Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 272 of 521.
- CVE-2024-44905 go-pg SQL injection vulnerability via the component /types/append_value.go
- CVE-2024-44903 SQL injection in IPAC20
- CVE-2024-44902 ThinkPHP deserialization vulnerability
- CVE-2024-4490 Cross-site scripting in Divi
- CVE-2024-44893 Privilege escalation in jeecg:jimureport
- CVE-2024-4489 Royal Elementor Addons and Templates <= 1.3.976 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Uploads
- CVE-2024-4488 Royal Elementor Addons and Templates <= 1.3.976 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-44872 Cross-site scripting in mozilo:mozilocms
- CVE-2024-44871 File upload in mozilo:mozilocms
- CVE-2024-4487 Blocksy Companion <= 2.0.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Uploads
- CVE-2024-44867 Path traversal in phpok:phpok
- CVE-2024-44866 A buffer overflow in the GuitarPro1::read function of MuseScore Studio v4.3.2 allows attackers to to execute arbitrary code or cause a Denia
- CVE-2024-44860 Information disclosure in solvait:solvait
- CVE-2024-4486 Cross-site scripting in Awesome Contact Form7 for Elementor
- CVE-2024-44859 Memory corruption in tenda:fh1201 firmware
- CVE-2024-44856 Null dereference in openrobotics:robot operating system
- CVE-2024-44855 Null dereference in openrobotics:robot operating system
- CVE-2024-44854 Null dereference in openrobotics:robot operating system
- CVE-2024-44853 Null dereference in openrobotics:robot operating system
- CVE-2024-44852 Memory corruption in openrobotics:robot operating system
- CVE-2024-44851 Cross-site scripting in perfexcrm:perfex crm
- CVE-2024-4485 Cross-site scripting in The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce
- CVE-2024-44849 File upload in qualitor:qualitor
- CVE-2024-44845 Command injection in draytek:vigor3900 firmware
- CVE-2024-44844 Command injection in draytek:vigor3900 firmware
- CVE-2024-44843 Auth bypass in steve-community:steve
- CVE-2024-4484 Cross-site scripting in The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce
- CVE-2024-44839 SQL injection in openrapid:rapidcms
- CVE-2024-44838 SQL injection in openrapid:rapidcms
- CVE-2024-44837 Cross-site scripting in deathbreak:drug
- CVE-2024-4483 Email Encoder < 2.2.2 - Admin+ Stored XSS
- CVE-2024-44825 Directory Traversal vulnerability in Centro de Tecnologia da Informaco Renato Archer InVesalius3 v3.1.99995 allows attackers to write arbitr
- CVE-2024-44821 Security feature bypass in zzcms:zzcms
- CVE-2024-44820 Information disclosure in zzcms:zzcms
- CVE-2024-4482 The Plus Addons for Elementor <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
- CVE-2024-44819 Cross-site scripting in zzcms:zzcms
- CVE-2024-44818 Cross-site scripting in zzcms:zzcms
- CVE-2024-44817 SQL injection in zzcms:zzcms
- CVE-2024-44815 Information disclosure in hathway:skyworth cm5100-511 firmware
- CVE-2024-44812 SQL injection in janobe:online complaint site
- CVE-2024-4481 Cross-site scripting in Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- CVE-2024-44809 A remote code execution (RCE) vulnerability exists in the Pi Camera project, version 1.0, maintained by RECANTHA.
- CVE-2024-44808 An issue in Vypor Attack API System v.1.0 allows a remote attacker to execute arbitrary code via the user GET parameter.
- CVE-2024-44807 A directory listing issue in the baserCMS plugin in D-ZERO CO., LTD.
- CVE-2024-4480 WP Prayer II <= 2.4.7 - Email Settings Update via CSRF
- CVE-2024-44798 Cross-site scripting in anujk305:bus pass management system
- CVE-2024-44797 Cross-site scripting in gazelle project:gazelle
- CVE-2024-44796 Cross-site scripting in xiebruce:picuploader
- CVE-2024-44795 Cross-site scripting in gazelle project:gazelle
- CVE-2024-44794 Cross-site scripting in xiebruce:picuploader
- CVE-2024-44793 Cross-site scripting in gazelle project:gazelle
- CVE-2024-4479 Cross-site scripting in Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress
- CVE-2024-44786 Incorrect access control in Meabilis CMS 1.0 allows attackers to access other users' address books via unspecified vectors.
