2024 CVEs (page 59)
Page 59 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-11357 | Medium | 5.9 | 2025-01-02 | The goodlayers-core WordPress plugin before 2.0.10 does not sanitise and escape some of its settings, which could allow users with the contributor role and abo… |
CVE-2024-11184 | Medium | 4.8 | 2025-01-02 | The wp-enable-svg WordPress plugin through 0.7 does not sanitize SVG files when uploaded, allowing for authors and above to upload SVGs containing malicious sc… |
CVE-2024-56830 | Medium | 5.4 | 2025-01-02 | The Net::EasyTCP package 0.15 through 0.26 for Perl uses Perl's builtin rand() if no strong randomization module is present. |
CVE-2024-56829 | Critical | 10.0 | 2025-01-02 | Huang Yaoshi Pharmaceutical Management Software through 16.0 allows arbitrary file upload via a .asp filename in the fileName element of the UploadFile element… |
CVE-2024-11846 | Medium | 6.1 | 2025-01-01 | The does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against hi… |
CVE-2024-56021 | Medium | 6.5 | 2025-01-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ibnuyahya Category Post Shortcode category-post-shortcode… |
CVE-2024-56020 | Medium | 6.5 | 2025-01-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in svegliadesign SvegliaT Buttons svegliat-buttons allows St… |
CVE-2024-56803 | | 2024-12-31 | Ghostty is a cross-platform terminal emulator. Ghostty, as allowed by default in 1.0.0, allows attackers to modify the window title via a certain character esc… | |
CVE-2024-56063 | Medium | 6.5 | 2024-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addo… |
CVE-2024-56062 | Medium | 6.5 | 2024-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons al… |
CVE-2024-13085 | High | 7.3 | 2024-12-31 | A vulnerability, which was classified as critical, has been found in PHPGurukul Land Record System 1.0. Affected by this issue is some unknown functionality of… |
CVE-2024-13084 | Medium | 6.3 | 2024-12-31 | A vulnerability classified as critical was found in PHPGurukul Land Record System 1.0. Affected by this vulnerability is an unknown functionality of the file /… |
CVE-2024-13083 | Low | 3.5 | 2024-12-31 | A vulnerability classified as problematic has been found in PHPGurukul Land Record System 1.0. Affected is an unknown function of the file /admin/admin-profile… |
CVE-2024-13082 | Low | 3.5 | 2024-12-31 | A vulnerability was found in PHPGurukul Land Record System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /admin… |
CVE-2024-13081 | Low | 3.5 | 2024-12-31 | A vulnerability was found in PHPGurukul Land Record System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /admin… |
CVE-2024-13080 | Low | 3.5 | 2024-12-31 | A vulnerability was found in PHPGurukul Land Record System 1.0. It has been classified as problematic. This affects an unknown part of the file /admin/aboutus… |
CVE-2024-13079 | Medium | 6.3 | 2024-12-31 | A vulnerability was found in PHPGurukul Land Record System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /ad… |
CVE-2024-13078 | Medium | 6.3 | 2024-12-31 | A vulnerability has been found in PHPGurukul Land Record System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of t… |
CVE-2024-13077 | Low | 3.5 | 2024-12-31 | A vulnerability, which was classified as problematic, was found in PHPGurukul Land Record System 1.0. Affected is an unknown function of the file /admin/add-pr… |
CVE-2024-13076 | Low | 3.5 | 2024-12-31 | A vulnerability, which was classified as problematic, has been found in PHPGurukul Land Record System 1.0. This issue affects some unknown processing of the fi… |
CVE-2024-13075 | Low | 3.5 | 2024-12-31 | A vulnerability classified as problematic was found in PHPGurukul Land Record System 1.0. This vulnerability affects unknown code of the file /admin/add-proper… |
CVE-2024-55955 | Medium | 6.7 | 2024-12-31 | An incorrect permissions assignment vulnerability in Trend Micro Deep Security 20.0 agents between versions 20.0.1-9400 and 20.0.1-23340 could allow a local at… |
CVE-2024-55917 | High | 7.8 | 2024-12-31 | An origin validation error vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note… |
CVE-2024-55632 | High | 7.8 | 2024-12-31 | A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please… |
CVE-2024-55631 | High | 7.8 | 2024-12-31 | An engine link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note: a… |
