2024 CVEs (page 221)
Page 221 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-37954 | High | 7.1 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in marcelotorres Simple Responsive Slider allows Refl… |
CVE-2024-37953 | High | 7.1 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in MBE Worldwide S.P.A. MBE eShip allows Reflected XS… |
CVE-2024-37951 | Medium | 6.5 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Noor alam Magical Posts Display – Elementor & Gute… |
CVE-2024-37950 | Medium | 5.9 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CodexHelp Master Popups allows Stored XSS.This iss… |
CVE-2024-37949 | Medium | 6.5 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CyberChimps Responsive Mobile allows Stored XSS.Th… |
CVE-2024-37948 | Medium | 6.5 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PootlePress Caxton – Create Pro page layouts in Gu… |
CVE-2024-37947 | Medium | 5.9 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themeum Tutor LMS allows Stored XSS.This issue aff… |
CVE-2024-37946 | Medium | 5.9 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs ReCaptcha Integration for WordPress wp-recaptcha-i… |
CVE-2024-37944 | Medium | 6.5 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Travel Engine allows Stored XSS.This issue affe… |
CVE-2024-37943 | Medium | 5.8 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH WooCommerce Ajax Product Filter yith-woocom… |
CVE-2024-37936 | Medium | 6.5 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in labibahmed Tabs For WPBakery Page Builder allows S… |
CVE-2024-37922 | Medium | 6.5 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-el… |
CVE-2024-37920 | High | 7.1 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Repute InfoSystems ARForms Form Builder allows Ref… |
CVE-2024-37919 | Medium | 5.9 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Pratik Chaskar Timeline Module for Beaver Builder… |
CVE-2024-37918 | Medium | 6.5 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPCone ConeBlog – WordPress Blog Widgets coneblog-widgets… |
CVE-2024-37565 | Medium | 5.9 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in TemeGUM Gum Elementor Addon allows Stored XSS.This… |
CVE-2024-37563 | Medium | 6.5 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in TOCHAT.BE allows Stored XSS.This issue affects TOC… |
CVE-2024-6637 | High | 7.3 | 2024-07-20 | The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthenticated privilege escalation in all versions up to, and including, 2.7.3. This is… |
CVE-2024-6636 | Critical | 9.8 | 2024-07-20 | The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'woo_slg_login_… |
CVE-2024-6635 | High | 7.3 | 2024-07-20 | The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.3. This is due to insufficient… |
CVE-2024-38767 | Medium | 6.5 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BannerSky.Com BSK PDF Manager allows Stored XSS.Th… |
CVE-2024-38758 | Medium | 4.9 | 2024-07-20 | Server-Side Request Forgery (SSRF) vulnerability in WappPress Team WappPress.This issue affects WappPress: from n/a through 6.0.4. |
CVE-2024-38757 | Medium | 6.5 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Typebot allows Stored XSS.This issue affects Typeb… |
CVE-2024-38750 | Medium | 6.5 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in digontoahsan Advanced post slider.This issue affec… |
CVE-2024-38741 | Medium | 6.5 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Noor-E-Alam Amazing Hover Effects allows Stored XS… |
CVE-2024-38739 | Medium | 5.1 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in FameThemes OnePress allows Stored XSS.This issue a… |
CVE-2024-38738 | Medium | 5.9 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Marian Kadanka Change From Email allows Stored XSS… |
CVE-2024-38725 | Medium | 5.9 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Webstix Admin Dashboard RSS Feed allows Stored XSS… |
CVE-2024-38722 | Medium | 6.5 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PickPlugins Job Board Manager allows Stored XSS.Th… |
CVE-2024-38720 | Medium | 6.5 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in EazyDocs eazydocs allows Stored XSS.This issue aff… |
CVE-2024-38718 | Medium | 6.5 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in clicklabs® Medienagentur Download Button for Eleme… |
CVE-2024-38713 | Medium | 6.5 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus… |
CVE-2024-38712 | Medium | 6.5 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Qode Qi Blocks qi-blocks.This issue affects Qi Blocks: fr… |
CVE-2024-38711 | High | 7.1 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Yannick Lefebvre Link Library allows Reflected XSS… |
CVE-2024-38710 | Medium | 5.9 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jewel Theme Master Addons for Elementor allows Sto… |
CVE-2024-38705 | Medium | 6.5 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ElementInvader ElementInvader Addons for Elementor… |
CVE-2024-38703 | Medium | 6.5 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Xylus Themes WP Event Aggregator allows Stored XSS… |
