2024 CVEs (page 358)
Page 358 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-1340 | Medium | 5.4 | 2024-02-29 | The Login Lockdown – Protect Login Form plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the generate_exp… |
CVE-2024-1339 | Medium | 4.3 | 2024-02-29 | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.13. This is… |
CVE-2024-1338 | Medium | 4.3 | 2024-02-29 | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.13. This is… |
CVE-2024-1337 | Medium | 4.3 | 2024-02-29 | The SKT Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'saveSktbuilderPageData'… |
CVE-2024-1336 | Medium | 4.3 | 2024-02-29 | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.13. This is… |
CVE-2024-1335 | Medium | 4.3 | 2024-02-29 | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.13. This is… |
CVE-2024-1334 | Medium | 4.3 | 2024-02-29 | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.13. This is… |
CVE-2024-1322 | Medium | 5.3 | 2024-02-29 | The Directorist – WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized modification of data due… |
CVE-2024-1318 | Medium | 6.5 | 2024-02-29 | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unauthorized modificatio… |
CVE-2024-1317 | High | 8.8 | 2024-02-29 | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to SQL Injection via the ‘s… |
CVE-2024-1294 | Medium | 5.3 | 2024-02-29 | The Sunshine Photo Cart: Free Client Galleries for Photographers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, an… |
CVE-2024-1288 | Medium | 4.3 | 2024-02-29 | The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'sas… |
CVE-2024-1282 | Medium | 6.4 | 2024-02-29 | The Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) i… |
CVE-2024-1277 | Medium | 6.4 | 2024-02-29 | The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom fields in all versions up to, and including, 2.2.4 due to insuffic… |
CVE-2024-1276 | Medium | 6.4 | 2024-02-29 | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2024-1242 | Medium | 6.4 | 2024-02-29 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button onclick attribute in all versions up to, and… |
CVE-2024-1236 | Medium | 6.4 | 2024-02-29 | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2024-1235 | Medium | 6.4 | 2024-02-29 | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom class field in all versions up to, and includ… |
CVE-2024-1218 | Medium | 4.3 | 2024-02-29 | The Contact Form builder with drag & drop for WordPress – Kali Forms plugin for WordPress is vulnerable to unauthorized access and modification of data via API… |
CVE-2024-1217 | High | 7.6 | 2024-02-29 | The Contact Form builder with drag & drop for WordPress – Kali Forms plugin for WordPress is vulnerable to unauthorized plugin deactivation due to a missing ca… |
CVE-2024-1206 | High | 8.8 | 2024-02-29 | The WP Recipe Maker plugin for WordPress is vulnerable to SQL Injection via the 'recipes' parameter in all versions up to, and including, 9.1.2 due to insuffic… |
CVE-2024-1192 | Low | 3.3 | 2024-02-29 | A vulnerability was found in South River WebDrive 18.00.5057. It has been declared as problematic. This vulnerability affects unknown code of the component New… |
CVE-2024-1191 | Low | 3.3 | 2024-02-29 | A vulnerability was found in Hyper CdCatalog 2.3.1. It has been classified as problematic. This affects an unknown part of the component HCF File Handler. The… |
CVE-2024-1172 | Medium | 5.4 | 2024-02-29 | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2024-1171 | Medium | 5.4 | 2024-02-29 | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2024-1133 | Medium | 4.3 | 2024-02-29 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access of restricted Q&A content due to a missing capab… |
CVE-2024-1130 | Medium | 5.3 | 2024-02-29 | The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check… |
CVE-2024-1129 | Medium | 5.3 | 2024-02-29 | The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check… |
CVE-2024-1128 | Medium | 5.4 | 2024-02-29 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 2.6.0. This is… |
CVE-2024-1091 | Medium | 4.3 | 2024-02-29 | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reini… |
CVE-2024-1090 | Medium | 4.3 | 2024-02-29 | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the stopO… |
CVE-2024-1089 | Medium | 4.3 | 2024-02-29 | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the optim… |
CVE-2024-1070 | Medium | 6.4 | 2024-02-29 | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the features attribute in all versions up to, and including… |
CVE-2024-1058 | Medium | 6.4 | 2024-02-29 | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the onclick parameter in all versions up to, and including… |
CVE-2024-1054 | Medium | 6.4 | 2024-02-29 | The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wcj_product_barcode' shortcode in all version… |
CVE-2024-1044 | Medium | 5.3 | 2024-02-29 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submit_r… |