CVE-2024-13074 | Low | 3.5 | 2024-12-31 | A vulnerability classified as problematic has been found in PHPGurukul Land Record System 1.0. This affects an unknown part of the file /index.php. The manipul… |
CVE-2024-56802 | | 2024-12-31 | Tapir is a private Terraform registry. Tapir versions 0.9.0 and 0.9.1 are facing a critical issue with scope-able Deploykeys where attackers can guess the key… | |
CVE-2024-56198 | | 2024-12-31 | path-sanitizer is a simple lightweight npm package for sanitizing paths to prevent Path Traversal. Prior to 3.1.0, the filters can be bypassed using .=%5c whic… | |
CVE-2024-53647 | Medium | 6.5 | 2024-12-31 | Trend Micro ID Security, version 3.0 and below contains a vulnerability that could allow an attacker to send an unlimited number of email verification requests… |
CVE-2024-52050 | High | 7.8 | 2024-12-31 | A LogServer arbitrary file creation vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Ple… |
CVE-2024-52049 | High | 7.8 | 2024-12-31 | A LogServer link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. This vulnerabil… |
CVE-2024-52048 | High | 7.8 | 2024-12-31 | A LogServer link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. This vulnerabil… |
CVE-2024-52047 | High | 7.5 | 2024-12-31 | A widget local file inclusion vulnerability in Trend Micro Apex One could allow a remote attacker to execute arbitrary code on affected installations. Pleas… |
CVE-2024-25133 | High | 8.8 | 2024-12-31 | A flaw was found in the Hive ClusterDeployments resource in OpenShift Dedicated. In certain conditions, this issue may allow a developer account on a Hive-enab… |
CVE-2024-13072 | Medium | 6.3 | 2024-12-31 | A vulnerability was found in 1000 Projects Beauty Parlour Management System 1.0. It has been rated as critical. Affected by this issue is some unknown function… |
CVE-2024-13070 | Medium | 6.3 | 2024-12-31 | A vulnerability was found in CodeAstro Online Food Ordering System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown function… |
CVE-2024-56207 | High | 8.8 | 2024-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in EditionGuard EditionGuard for WooCommerce – eBook Sales with DRM editionguard-for-woocommerce-ebook-sales-wi… |
CVE-2024-56206 | High | 8.8 | 2024-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in krishankakkar gap-hub-user-role gap-hub-user-role allows Authentication Bypass.This issue affects gap-hub-us… |
CVE-2024-56204 | High | 8.8 | 2024-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in yonisink Sinking Dropdowns sinking-dropdowns allows Privilege Escalation.This issue affects Sinking Dropdown… |
CVE-2024-56203 | High | 8.8 | 2024-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in gholme4 Wayne Audio Player wayne-audio-player allows Privilege Escalation.This issue affects Wayne Audio Pla… |
CVE-2024-56070 | High | 7.4 | 2024-12-31 | Missing Authorization vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2024-56066 | Critical | 9.8 | 2024-12-31 | Missing Authorization vulnerability in inspry Agency Toolkit agency-toolkit allows Privilege Escalation.This issue affects Agency Toolkit: from n/a through <=… |
CVE-2024-56061 | High | 8.8 | 2024-12-31 | Missing Authorization vulnerability in Ateeq Rafeeq RepairBuddy computer-repair-shop allows Privilege Escalation.This issue affects RepairBuddy: from n/a throu… |
CVE-2024-56045 | Critical | 9.3 | 2024-12-31 | Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5. |
CVE-2024-56044 | Critical | 9.8 | 2024-12-31 | Authentication Bypass Using an Alternate Path or Channel vulnerability in VibeThemes WPLMS wplms_plugin allows Authentication Bypass.This issue affects WPLMS… |
CVE-2024-56043 | Critical | 9.8 | 2024-12-31 | Incorrect Privilege Assignment vulnerability in VibeThemes WPLMS wplms_plugin allows Privilege Escalation.This issue affects WPLMS: from n/a through <= 1.9.9. |
CVE-2024-56040 | Critical | 9.8 | 2024-12-31 | Incorrect Privilege Assignment vulnerability in VibeThemes VibeBP vibebp allows Privilege Escalation.This issue affects VibeBP: from n/a through <= 1.9.9.4.1. |
CVE-2024-56002 | Medium | 6.4 | 2024-12-31 | Missing Authorization vulnerability in mightyforms Contact Form, Survey & Form Builder – MightyForms mightyforms allows Exploiting Incorrectly Configured Acces… |
