Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 261 of 521.
- CVE-2024-46475 A reflected cross-site scripting (XSS) vulnerability on the homepage of Metronic Admin Dashboard Template v2.0 allows attackers to execute a
- CVE-2024-46472 SQL injection in codeastro:membership management system
- CVE-2024-46471 Information disclosure in codeastro:membership management system
- CVE-2024-46470 Cross-site scripting in codeastro:membership management system
- CVE-2024-4647 Campcodes Complete Web-Based School Management System student_first_payment.php cross site scripting
- CVE-2024-46468 Server-side request forgery in jpress:jpress
- CVE-2024-46467 By default, dedicated folders of ZONEPOINT for Windows up to 2024.1 can be accessed by other users to misuse technical files and make them p
- CVE-2024-46466 By default, dedicated folders of ZONECENTRAL for Windows up to 2024.3 or up to Q.2021.2 (ANSSI qualification submission) can be accessed by
- CVE-2024-46465 Misconfiguration in primx:cryhod
- CVE-2024-46464 In PRIMX ZED Enterprise up to 2024.3, technical files stored in local folders with common user access can be manipulated to render the host
- CVE-2024-46463 By default, dedicated folders of ORIZON for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them perf
- CVE-2024-46462 By default, dedicated folders of ZEDMAIL for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them per
- CVE-2024-46461 VLC media player 3.0.20 and earlier is vulnerable to denial of service through an integer overflow which could be triggered with a malicious
- CVE-2024-4646 Campcodes Complete Web-Based School Management System student_payment_details.php cross site scripting
- CVE-2024-46455 unstructured XML External Entity (XXE)
- CVE-2024-46453 Cross-site scripting in honeywell:iq3xcite firmware
- CVE-2024-46452 A Host Header injection vulnerability in the password reset function of VigyBag Open Source Online Shop commit 3f0e21b allows attackers to r
- CVE-2024-46451 Memory corruption in totolink:t8 firmware
- CVE-2024-46450 Auth bypass in tenda:ac6 firmware
- CVE-2024-4645 SourceCodester Prison Management System changepassword.php cross site scripting
- CVE-2024-46446 Path traversal in mecha-cms:mecha
- CVE-2024-46442 An issue in the BYD Dilink Headunit System v3.0 to v4.0 allows attackers to bypass authentication via a bruteforce attack.
- CVE-2024-46441 An arbitrary file upload vulnerability in YPay 1.2.0 allows attackers to execute arbitrary code via a ZIP archive to themePutFile in app/com
- CVE-2024-4644 SourceCodester Prison Management System changepassword.php cross site scripting
- CVE-2024-46437 Information disclosure in tenda:w18e firmware
- CVE-2024-46436 Hardcoded credentials in tenda:w18e firmware
- CVE-2024-46435 Memory corruption in tenda:w18e firmware
- CVE-2024-46434 Auth bypass in tenda:w18e firmware
- CVE-2024-46433 Hardcoded credentials in tenda:w18e firmware
- CVE-2024-46432 Missing authorization in tenda:w18e firmware
- CVE-2024-46431 Memory corruption in tenda:w18e firmware
- CVE-2024-46430 Auth bypass in tenda:w18e firmware
- CVE-2024-4643 Cross-site scripting in Element Pack – Widgets, Templates & Addons for Elementor
- CVE-2024-46429 Hardcoded credentials in tenda:w18e firmware
- CVE-2024-46424 Memory corruption in totolink:t8 firmware
- CVE-2024-46419 Memory corruption in totolink:t8 firmware
- CVE-2024-46413 Server-side request forgery in getrebuild:rebuild
- CVE-2024-46412 Incorrect access control in the prehandle function of Rebuild v3.7.7 allows attackers to bypass authentication via a crafted GET request sen
- CVE-2024-46410 Cross-site scripting in publiccms:publiccms
- CVE-2024-4641 OnCell G3470A-LTE Series: Authenticated Format String Errors
- CVE-2024-46409 Cross-site scripting in seeddms:seeddms
- CVE-2024-4640 OnCell G3470A-LTE Series: Authenticated Command Injection via sendTestEmail
- CVE-2024-46394 Cross-site request forgery in frogcms project:frogcms
- CVE-2024-4639 OnCell G3470A-LTE Series: Authenticated Command Injection via webDelIPSec
- CVE-2024-46383 Hathway Skyworth Router CM5100-511 v4.1.1.24 was discovered to store sensitive information about USB and Wifi connected devices in plaintext.