CVE-2024-1043 | Medium | 6.5 | 2024-02-29 | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'amppb_remov… |
CVE-2024-0984 | Medium | 4.3 | 2024-02-29 | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disab… |
CVE-2024-0983 | Medium | 4.3 | 2024-02-29 | The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enabl… |
CVE-2024-0978 | Medium | 5.3 | 2024-02-29 | The My Private Site plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.14 via the REST API. This ma… |
CVE-2024-0907 | Medium | 5.3 | 2024-02-29 | The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check… |
CVE-2024-0838 | Medium | 6.4 | 2024-02-29 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the side image URL parameter in the Age Gate in all versio… |
CVE-2024-0821 | Medium | 6.1 | 2024-02-29 | The Cost of Goods Sold (COGS): Cost & Profit Calculator for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'section'… |
CVE-2024-0792 | Medium | 6.4 | 2024-02-29 | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions… |
CVE-2024-0702 | High | 7.3 | 2024-02-29 | The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functi… |
CVE-2024-0658 | Medium | 4.4 | 2024-02-29 | The Insert PHP Code Snippet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user's name when accessing the insert-php-code-snippet-ma… |
CVE-2024-0656 | Medium | 4.4 | 2024-02-29 | The Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2024-0621 | Medium | 4.4 | 2024-02-29 | The Simple Share Buttons Adder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 8.4.1… |
CVE-2024-0620 | Medium | 5.3 | 2024-02-29 | The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.9 via API. Thi… |
CVE-2024-0616 | Medium | 5.3 | 2024-02-29 | The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4… |
CVE-2024-0604 | Medium | 4.4 | 2024-02-29 | The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and… |
CVE-2024-0602 | Medium | 4.4 | 2024-02-29 | The YARPP – Yet Another Related Posts Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and in… |
CVE-2024-0590 | Medium | 6.1 | 2024-02-29 | The Microsoft Clarity plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9.3. This is due to missing nonc… |
CVE-2024-0516 | Medium | 5.3 | 2024-02-29 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to unauthorized post metadata update due to a missing capability check on the wpr_u… |
CVE-2024-0515 | Medium | 4.3 | 2024-02-29 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.87. This is… |
CVE-2024-0514 | Medium | 4.3 | 2024-02-29 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.87. This is… |
CVE-2024-0513 | Medium | 4.3 | 2024-02-29 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.87. This is… |
CVE-2024-0512 | Medium | 4.3 | 2024-02-29 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.87. This is… |
CVE-2024-0506 | Medium | 6.4 | 2024-02-29 | The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $instance[alt] param… |
CVE-2024-0442 | Medium | 6.4 | 2024-02-29 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via element URL parameters in all versions up to, an… |
CVE-2024-0438 | Medium | 6.4 | 2024-02-29 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wrapper link parameter in the Age Gate in all versions… |
CVE-2024-0379 | Medium | 4.3 | 2024-02-29 | The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi… |
CVE-2024-26146 | Medium | 5.3 | 2024-02-29 | Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible de… |
CVE-2024-26141 | Medium | 5.8 | 2024-02-29 | Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with… |
CVE-2024-25126 | Medium | 5.3 | 2024-02-29 | Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leadi… |
CVE-2024-26559 | Medium | 5.3 | 2024-02-28 | An issue in uverif v.2.0 allows a remote attacker to obtain sensitive information. |
CVE-2024-25579 | Medium | 6.8 | 2024-02-28 | OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent attacker with an administrative privilege to execute arbitrary OS c… |
CVE-2024-25422 | Critical | 9.8 | 2024-02-28 | SQL Injection vulnerability in SEMCMS v.4.8 allows a remote attacker to execute arbitrary code and obtain sensitive information via the SEMCMS_Menu.php compone… |
CVE-2024-23910 | High | 8.8 | 2024-02-28 | Cross-site request forgery (CSRF) vulnerability in ELECOM wireless LAN routers and wireless LAN repeater allows a remote unauthenticated attacker to hijack the… |
CVE-2024-22532 | Medium | 6.5 | 2024-02-28 | Buffer Overflow vulnerability in XNSoft NConvert 7.163 (for Windows x86) allows attackers to cause a denial of service via crafted xwd file. |
CVE-2024-21798 | Medium | 4.8 | 2024-02-28 | ELECOM wireless LAN routers contain a cross-site scripting vulnerability. Assume that a malicious administrative user configures the affected product with spec… |
CVE-2024-26476 | Low | 3.5 | 2024-02-28 | An issue in open-emr before v.7.0.2 allows a remote attacker to escalate privileges via a crafted script to the formid parameter in the ereq_form.php component. |