- CVE-2024-4478 Cross-site scripting in Happy Addons for Elementor
- CVE-2024-44779 Cross-site scripting in vtiger:vtiger crm
- CVE-2024-44778 Cross-site scripting in vtiger:vtiger crm
- CVE-2024-44777 Cross-site scripting in vtiger:vtiger crm
- CVE-2024-44776 Open redirect in vtiger:vtiger crm
- CVE-2024-44775 Null dereference in davidepianca98:kmqtt
- CVE-2024-44771 BigId PrivacyPortal v179 is vulnerable to Cross Site Scripting (XSS) via the "Label" field in the Report template function.
- CVE-2024-4477 WP Logs Book <= 1.0.1 - Unauthenticated Stored XSS
- CVE-2024-44765 An Improper Authorization (Access Control Misconfiguration) vulnerability in MGT-COMMERCE GmbH CloudPanel v2.0.0 to v2.4.2 allows low-privil
- CVE-2024-44762 Information disclosure in webmin:usermin
- CVE-2024-44761 Path traversal in gzequan:eq enterprise management system
- CVE-2024-44760 Information disclosure in sunmochina:enterprise management system
- CVE-2024-44759 Path traversal in nuserp:nus-m9 erp
- CVE-2024-44758 File upload in nuserp:nus-m9 erp
- CVE-2024-44757 Path traversal in nuserp:nus-m9 erp
- CVE-2024-44756 SQL injection in nuserp:nus-m9 erp
- CVE-2024-44754 Cryptographic key extraction from internal flash in Minut M2 with firmware version #15142 allows physically proximate attackers to inject mo
- CVE-2024-4475 WP Logs Book <= 1.0.1 - Log Clearing via CSRF
- CVE-2024-44744 An issue in Malwarebytes Premium Security v5.0.0.883 allows attackers to execute arbitrary code via placing crafted binaries into unspecified directories.
- CVE-2024-4474 WP Logs Book <= 1.0.1 - Disable Logging via CSRF
- CVE-2024-44739 SQL injection in oretnom23:simple forum website
- CVE-2024-44734 Incorrect access control in Mirotalk before commit 9de226 allows attackers to arbitrarily change usernames via sending a crafted roomAction
- CVE-2024-44731 Mirotalk before commit 9de226 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability which allows attackers to execu
- CVE-2024-44730 Incorrect access control in the function handleDataChannelChat(dataMessage) of Mirotalk before commit c21d58 allows attackers to forge chat
- CVE-2024-4473 Sydney Toolbox <= 1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via aThemes: Portfolio Widget
- CVE-2024-44729 Incorrect access control in the component app/src/server.js of Mirotalk before commit 9de226 allows unauthenticated attackers without presen
- CVE-2024-44728 Cross-site scripting in angeljudesuarez:event management system
- CVE-2024-44727 SQL injection in angeljudesuarez:event management system
- CVE-2024-44725 SQL injection in autocms project:autocms
- CVE-2024-44724 Code injection in autocms project:autocms
- CVE-2024-44722 Command injection in anolis:sysak
- CVE-2024-44721 Server-side request forgery in seacms:seacms
- CVE-2024-44720 Path traversal in seacms:seacms
- CVE-2024-4472 Insertion of Sensitive Information into Log File in GitLab
- CVE-2024-44717 Cross-site scripting in dedebiz:dedebiz
- CVE-2024-44716 Cross-site scripting in dedebiz:dedebiz
- CVE-2024-4471 140+ Widgets | Best Addons For Elementor – FREE <= 1.4.3.1 - Authenticated (Contributor+) PHP Object Injection
- CVE-2024-4470 Master Slider – Responsive Touch Slider <= 3.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-4469 Migration Backup Restore < 3.5.0 - Admin+ SSRF
- CVE-2024-44685 Titan SFTP and Titan MFT Server 2.0.25.2426 and earlier have a vulnerability a vulnerability where sensitive information, including password
- CVE-2024-44684 Cross-site scripting in tpmecms:tpmecms
- CVE-2024-44683 Cross-site scripting in seacms:seacms
- CVE-2024-44682 Cross-site scripting in shopxo:shopxo
- CVE-2024-4468 Salon booking system <= 9.9 - Missing Authorization
- CVE-2024-44678 Gigastone TR1 Travel Router R101 v1.0.2 is vulnerable to Command Injection.
- CVE-2024-44677 Server-side request forgery in eladmin:eladmin
- CVE-2024-44676 Cross-site scripting in eladmin:eladmin