Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 246 of 521.
- CVE-2024-48229 SQL injection in funadmin
- CVE-2024-48228 Funadmin Cross-site Scripting vulnerability
- CVE-2024-48227 Logic flaw in Funadmin
- CVE-2024-48226 SQL injection in funadmin
- CVE-2024-48225 SQL injection in funadmin
- CVE-2024-48224 SQL injection in funadmin
- CVE-2024-48223 SQL injection in funadmin
- CVE-2024-48222 SQL injection in funadmin
- CVE-2024-4822 Cross-site Scripting in School ERP Pro+Responsive by AROX SOLUTION
- CVE-2024-48218 SQL injection in funadmin
- CVE-2024-48217 An Insecure Direct Object Reference (IDOR) in the dashboard of SiSMART v7.4.0 allows attackers to execute a horizontal-privilege escalation.
- CVE-2024-48214 KERUI HD 3MP 1080P Tuya Camera 1.0.4 has a command injection vulnerability in the module that connects to the local network via a QR code.
- CVE-2024-48213 Path traversal in rockoa:xinhu
- CVE-2024-4821 Cross-site scripting in WP Shortcodes Plugin — Shortcodes Ultimate
- CVE-2024-48208 Memory corruption in pureftpd:pure-ftpd
- CVE-2024-48206 A Deserialization of Untrusted Data vulnerability in chainer v7.8.1.post1 leads to execution of arbitrary code.
- CVE-2024-48204 SQL injection vulnerability in Hanzhou Haobo network management system 1.0 allows a remote attacker to execute arbitrary code via a crafted script.
- CVE-2024-48202 File upload in thecosy:icecms
- CVE-2024-48200 An issue in MobaXterm v24.2 allows a local attacker to escalate privileges and execute arbitrary code via the remove function of the MobaXte
- CVE-2024-4820 SourceCodester Online Computer and Laptop Store unrestricted upload
- CVE-2024-48197 Cross Site Scripting vulnerability in Audiocodes MP-202b v.4.4.3 allows a remote attacker to escalate privileges via the login page of the web interface.
- CVE-2024-48196 Information disclosure in eyoucms:eyoucms
- CVE-2024-48195 Cross-site scripting in eyoucms:eyoucms
- CVE-2024-48192 Hardcoded credentials in tenda:g3 firmware
- CVE-2024-48191 Cross-site request forgery in timgreen:dingfanzu cms
- CVE-2024-4819 Campcodes Online Laundry Management System admin_class.php improper authorization
- CVE-2024-48180 File upload in classcms:classcms
- CVE-2024-4818 Campcodes Online Laundry Management System index.php file inclusion
- CVE-2024-48178 Server-side request forgery in newbee-mall project:newbee-mall
- CVE-2024-48177 SQL injection in mrcms:mrcms
- CVE-2024-48176 Auth bypass in lylme:lylme spage
- CVE-2024-48170 Cross-site scripting in phpgurukul:small crm
- CVE-2024-4817 Campcodes Online Laundry Management System HTTP Request Parameter manage_user.php resource injection
- CVE-2024-48168 Memory corruption in dlink:dcs-960l firmware
- CVE-2024-4816 Ruijie RG-UAC gre_add_commit.php os command injection
- CVE-2024-48153 Command injection in draytek:vigor3900 firmware
- CVE-2024-48150 Memory corruption in dlink:dir-820l firmware
- CVE-2024-4815 Ruijie RG-UAC detail.php os command injection
- CVE-2024-48145 A prompt injection vulnerability in the chatbox of Netangular Technologies ChatNet AI Version v1.0 allows attackers to access and exfiltrate
- CVE-2024-48144 A prompt injection vulnerability in the chatbox of Fusion Chat Chat AI Assistant Ask Me Anything v1.2.4.0 allows attackers to access and exf
- CVE-2024-48143 A lack of rate limiting in the OTP validation component of Digitory Multi Channel Integrated POS v1.0 allows attackers to gain access to the
- CVE-2024-48142 A prompt injection vulnerability in the chatbox of Butterfly Effect Limited Monica ChatGPT AI Assistant v2.4.0 allows attackers to access an
- CVE-2024-48141 A prompt injection vulnerability in the chatbox of Zhipu AI CodeGeeX v2.17.0 allows attackers to access and exfiltrate all previous and subs
- CVE-2024-48140 A prompt injection vulnerability in the chatbox of Butterfly Effect Limited Monica Your AI Copilot powered by ChatGPT4 v6.3.0 allows attacke
- CVE-2024-4814 Ruijie RG-UAC static_route_edit_commit.php os command injection
- CVE-2024-48139 A prompt injection vulnerability in the chatbox of Blackbox AI v1.3.95 allows attackers to access and exfiltrate all previous and subsequent
- CVE-2024-48138 A remote code execution (RCE) vulnerability in the component /PluXml/core/admin/parametres_edittpl.php of PluXml v5.8.16 and lower allows at
- CVE-2024-4813 Ruijie RG-UAC interface_commit.php os command injection
- CVE-2024-48126 HI-SCAN 6040i Hitrax HX-03-19-I was discovered to contain hardcoded credentials for access to vendor support and service access.