- CVE-2024-46382 SQL injection in linlinjava:litemall
- CVE-2024-4638 OnCell G3470A-LTE Series: Authenticated Command Injection via webUploadKey
- CVE-2024-46377 File upload in mayurik:best house rental management system
- CVE-2024-46376 File upload in mayurik:best house rental management system
- CVE-2024-46375 File upload in mayurik:best house rental management system
- CVE-2024-46374 SQL injection in mayurik:best house rental management system
- CVE-2024-46373 File upload in dedecms:dedecms
- CVE-2024-46372 Cross-site scripting in dedecms:dedecms
- CVE-2024-4637 Cross-site scripting in Slider Revolution
- CVE-2024-46367 Cross-site scripting in webkul:krayin crm
- CVE-2024-46366 Code injection in webkul:krayin crm
- CVE-2024-46362 Cross-site request forgery in frogcms project:frogcms
- CVE-2024-4636 Cross-site scripting in Optimole – Optimize Images in Real Time
- CVE-2024-4635 Menu Icons by ThemeIsle <= 0.13.13 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload
- CVE-2024-46341 Weak cryptography in tp-link:tl-wr845n firmware
- CVE-2024-46340 Information disclosure in tp-link:tl-wr845n firmware
- CVE-2024-4634 Elementor Header & Footer Builder <= 1.6.28 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-46336 Cross-site scripting in kashipara:school management system
- CVE-2024-46335 Cross-site scripting in phpgurukul:complaint management system
- CVE-2024-46334 Cross-site scripting in kashipara:school management system
- CVE-2024-46333 Cross-site scripting in piwigo:piwigo
- CVE-2024-46331 Open redirect in modstart:mostartcms
- CVE-2024-46330 Command injection in vonets:vap11g-300 firmware
- CVE-2024-4633 Cross-site scripting in Depicter — Popup & Slider Builder
- CVE-2024-46329 Command injection in vonets:vap11g-300 firmware
- CVE-2024-46328 Hardcoded credentials in vonets:vap11g-300 firmware
- CVE-2024-46327 Path traversal in vonets:vap11g-300 firmware
- CVE-2024-46326 Public Knowledge Project pkp-lib 3.4.0-7 and earlier is vulnerable to Open redirect due to a lack of input sanitization in the logout function.
- CVE-2024-46325 Memory corruption in tp-link:wr740n firmware
- CVE-2024-4632 Cross-site scripting in CartFlows – Funnel Builder & Checkout Plugin for WooCommerce
- CVE-2024-46316 Command injection in draytek:vigor3900 firmware
- CVE-2024-46313 Memory corruption in tp-link:wr941nd firmware
- CVE-2024-46310 Incorrect Access Control in Cfx.re FXServer v9601 and earlier allows unauthenticated users to modify and read arbitrary user data via expose
- CVE-2024-46307 Business logic in sparkshop:sparkshop
- CVE-2024-46304 A NULL pointer dereference in libcoap v4.3.5-rc2 and below allows a remote attacker to cause a denial of service via the coap_handle_request
- CVE-2024-46300 Cross-site scripting in angeljudesuarez:placement management system
- CVE-2024-4630 Cross-site scripting in Starter Templates – AI-Powered Templates for Elementor & Gutenberg
- CVE-2024-46293 Missing authorization in oretnom23:online medicine ordering system
- CVE-2024-46292 Memory corruption in trustwave:modsecurity
- CVE-2024-4629 Keycloak: potential bypass of brute force protection
- CVE-2024-46280 PIX-LINK LV-WR22 RE3002-P1-01_V117.0 is vulnerable to Improper Access Control.
- CVE-2024-46278 Cross-site scripting in sismics:teedy
- CVE-2024-46276 Memory corruption in randygaul:cute png
- CVE-2024-46274 Memory corruption in randygaul:cute png
- CVE-2024-4627 Rank Math SEO < 1.0.219 - Authenticated Stored XSS
- CVE-2024-46267 Memory corruption in randygaul:cute png
- CVE-2024-46264 Memory corruption in randygaul:cute png
- CVE-2024-46263 Memory corruption in randygaul:cute png
- CVE-2024-46261 Memory corruption in randygaul:cute png
- CVE-2024-4626 Cross-site scripting in JetWidgets For Elementor
- CVE-2024-46259 Memory corruption in randygaul:cute png
- CVE-2024-46258 Memory corruption in randygaul:cute png
- CVE-2024-46257 Command injection in jc21:nginx proxy manager
- CVE-2024-46256 Command injection in jc21:nginx proxy manager
- CVE-2024-46242 An issue in the validate_email function in CTFd/utils/validators/__init__.py of CTFd 3.7.3 allows attackers to cause a Regular expression De