CVE-2024-38698 | Medium | 6.5 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SKT Themes SKT Skill Bar allows Stored XSS.This is… |
CVE-2024-38697 | Medium | 6.5 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ali Rahimi Goftino allows Stored XSS.This issue af… |
CVE-2024-38696 | High | 7.1 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Zoho CRM Zoho CRM Lead Magnet allows Reflected XSS… |
CVE-2024-38694 | High | 7.1 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Moloni allows Reflected XSS.This issue affects Mol… |
CVE-2024-38689 | Medium | 5.9 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Garrett Grimm Simple Popup allows Stored XSS.This… |
CVE-2024-38687 | Medium | 6.5 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wowDevs Sky Addons for Elementor sky-elementor-addons.Thi… |
CVE-2024-38686 | Medium | 6.5 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Pluginic FancyPost – Best Ultimate Post Block, Pos… |
CVE-2024-38685 | Medium | 5.9 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SubscriptionPro WP Announcement allows Stored XSS… |
CVE-2024-38684 | Medium | 6.5 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in FunnelKit SlingBlocks – Gutenberg Blocks by Funnel… |
CVE-2024-38683 | High | 7.1 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in iThemelandCo WooCommerce Report allows Reflected X… |
CVE-2024-38682 | Medium | 6.5 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Techeshta Post Layouts for Gutenberg allows Stored… |
CVE-2024-38681 | Medium | 6.5 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Noor alam Magical Addons For Elementor allows Stor… |
CVE-2024-38680 | High | 7.1 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Appmaker Appmaker – Convert WooCommerce to Android… |
CVE-2024-38679 | Medium | 6.5 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Yongki Agustinus Animated Typed JS Shortcode allow… |
CVE-2024-38678 | Medium | 6.5 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Calendar.Online Calendar.Online / Kalender.Digital… |
CVE-2024-38677 | Medium | 6.5 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Reviews.Co.Uk REVIEWS.Io allows Stored XSS.This is… |
CVE-2024-38676 | Medium | 6.5 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Booking Ultra Pro allows Stored XSS.This issue aff… |
CVE-2024-38675 | Medium | 6.5 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in LOOS,Inc. Arkhe Blocks allows Stored XSS.This issu… |
CVE-2024-38674 | Medium | 6.5 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SKT Themes SKT Addons for Elementor allows Stored… |
CVE-2024-38673 | High | 7.1 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Obtain Infotech Multisite Content Copier/Updater a… |
CVE-2024-38672 | High | 7.1 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in namithjawahar AdPush allows Reflected XSS.This iss… |
CVE-2024-38671 | Medium | 6.5 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Martin Gibson WP GoToWebinar allows Stored XSS.Thi… |
CVE-2024-38670 | Medium | 6.5 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Team Members allows Stored XSS.This issue affects… |
CVE-2024-38669 | High | 7.1 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in a3rev Software WooCommerce Predictive Search allow… |
CVE-2024-37961 | High | 7.1 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in codoc.Jp allows Stored XSS.This issue affects codo… |
CVE-2024-37960 | Medium | 6.5 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Chris Coyier CodePen Embedded Pens Shortcode allow… |
CVE-2024-6491 | Medium | 4.3 | 2024-07-20 | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mailchimp_api_ke… |
CVE-2024-6489 | Medium | 5.3 | 2024-07-20 | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the get_google_api_k… |
CVE-2024-6694 | Low | 2.7 | 2024-07-20 | The WP Mail SMTP plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 4.0.1. This is due to plugin providing the SM… |
CVE-2024-6281 | High | 7.3 | 2024-07-20 | A path traversal vulnerability exists in the `apply_settings` function of parisneo/lollms versions prior to 9.5.1. The `sanitize_path` function does not adequa… |
CVE-2024-40348 | High | 8.2 | 2024-07-20 | An issue in the component /api/swaggerui/static of Bazaar v1.4.3 allows unauthenticated attackers to execute a directory traversal. |
CVE-2024-40347 | Medium | 6.1 | 2024-07-20 | A reflected cross-site scripting (XSS) vulnerability in Hyland Alfresco Platform 23.2.1-r96 allows attackers to execute arbitrary code in the context of a user… |
CVE-2024-3934 | Medium | 6.5 | 2024-07-20 | The Mercado Pago payments for WooCommerce plugin for WordPress is vulnerable to Path Traversal in versions 7.3.0 to 7.5.1 via the mercadopagoDownloadLog functi… |
CVE-2024-6560 | Medium | 5.3 | 2024-07-20 | The Addonify – Quick View For WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2.16. This is due… |
CVE-2024-2337 | Medium | 6.4 | 2024-07-20 | The Easy Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'testimonials_grid ' shortcode in all versions up to… |