CVE-2024-55995 | Medium | 6.5 | 2024-12-31 | Missing Authorization vulnerability in Torod Company for Information Technology Torod torod allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2024-51667 | Medium | 4.3 | 2024-12-31 | Missing Authorization vulnerability in paytiumsupport Paytium paytium.This issue affects Paytium: from n/a through <= 4.4.10. |
CVE-2024-49698 | Medium | 4.3 | 2024-12-31 | Missing Authorization vulnerability in PriceListo Best Restaurant Menu by PriceListo best-restaurant-menu-by-pricelisto.This issue affects Best Restaurant Menu… |
CVE-2024-49694 | Medium | 5.3 | 2024-12-31 | Missing Authorization vulnerability in imw3 My Wp Brand my-wp-brand.This issue affects My Wp Brand: from n/a through <= 1.1.2. |
CVE-2024-49687 | Medium | 4.3 | 2024-12-31 | Missing Authorization vulnerability in storeapps Smart Manager smart-manager-for-wp-e-commerce.This issue affects Smart Manager: from n/a through <= 8.45.0. |
CVE-2024-49686 | Medium | 5.4 | 2024-12-31 | Missing Authorization vulnerability in fatcatapps Landing Page Cat landing-page-cat.This issue affects Landing Page Cat: from n/a through <= 1.7.4. |
CVE-2024-56205 | Critical | 9.8 | 2024-12-31 | Incorrect Privilege Assignment vulnerability in SunnyKai AI Magic newsletter-page-redirects allows Privilege Escalation.This issue affects AI Magic: from n/a t… |
CVE-2024-56071 | Critical | 9.8 | 2024-12-31 | Incorrect Privilege Assignment vulnerability in mikeleembruggen Simple Dashboard simple-dashboard allows Privilege Escalation.This issue affects Simple Dashboa… |
CVE-2024-56068 | High | 7.5 | 2024-12-31 | Deserialization of Untrusted Data vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup.This issue affects WP SuperBackup: from n/a through <= 2.3.3. |
CVE-2024-56067 | High | 7.5 | 2024-12-31 | Missing Authorization vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2024-56064 | Critical | 10.0 | 2024-12-31 | Unrestricted Upload of File with Dangerous Type vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Upload a Web Shell to a Web Server.This i… |
CVE-2024-56046 | Critical | 10.0 | 2024-12-31 | Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPL… |
CVE-2024-56042 | Critical | 9.3 | 2024-12-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows SQL Injection.This i… |
CVE-2024-56041 | High | 8.5 | 2024-12-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes VibeBP vibebp allows SQL Injection.This issue… |
CVE-2024-56039 | Critical | 9.3 | 2024-12-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes VibeBP vibebp allows SQL Injection.This issue… |
CVE-2024-56031 | Medium | 6.5 | 2024-12-31 | Missing Authorization vulnerability in Yulio Aleman Jimenez Smart Shopify Product smart-shopify-product allows Exploiting Incorrectly Configured Access Control… |
CVE-2024-55991 | Medium | 6.5 | 2024-12-31 | Missing Authorization vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2024-13061 | Critical | 9.8 | 2024-12-31 | The Electronic Official Document Management System from 2100 Technology has an Authentication Bypass vulnerability. Although the product enforces an IP whiteli… |
CVE-2024-56265 | High | 7.1 | 2024-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpweb WooCommerce PDF Vouchers woocommerce-pdf-vouchers a… |
CVE-2024-56256 | Medium | 5.9 | 2024-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andy Fragen Embed PDF Viewer embed-pdf-viewer.This issue… |
CVE-2024-56235 | Medium | 6.5 | 2024-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vicky Kumar Coupon coupon-lite allows DOM-Based XSS.This… |
CVE-2024-56234 | Medium | 5.4 | 2024-12-31 | Missing Authorization vulnerability in vowelweb VW Automobile Lite vw-automobile-lite allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2024-56233 | High | 7.1 | 2024-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kinhelios KinTPV WooConnect kintpv-connect allows Stored… |
CVE-2024-56231 | Medium | 6.5 | 2024-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Debuggers Studio SaasPricing saaspricing allows DOM-Based… |
CVE-2024-56228 | High | 7.1 | 2024-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Wishlist for WooCommerce wish-list-for-woocomme… |
CVE-2024-56227 | Medium | 4.3 | 2024-12-31 | Missing Authorization vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2024-56226 | High | 7.1 | 2024-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons al… |
