Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 346 of 521.
- CVE-2024-3561 Custom Field Suite <= 2.6.7 - Authenticated (Contributor+) SQL Injection via Term Custom Field
- CVE-2024-3560 LearnPress – WordPress LMS Plugin <= 4.2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-35595 An arbitrary file upload vulnerability in the File Preview function of Xintongda OA v2023.12.30.1 allows attackers to execute arbitrary code
- CVE-2024-35593 An arbitrary file upload vulnerability in the File preview function of Raingad IM v4.1.4 allows attackers to execute arbitrary code via uplo
- CVE-2024-35592 An arbitrary file upload vulnerability in the Upload function of Box-IM v2.0 allows attackers to execute arbitrary code via uploading a crafted PDF file.
- CVE-2024-35591 File upload in zoneland:o2oa
- CVE-2024-3559 Custom Field Suite <= 2.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via cfs[post_content]
- CVE-2024-35585 Auth bypass in MinKNOW
- CVE-2024-35584 SQL injection in os4ed:opensis
- CVE-2024-35583 Cross-site scripting in oretnom23:computer laboratory management system
- CVE-2024-35582 Cross-site scripting in oretnom23:computer laboratory management system
- CVE-2024-35581 Cross-site scripting in oretnom23:computer laboratory management system
- CVE-2024-35580 Memory corruption in tenda:ax1806 firmware
- CVE-2024-3558 Custom Field Suite <= 2.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via cfs[post_title]
- CVE-2024-35579 Memory corruption in tenda:ax1806 firmware
- CVE-2024-35578 Memory corruption in tenda:ax1806 firmware
- CVE-2024-35576 Memory corruption in tenda:ax1806 firmware
- CVE-2024-35571 Memory corruption in tenda:ax1806 firmware
- CVE-2024-35570 File upload in inxedu:inxedu
- CVE-2024-3557 WP Go Maps (formerly WP Google Maps) <= 9.0.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-35563 CDG-Server-V5.6.2.126.139 and earlier was discovered to contain a SQL injection vulnerability via the permissionId parameter in CDGTempPermissions.
- CVE-2024-35561 Cross-site request forgery in idccms:idccms
- CVE-2024-35560 Cross-site request forgery in idccms:idccms
- CVE-2024-35559 Cross-site request forgery in idccms:idccms
- CVE-2024-35558 Cross-site request forgery in idccms:idccms
- CVE-2024-35557 Cross-site request forgery in idccms:idccms
- CVE-2024-35556 Cross-site request forgery in idccms:idccms
- CVE-2024-35555 Cross-site request forgery in idccms:idccms
- CVE-2024-35554 Cross-site request forgery in idccms:idccms
- CVE-2024-35553 Cross-site request forgery in idccms:idccms
- CVE-2024-35552 Cross-site request forgery in idccms:idccms
- CVE-2024-35551 Cross-site request forgery in idccms:idccms
- CVE-2024-35550 Cross-site request forgery in idccms:idccms
- CVE-2024-3555 Missing authorization in Social Link Pages: link-in-bio landing pages for your social media profiles
- CVE-2024-35548 A SQL injection vulnerability in Mybatis plus versions below 3.5.6 allows remote attackers to obtain database information via a Boolean blind injection.
- CVE-2024-35545 Cross-site scripting in mapos:map-os
- CVE-2024-35540 Cross-site scripting in typecho:typecho
- CVE-2024-3554 Cross-site scripting in All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic
- CVE-2024-35539 Race condition in typecho:typecho
- CVE-2024-35538 Security feature bypass in typecho:typecho
- CVE-2024-35537 Weak cryptography in tvsmotor:tvs connect
- CVE-2024-35532 An XML External Entity (XXE) injection vulnerability in Intersec Geosafe-ea 2022.12, 2022.13, and 2022.14 allows attackers to perform arbitr
- CVE-2024-3553 Tutor LMS <= 2.6.2 - Missing Authorization to Unauthenticated Limited Options Update
- CVE-2024-35527 An arbitrary file upload vulnerability in /fileupload/upload.cfm in Daemon PTY Limited FarCry Core framework before 7.2.14 allows attackers
- CVE-2024-35526 An issue in Daemon PTY Limited FarCry Core framework before 7.2.14 allows attackers to access sensitive information in the /facade directory.