CVE-2024-5804 | Medium | 4.3 | 2024-07-20 | The Conditional Fields for Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.13. This is du… |
CVE-2024-41599 | Medium | 6.1 | 2024-07-19 | Cross Site Scripting vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the file upload method |
CVE-2024-41597 | Medium | 4.2 | 2024-07-19 | Cross Site Request Forgery vulnerability in ProcessWire v.3.0.229 allows a remote attacker to insert a comment. NOTE: this is disputed by the Supplier because… |
CVE-2024-41124 | Medium | 6.3 | 2024-07-19 | Puncia is the Official CLI utility for Subdomain Center & Exploit Observer. `API_URLS` is utilizing HTTP instead of HTTPS for communication that can lead to is… |
CVE-2024-41122 | High | 7.5 | 2024-07-19 | Woodpecker is a simple yet powerful CI/CD engine with great extensibility. The server allow to create any user who can trigger a pipeline run malicious workflo… |
CVE-2024-41121 | High | 8.8 | 2024-07-19 | Woodpecker is a simple yet powerful CI/CD engine with great extensibility. The server allow to create any user who can trigger a pipeline run malicious workflo… |
CVE-2024-39906 | High | 8.3 | 2024-07-19 | A command injection vulnerability was found in the IndieAuth functionality of the Ruby on Rails based Haven blog web application. The affected functionality re… |
CVE-2024-39123 | Medium | 5.4 | 2024-07-19 | In janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments function is vulnerable to Cross Site Scripting (XSS) due to improper sanitization performed by… |
CVE-2024-40400 | High | 8.8 | 2024-07-19 | An arbitrary file upload vulnerability in the image upload function of Automad v2.0.0 allows attackers to execute arbitrary code via a crafted file. |
CVE-2024-41600 | High | 7.5 | 2024-07-19 | Insecure Permissions vulnerability in lin-CMS Springboot v.0.2.1 and before allows a remote attacker to obtain sensitive information via the login method in th… |
CVE-2024-41603 | Critical | 9.6 | 2024-07-19 | Spina CMS v2.18.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the URI /admin/layout. |
CVE-2024-41602 | High | 8.8 | 2024-07-19 | Cross Site Request Forgery vulnerability in Spina CMS v.2.18.0 and before allows a remote attacker to escalate privileges via a crafted URL |
CVE-2024-41601 | High | 7.5 | 2024-07-19 | Insecure Permissions vulnerability in lin-CMS v.0.2.0 and before allows a remote attacker to obtain sensitive information via the login method in the UserContr… |
CVE-2024-41492 | High | 7.5 | 2024-07-19 | A stack overflow in Tenda AX1806 v1.0.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2024-41281 | High | 8.8 | 2024-07-19 | Linksys WRT54G v4.21.5 has a stack overflow vulnerability in get_merge_mac function. |
CVE-2024-29080 | Medium | 6.5 | 2024-07-19 | Potential vulnerabilities have been identified in the HP Display Control software component within the HP Application Enabling Software Driver which might allo… |
CVE-2024-24970 | Medium | 6.5 | 2024-07-19 | Potential vulnerabilities have been identified in the HP Display Control software component within the HP Application Enabling Software Driver which might allo… |
CVE-2024-6908 | | 2024-07-19 | Improper privilege management in Yugabyte Platform allows authenticated admin users to escalate privileges to SuperAdmin via a crafted PUT HTTP request, potent… | |
CVE-2024-6895 | | 2024-07-19 | Insufficient authentication in user account management in Yugabyte Platform allows local network attackers with a compromised user session to change critical s… | |
CVE-2024-39963 | High | 8.0 | 2024-07-19 | AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX9 V22.03.01.46 and AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX12 V1.0 V22.03.01.46 were discovered to contain an authe… |
CVE-2024-39962 | Critical | 9.8 | 2024-07-19 | D-Link DIR-823X AX3000 Dual-Band Gigabit Wireless Router v21_D240126 was discovered to contain a remote code execution (RCE) vulnerability in the ntp_zone_val… |
CVE-2024-27489 | High | 7.5 | 2024-07-19 | An issue in the DelFile() function of WMCMS v4.4 allows attackers to delete arbitrary files via a crafted POST request. |
CVE-2024-0006 | | 2024-07-19 | Information exposure in the logging system in Yugabyte Platform allows local attackers with access to application logs to obtain database user credentials in l… | |
CVE-2024-37066 | Medium | 6.8 | 2024-07-19 | A command injection vulnerability exists in Wyze V4 Pro firmware versions before 4.50.4.9222, which allows attackers to execute arbitrary commands over Bluetoo… |
CVE-2024-6916 | Medium | 5.9 | 2024-07-19 | A vulnerability in Zowe CLI allows local, privileged actors to display securely stored properties in cleartext within a terminal using the '--show-inputs-only'… |
CVE-2024-5977 | Medium | 5.4 | 2024-07-19 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includi… |
CVE-2024-41107 | High | 8.1 | 2024-07-19 | The CloudStack SAML authentication (disabled by default) does not enforce signature check. In CloudStack environments where SAML authentication is enabled, an… |
CVE-2024-6907 | Low | 3.5 | 2024-07-19 | A vulnerability was found in SourceCodester Record Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file so… |