CVE-2024-56225 | Medium | 5.4 | 2024-12-31 | Missing Authorization vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor allows Accessing Functionality Not Properly Constrained… |
CVE-2024-56224 | Medium | 6.5 | 2024-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ledenbeheer Ledenbeheer ledenbeheer-external-connection a… |
CVE-2024-56223 | High | 7.1 | 2024-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fahad Mahmood Gulri Slider gulri-slider allows Reflected… |
CVE-2024-56221 | Medium | 6.5 | 2024-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elicus WPMozo Addons Lite for Elementor wpmozo-addons-lit… |
CVE-2024-56219 | Medium | 4.3 | 2024-12-31 | Missing Authorization vulnerability in Marketing Fire Widget Options widget-options allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2024-56217 | Medium | 4.3 | 2024-12-31 | Missing Authorization vulnerability in Shahjada Download Manager download-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2024-56215 | Medium | 4.3 | 2024-12-31 | Missing Authorization vulnerability in DBAR Productions Member Directory and Contact Form pta-member-directory allows Exploiting Incorrectly Configured Access… |
CVE-2024-56210 | High | 7.1 | 2024-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DeluxeThemes Userpro userpro allows Reflected XSS.This is… |
CVE-2024-56209 | High | 7.1 | 2024-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SeventhQueen Kleo kleo allows Reflected XSS.This issue af… |
CVE-2024-13069 | Low | 3.5 | 2024-12-31 | A vulnerability was found in SourceCodester Multi Role Login System 1.0. It has been classified as problematic. Affected is an unknown function of the file /en… |
CVE-2024-12108 | Critical | 9.6 | 2024-12-31 | In WhatsUp Gold versions released before 2024.0.2, an attacker can gain access to the WhatsUp Gold server via the public API. |
CVE-2024-12106 | Critical | 9.4 | 2024-12-31 | In WhatsUp Gold versions released before 2024.0.2, an unauthenticated attacker can configure LDAP settings. |
CVE-2024-12105 | Medium | 6.5 | 2024-12-31 | In WhatsUp Gold versions released before 2024.0.2, an authenticated user can use a specially crafted HTTP request that can lead to information disclosure. |
CVE-2024-56232 | High | 7.1 | 2024-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in Alex Volkov WP Nice Loader wp-nice-loader allows Stored XSS.This issue affects WP Nice Loader: from n/a thro… |
CVE-2024-56230 | High | 7.5 | 2024-12-31 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Maidul Dynamic Product Category Grid… |
CVE-2024-56229 | Medium | 4.3 | 2024-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in SearchIQ SearchIQ searchiq.This issue affects SearchIQ: from n/a through <= 4.6. |
CVE-2024-56222 | Medium | 5.4 | 2024-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in CodeBard CodeBard Help Desk codebard-help-desk allows Cross Site Request Forgery.This issue affects CodeBard… |
CVE-2024-56220 | Critical | 9.8 | 2024-12-31 | Incorrect Privilege Assignment vulnerability in sslplugins SSL Wireless SMS Notification ssl-wireless-sms-notification allows Privilege Escalation.This issue a… |
CVE-2024-56218 | Medium | 4.3 | 2024-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in sevenspark Contact Form 7 – Dynamic Text Extension contact-form-7-dynamic-text-extension allows Cross Site R… |
CVE-2024-56216 | Medium | 6.5 | 2024-12-31 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themifyme Themify Builder themify-buil… |
CVE-2024-56214 | High | 8.3 | 2024-12-31 | Path Traversal: '.../...//' vulnerability in DeluxeThemes Userpro userpro allows Path Traversal.This issue affects Userpro: from n/a through <= 5.1.9. |
CVE-2024-56213 | Medium | 6.5 | 2024-12-31 | Path Traversal: '.../...//' vulnerability in Arraytics Eventin wp-event-solution allows Path Traversal.This issue affects Eventin: from n/a through <= 4.0.7. |
CVE-2024-56212 | High | 8.5 | 2024-12-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DeluxeThemes Userpro userpro.This issue affects Userpro… |
CVE-2024-56211 | High | 8.8 | 2024-12-31 | Missing Authorization vulnerability in DeluxeThemes Userpro userpro.This issue affects Userpro: from n/a through <= 5.1.9. |
CVE-2024-49422 | Medium | 5.2 | 2024-12-31 | Protection Mechanism Failure in bootloader prior to SMR Oct-2024 Release 1 allows physical attackers to reset lockscreen failure count by hardware fault inject… |