- CVE-2024-35522 Command injection in netgear:ex3700 firmware
- CVE-2024-35520 Command injection in netgear:r7000 firmware
- CVE-2024-3552 Web Directory Free < 1.7.0 - Unauthenticated SQL Injection
- CVE-2024-35519 Command injection in netgear:ex3700 firmware
- CVE-2024-35518 Command injection in netgear:ex6120 firmware
- CVE-2024-35517 Command injection in netgear:xr1000 firmware
- CVE-2024-35515 sqlitedict insecure deserialization vulnerability
- CVE-2024-35512 hmq v1.5.5 is vulnerable to Denial of Service (DoS) due to a Null Pointer Exception.
- CVE-2024-35511 SQL injection in phpgurukul:men salon management system
- CVE-2024-35510 File upload in dedecms:dedecms
- CVE-2024-3551 Penci Soledad Data Migrator <= 1.3.0 - Unauthenticated Local File Inclusion
- CVE-2024-35504 Cross-site scripting in finesoft project:finesoft
- CVE-2024-3550 Cross-site scripting in WP Shortcodes Plugin — Shortcodes Ultimate
- CVE-2024-35498 Grav Cross-site Scripting vulnerability
- CVE-2024-35495 An Information Disclosure vulnerability in the Telemetry component in TP-Link Kasa KP125M V1.0.0 and Tapo P125M 1.0.0 Build 220930 Rel.14394
- CVE-2024-35492 Cesanta Mongoose commit b316989 was discovered to contain a NULL pointer dereference via the scpy function at src/fmt.c.
- CVE-2024-3549 Blog2Social: Social Media Auto Post & Scheduler <= 7.4.1 - Authenticated (Subscriber+) SQL Injection
- CVE-2024-3548 Shortcodes Ultimate < 7.1.2 - Contributor+ Stored XSS
- CVE-2024-35475 Cross-site request forgery in openkm:openkm
- CVE-2024-35474 A Directory Traversal vulnerability in iceice666 ResourcePack Server before v1.0.8 allows a remote attacker to disclose files on the server,
- CVE-2024-3547 Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.102 - Reflected Cross-Site Scripting
- CVE-2024-35469 SQL injection in oretnom23:human resource management system
- CVE-2024-35468 SQL injection in oretnom23:human resource management system
- CVE-2024-3546 WordPress Backup & Migration <= 1.4.8 - Missing Authorization to Directory Traversal
- CVE-2024-35451 Server-side request forgery in linkstack:linkstack
- CVE-2024-3545 Information disclosure in Remote Desktop Manager
- CVE-2024-3544 LoadMaster Hardcoded SSH Key
- CVE-2024-35434 Memory corruption in irontec:sngrep
- CVE-2024-35433 Missing authorization in zkteco:zkbio cvsecurity
- CVE-2024-35432 Cross-site scripting in zkteco:zkbio cvsecurity
- CVE-2024-35431 Path traversal in zkteco:zkbio cvsecurity
- CVE-2024-35430 Auth bypass in zkteco:zkbio cvsecurity
- CVE-2024-3543 LoadMaster Reversible Password Encryption Algorithm
- CVE-2024-35429 Path traversal in zkteco:zkbio cvsecurity
- CVE-2024-35428 Path traversal in zkteco:zkbio cvsecurity
- CVE-2024-35427 Denial of service in lonelycoder:vmir
- CVE-2024-35426 Memory corruption in lonelycoder:vmir
- CVE-2024-35425 Memory corruption in lonelycoder:vmir
- CVE-2024-35424 Denial of service in lonelycoder:vmir
- CVE-2024-35423 Memory corruption in lonelycoder:vmir
- CVE-2024-35422 Memory corruption in lonelycoder:vmir
- CVE-2024-35421 Denial of service in lonelycoder:vmir
- CVE-2024-35420 Memory corruption in kanaka:wac
- CVE-2024-3542 Campcodes Church Management System add_visitor.php cross site scripting
- CVE-2024-35419 Memory corruption in kanaka:wac
- CVE-2024-35418 Memory corruption in kanaka:wac
- CVE-2024-35410 Memory corruption in kanaka:wac
- CVE-2024-3541 Campcodes Church Management System admin_user.php cross site scripting
- CVE-2024-35409 SQL injection in webidsupport:webid
- CVE-2024-35403 Memory corruption in totolink:cp900l firmware
- CVE-2024-35401 Command injection in totolink:cp900l firmware
- CVE-2024-35400 Memory corruption in totolink:cp900l firmware
- CVE-2024-3540 Campcodes Church Management System add_sundaysch.php sql injection
- CVE-2024-35399 Memory corruption in totolink:cp900l firmware
- CVE-2024-35398 Memory corruption in totolink:cp900l firmware