Stored XSSAjax Search Lite
- CVE-2024-10518ProfilePress < 4.15.15 - Admin+ Stored XSSPaid Membership Plugin, Ecommerce, User Registration Form,…
- CVE-2024-10517ProfilePress < 4.15.15 - Admin+ Stored XSSPaid Membership Plugin, Ecommerce, User Registration Form,…
- CVE-2024-10010LearnPress < 4.2.7.2 - Admin+ Stored XSSLearnPress
- CVE-2024-12263Child Theme Creator by Orbisius <= 1.5.5 - Missing Authorization to Authenticated (Subscriber+) Cloud Snippet Update/Deletelordspace Child Theme Creator by Orbisius
- CVE-2024-12059ElementInvader Addons for Elementor <= 1.3.1 - Missing Authorization to Arbitrary Options ReadElementInvader Addons for Elementor
- CVE-2024-12265Web3 Cryptocurrency Payments by DePay for WooCommerce <= 2.12.17 - Missing Authorization to Information Exposuredepayfi Web3 Crypto Payments by DePay for WooCommerce
- CVE-2024-11766WordPress Book Plugin for Displaying Books in Grid, Flip, Slider, Popup Layout and more <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingsamdani GS Books Showcase – Display Books in Grid, Slider &…
- CVE-2024-11785Integrate Firebase <= 0.9.3 - Authenticated (Contributor+) Stored Cross-Site Scriptinghanthuy Integrate Firebase
- CVE-2024-11871Social Media Shortcodes <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingtw2113 Social Media Shortcodes
- CVE-2024-11757WP GeoNames <= 1.9.0.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingsojahu WP GeoNames
- CVE-2024-12255Accept Stripe Payments Using Contact Form 7 <= 2.5 - Unauthenticated Information Exposurezealopensource Accept Stripe Payments Using Contact Form
- CVE-2024-11765WordPress Portfolio Plugin – A Plugin for Making Filterable Portfolio Grid, Portfolio Slider and more <= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingsamdani GS Portfolio – A Plugin for Making Filterable Portf…
- CVE-2024-12072Analytics Cat – Google Analytics Made Easy <= 1.1.2 - Reflected Cross-Site Scriptingfatcatapps Analytics Cat – Google Analytics Made Easy
- CVE-2024-12018Snippet Shortcodes <= 4.1.6 - Authenticated (Subscriber+) Shortcode Deletionaliakro Snippet Shortcodes
- CVE-2024-11359Library Bookshelves <= 5.8 - Reflected Cross-Site Scriptingphotonicgnostic Library Bookshelves
- CVE-2024-11781Smart Agenda – Prise de rendez-vous en ligne <= 4.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingSmartAgenda – Prise de rendez-vous en ligne
- CVE-2024-11882FAQ And Answers – Create Frequently Asked Questions Area on WP Sites <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingbplugins Awesome FAQ – Modern Accordion, Tabs,Responsive &…
- CVE-2024-12526Arena.IM – Live Blogging for real-time events <= 0.4.1 - Cross-Site Request Forgery to Settings Updatearenaim Arena.IM – Live Blogging for real-time events
- CVE-2024-11709AI Post Generator | AutoWriter <= 3.5 - Missing Authorization to Authenticated (Contributor+) Post/Page Deletionkekotron AI Post Generator | AutoWriter
- CVE-2024-12441BP Email Assign Templates <= 1.5 - Reflected Cross-Site Scriptingshanebp BP Email Assign Templates
- CVE-2024-12156AI Content Writer, RSS Feed to Post, Autoblogging SEO Help <= 6.1.3 - Reflected Cross-Site Scriptingquantumcloud QC SEO Help for llms.txt, AI Analytics, AI Con…
- CVE-2024-12162Video & Photo Gallery for Ultimate Member <= 1.1.1 - Reflected Cross-Site Scriptingsuiteplugins Video & Photo Gallery for Ultimate Member
- CVE-2024-11459Country Blocker <= 3.2 - Reflected Cross-Site Scriptingkarlkiesinger Country Blocker
- CVE-2024-11804Planaday API <= 11.4 - Reflected Cross-Site ScriptingPlanaday API
- CVE-2024-10182Cognito Forms <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parametercognitoapps Cognito Forms
- CVE-2024-12463Arena.IM – Live Blogging for real-time events <= 0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via arena_embed_amp Shortcodearenaim Arena.IM – Live Blogging for real-time events