CVE-2024-26450 | Medium | 5.4 | 2024-02-28 | An issue exists within Piwigo before v.14.2.0 allowing a malicious user to take over the application. This exploit involves chaining a Cross Site Request Forge… |
CVE-2024-25869 | High | 8.8 | 2024-02-28 | An Unrestricted File Upload vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary code via upload… |
CVE-2024-25868 | Medium | 6.1 | 2024-02-28 | A Cross Site Scripting (XSS) vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary code via the me… |
CVE-2024-25867 | Critical | 9.1 | 2024-02-28 | A SQL Injection vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary SQL commands via the members… |
CVE-2024-25866 | High | 8.8 | 2024-02-28 | A SQL Injection vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary SQL commands via the email p… |
CVE-2024-25351 | Low | 3.8 | 2024-02-28 | SQL Injection vulnerability in /zms/admin/changeimage.php in PHPGurukul Zoo Management System 1.0 allows attackers to run arbitrary SQL commands via the editid… |
CVE-2024-25350 | Critical | 9.8 | 2024-02-28 | SQL Injection vulnerability in /zms/admin/edit-ticket.php in PHPGurukul Zoo Management System 1.0 via tickettype and tprice parameters. |
CVE-2024-22983 | High | 8.1 | 2024-02-28 | SQL injection vulnerability in Projectworlds Visitor Management System in PHP v.1.0 allows a remote attacker to escalate privileges via the name parameter in t… |
CVE-2024-1972 | Low | 3.5 | 2024-02-28 | A vulnerability was found in SourceCodester Online Job Portal 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the fi… |
CVE-2024-27285 | Medium | 5.4 | 2024-02-28 | YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due… |
CVE-2024-25859 | High | 7.1 | 2024-02-28 | A path traversal vulnerability in the /path/to/uploads/ directory of Blesta before v5.9.2 allows attackers to takeover user accounts and execute arbitrary code. |
CVE-2024-25435 | Medium | 6.1 | 2024-02-28 | A cross-site scripting (XSS) vulnerability in Md1health Md1patient v2.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injec… |
CVE-2024-25202 | Medium | 6.1 | 2024-02-28 | Cross Site Scripting vulnerability in Phpgurukul User Registration & Login and User Management System 1.0 allows attackers to run arbitrary code via the search… |
CVE-2024-25170 | Critical | 9.1 | 2024-02-28 | An issue in Mezzanine v6.0.0 allows attackers to bypass access controls via manipulating the Host header. |
CVE-2024-25169 | Critical | 9.8 | 2024-02-28 | An issue in Mezzanine v6.0.0 allows attackers to bypass access control mechanisms in the admin panel via a crafted request. |
CVE-2024-24148 | High | 7.5 | 2024-02-28 | A memory leak issue discovered in parseSWF_FREECHARACTER in libming v0.4.8 allows attackers to cause a denial of service via a crafted SWF file. |
CVE-2024-27948 | Medium | 5.4 | 2024-02-28 | Cross-Site Request Forgery (CSRF) vulnerability in bytesforall Atahualpa.This issue affects Atahualpa: from n/a through 3.7.24. |
CVE-2024-27103 | Medium | 6.1 | 2024-02-28 | Querybook is a Big Data Querying UI. When a user searches for their queries, datadocs, tables and lists, the search result is marked and highlighted, and this… |
CVE-2024-26342 | High | 7.5 | 2024-02-28 | A Null pointer dereference in usr/sbin/httpd in ASUS AC68U 3.0.0.4.384.82230 allows remote attackers to trigger DoS via network packet. |
CVE-2024-1847 | High | 7.8 | 2024-02-28 | Heap-based Buffer Overflow, Memory Corruption, Out-Of-Bounds Read, Out-Of-Bounds Write, Stack-based Buffer Overflow, Type Confusion, Uninitialized Variable, Us… |
CVE-2024-21749 | Medium | 5.4 | 2024-02-28 | Cross-Site Request Forgery (CSRF) vulnerability in Atakan Au 1 click disable all.This issue affects 1 click disable all: from n/a through 1.0.1. |
CVE-2024-0560 | Medium | 6.3 | 2024-02-28 | A vulnerability was found in 3Scale, when used with Keycloak 15 (or RHSSO 7.5.0) and superiors. When the auth_type is use_3scale_oidc_issuer_endpoint, the Toke… |
CVE-2024-24705 | Medium | 5.4 | 2024-02-28 | Cross-Site Request Forgery (CSRF) vulnerability in Octa Code Accessibility.This issue affects Accessibility: from n/a through 1.0.6. |
CVE-2024-24702 | Medium | 4.3 | 2024-02-28 | Cross-Site Request Forgery (CSRF) vulnerability in Matt Martz & Andy Stratton Page Restrict.This issue affects Page Restrict: from n/a through 2.5.5. |
CVE-2024-27515 | High | 7.2 | 2024-02-28 | Osclass 5.1.2 is vulnerable to SQL Injection. |
CVE-2024-25927 | Critical | 9.3 | 2024-02-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Joel Starnes postMash – custom post order.This issue affe… |
CVE-2024-25910 | Critical | 9.8 | 2024-02-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Skymoonlabs MoveTo.This issue affects MoveTo: from n/a th… |
CVE-2024-25902 | High | 7.6 | 2024-02-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in miniorange Malware Scanner.This issue affects Malware Sca… |