- CVE-2024-48125 An issue in the AsDB service of HI-SCAN 6040i Hitrax HX-03-19-I allows attackers to enumerate user credentials via crafted GIOP protocol requests.
- CVE-2024-48123 An issue in the USB Autorun function of HI-SCAN 6040i Hitrax HX-03-19-I allows attackers to execute arbitrary code via uploading a crafted s
- CVE-2024-48122 Insecure default configurations in HI-SCAN 6040i Hitrax HX-03-19-I allow authenticated attackers with low-level privileges to escalate to root-level privileges.
- CVE-2024-48121 The HI-SCAN 6040i Hitrax HX-03-19-I was discovered to transmit user credentials in cleartext over the GIOP protocol.
- CVE-2024-48120 Cross-site scripting in x2engine:x2crm
- CVE-2024-4812 Katello: potential cross-site scripting exploit in ui
- CVE-2024-48119 Cross-site scripting in vtiger:vtiger crm
- CVE-2024-48112 ThinkPHP deserialization vulnerability
- CVE-2024-4811 Missing authorization in Octopus Server
- CVE-2024-48107 Server-side request forgery in sparkshop:sparkshop
- CVE-2024-48093 Unrestricted File Upload in the Discussions tab in Operately v.0.1.0 allows a privileged user to achieve Remote Code Execution via uploading
- CVE-2024-48091 Tally Prime Edit Log v2.1 was discovered to contain a DLL hijacking vulnerability via the component TextShaping.dll.
- CVE-2024-4809 SourceCodester Open Source Clinic Management System setting.php unrestricted upload
- CVE-2024-48080 An issue in aedes v0.51.2 allows attackers to cause a Denial of Service(DoS) via a crafted request.
- CVE-2024-4808 Kashipara College Management System delete_faculty.php sql injection
- CVE-2024-48077 Denial of service in emqx:nanomq
- CVE-2024-48075 A Heap buffer overflow in the server-site handshake implementation in Real Time Logic SharkSSL from 09/09/24 and earlier allows a remote att
- CVE-2024-48074 Command injection in draytek:vigor2960 firmware
- CVE-2024-48073 sunniwell HT3300 before 1.0.0.B022.2 is vulnerable to Insecure Permissions.
- CVE-2024-48072 SQL injection in weaver:e-cology
- CVE-2024-48071 Path traversal in weaver:e-cology
- CVE-2024-48070 Code injection in weaver:e-cology
- CVE-2024-4807 Kashipara College Management System delete_user.php sql injection
- CVE-2024-48069 Race condition in weaver:e-cology
- CVE-2024-48068 A cross-site scripting (XSS) vulnerability in Shenzhen Landray Software Co.,LTD Landray EKP v16 and earlier allows attackers to execute arbi
- CVE-2024-48063 Deserialization in linuxfoundation:pytorch
- CVE-2024-48061 Langflow vulnerable to remote code execution
- CVE-2024-4806 Kashipara College Management System each_extracurricula_activities.php sql injection
- CVE-2024-48059 Cross-site scripting in gaizhenbiao:chuanhuchatgpt
- CVE-2024-48057 LocalAI Cross-site Scripting vulnerability
- CVE-2024-48052 gradio Server Side Request Forgery vulnerability
- CVE-2024-48050 AgentScope uses `eval`
- CVE-2024-4805 Kashipara College Management System edit_faculty.php sql injection
- CVE-2024-48049 WordPress Mighty Builder plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-48048 WordPress Wsify Widget plugin <= 1.0 - CSRF to Stored XSS vulnerability
- CVE-2024-48047 WordPress Linked Variation for WooCommerce plugin <= 1.0.5 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-48046 WordPress Contact Form by Supsystic plugin <= 1.7.28 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-48045 WordPress Happy Elementor Addons plugin <= 3.12.3 - Broken Access Control vulnerability
- CVE-2024-48044 WordPress ShortPixel Image Optimizer plugin <= 5.6.3 - Broken Access Control vulnerability
- CVE-2024-48043 WordPress ShortPixel Image Optimizer plugin <= 5.6.3 - SQL Injection vulnerability
- CVE-2024-48042 WordPress Contact Form by Supsystic plugin <= 1.7.28 - Remote Code Execution (RCE) vulnerability
- CVE-2024-48041 WordPress CM Tooltip Glossary plugin <= 4.3.9 - Stored Cross-Site Scripting vulnerability
- CVE-2024-48040 WordPress Tainacan plugin <= 0.21.8 - SQL Injection vulnerability
- CVE-2024-4804 Kashipara College Management System edit_user.php sql injection
- CVE-2024-48039 WordPress CubeWP Framework plugin <= 1.1.15 - Broken Access Control vulnerability
- CVE-2024-48038 WordPress wp-Monalisa plugin <= 6.4 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-48037 WordPress Contact Form Widget plugin <= 1.4.2 - CSRF vulnerability
- CVE-2024-48036 WordPress SKT Blocks plugin <= 1.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-48035 WordPress ACF Images Search And Insert plugin <= 1.1.4 - Arbitrary File Upload vulnerability
- CVE-2024-48034 WordPress Creates 3D Flipbook, PDF Flipbook plugin <= 1.2 - Arbitrary File Upload vulnerability
- CVE-2024-48033 WordPress Talkback plugin <= 1.0 - PHP Object Injection vulnerability