- CVE-2024-11384Arena.IM – Live Blogging for real-time events <= 0.3.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingarenaim Arena.IM – Live Blogging for real-time events
- CVE-2024-11410Top and footer bars for announcements, notifications, advertisements, promotions – YooBar <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scriptingsharabindu Yoo Bar – Floating Notification & Promo Bar for…
- CVE-2024-11875Add infos to the events calendar <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scriptinghage Add infos to The Events Calendar
- CVE-2024-11750ONLYOFFICE DocSpace <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingONLYOFFICE DocSpace
- CVE-2024-11891Perfect Font Awesome Integration <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingkaushik07 Perfect Font Awesome Integration
- CVE-2024-12406Library Management System <= 3.2.0 - Authenticated (Subscriber+) SQL Injectionowthub Library Management System
- CVE-2024-11723kvCORE IDX <= 2.3.35 - Reflected Cross-Site Scriptinginsiderealestate kvCORE IDX
- CVE-2024-11683Newsletter Subscriptions <= 2.1 - Reflected Cross-Site Scriptinghanif-khan Newsletter Subscriptions
- CVE-2024-12258WP Service Payment Form With Authorize.net <= 2.6.3 - Reflected Cross-Site Scriptingshivtiwari WP Service Payment Form With Authorize.net
- CVE-2024-12260Ultimate Endpoints With Rest Api <= 2.2.2 - Reflected Cross-Site Scriptingdipankarpal212 Ultimate Endpoints With Rest Api
- CVE-2024-12338Website Toolbox Community <= 2.0.1 - Reflected Cross-Site Scripting via websitetoolbox_usernamewebsitetoolbox Website Toolbox Forum
- CVE-2024-11901PowerBI Embed Reports <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scriptingcyberlord92 PowerBI Embed Reports
- CVE-2024-11417dejure.org Vernetzungsfunktion <= 1.97.5 - Cross-Site Request Forgery to Stored Cross-Site Scriptingdejureorg dejure.org Vernetzungsfunktion
- CVE-2024-11419Password for WP <= 1.5 - Cross-Site Request Forgery to Stored Cross-Site Scriptingget3code Password for WP
- CVE-2024-12461WP-Revive Adserver <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingzoan WP-Revive Adserver
- CVE-2024-11433Surbma | SalesAutopilot Shortcode <= 2.5 - Authenticated (Contributor+) Stored Cross-Site ScriptingSurbma | SalesAutopilot Shortcode
- CVE-2024-11914Gutenberg Blocks and Page Layouts – Attire Blocks <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scriptingshafayat-alam Gutenberg Blocks and Page Layouts – Attire Bl…
- CVE-2024-11427Catch Popup <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scriptingmaheshmaharjan Catch Popup
- CVE-2024-11279Schema App Structured Data <= 2.2.4 - Reflected Cross-Site Scriptingvberkel Schema App Structured Data
- CVE-2024-11413HostFact bestelformulier integratie <= 1.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingHostFact bestelformulier integratie
- CVE-2024-11430SQL Chart Builder <= 2.3.6 - Authenticated (Contributor+) SQL Injectionelvinhaci SQL Chart Builder
- CVE-2024-12341Custom Skins Contact Form 7 <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Update and Skin Creationmahendrapatidarmp Custom Skins Contact Form
- CVE-2024-11442Horizontal scroll image slideshow <= 10.1 - Authenticated (Contributor+) Stored Cross-Site Scriptinggopiplus Horizontal scroll image slideshow
- CVE-2024-41146Use of Multiple Resources with Duplicate Identifier (CWE-694) in the Controller 6000 and Controller 7000 Platforms could allow an attacker wGallagher Controller 6000 and Controller
- CVE-2024-12536SourceCodester Kortex Lite Advocate Office Management System client_data.php cross site scriptingSourceCodester Kortex Lite Advocate Office Management System
- CVE-2024-12503ClassCMS Model Management Page admin cross site scriptingClassCMS
- CVE-2024-31670rizin before v0.6.3 is vulnerable to Buffer Overflow via create_cache_bins, read_cache_accel, and rz_dyldcache_new_buf functions in librz/bi