Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 480 of 521.
- CVE-2024-13150 SQLi in Fayton Software's fayton.pro ERP
- CVE-2024-1315 Classified Listing <= 3.0.4 - Cross-Site Request Forgery to Account Takeover via rtcl_update_user_account
- CVE-2024-13149 SQLi in Arma Store's Armalife
- CVE-2024-13148 SQLi in Yukseloglu Filter's B2B Login Platform
- CVE-2024-13147 SQLi in Merkur Software's B2B Login Panel
- CVE-2024-13146 Booknetic < 4.1.5 - Staff Creation via CSRF
- CVE-2024-13145 zhenfeng13 My-Blog uploadController. java upload unrestricted upload
- CVE-2024-13144 zhenfeng13 My-Blog BlogController.java uploadFileByEditomd unrestricted upload
- CVE-2024-13143 ZeroWdd studentmanager PermissionController. java submitAddPermission cross site scripting
- CVE-2024-13142 ZeroWdd studentmanager RoleController. java submitAddRole cross site scripting
- CVE-2024-13141 osuuu LightPicture SVG File Upload upload cross site scripting
- CVE-2024-13140 Emlog Pro Cover Upload article.php cross site scripting
- CVE-2024-13139 wangl1989 mysiteforme FileController doContent server-side request forgery
- CVE-2024-13138 wangl1989 mysiteforme LocalUploadServiceImpl upload unrestricted upload
- CVE-2024-13137 wangl1989 mysiteforme SiteController RestResponse cross site scripting
- CVE-2024-13136 wangl1989 mysiteforme ShiroConfig.java rememberMeManager deserialization
- CVE-2024-13135 Emlog Pro Subpage twitter.php cross site scripting
- CVE-2024-13134 ZeroWdd studentmanager TeacherController. java editTeacher unrestricted upload
- CVE-2024-13133 ZeroWdd studentmanager StudentController. java editStudent unrestricted upload
- CVE-2024-13132 Emlog Pro Subpage article.php cross site scripting
- CVE-2024-13130 Dahua IPC-HFW1200S Web Interface Sha1Account1 path traversal
- CVE-2024-1313 Users outside an organization can delete a snapshot with its key
- CVE-2024-13129 Roxy-WI roxy.py action_service os command injection
- CVE-2024-13128 LearnPress – WordPress LMS Plugin < 4.2.7.5.1 - Admin+ Stored XSS
- CVE-2024-13127 LearnPress – WordPress LMS Plugin < 4.2.7.5.1 - Admin+ Stored XSS
- CVE-2024-13126 Download Manager < 3.3.07 - Unauthenticated Data Exposure
- CVE-2024-13125 Everest Forms < 3.0.8.1 - Admin+ Stored XSS
- CVE-2024-13124 Photo Gallery by 10Web < 1.8.33 - Admin+ Stored XSS
- CVE-2024-13123 AFI < 1.100.0 - Admin+ Stored XSS
- CVE-2024-13122 AFI < 1.100.0 - Admin+ Stored XSS
- CVE-2024-13121 Paid Membership Plugin < 4.15.20 - Admin+ Stored XSS
- CVE-2024-13120 ProfilePress < 4.15.20 - Admin+ Stored XSS
- CVE-2024-1312 Kernel: race condition leads to use after free during vma lock in lock_vma_under_rcu
- CVE-2024-13119 ProfilePress < 4.15.20 - Admin+ Stored XSS
- CVE-2024-13118 IP Based Login < 2.4.1 - Log Deletion via CSRF
- CVE-2024-13117 Social Share Buttons for WordPress <= 2.7 - Unauthenticated Image Upload & Path Traversal
- CVE-2024-13116 Crelly Slider < 1.4.7 - Admin+ Stored XSS
- CVE-2024-13115 WP Projects Portfolio with Client Testimonials <= 3.0 - Stored XSS via CSRF
- CVE-2024-13114 WP Projects Portfolio with Client Testimonials <= 3.0 - Reflected XSS
- CVE-2024-13113 Countdown Timer for Elementor < 1.3.7 - Contributor+ Stored XSS
- CVE-2024-13112 WP MediaTagger <= 4.1.1 - Reflected XSS
- CVE-2024-13111 Beijing Yunfan Internet Technology Yunfan Learning Examination System JWT Token SysUserControl improper authentication
- CVE-2024-13110 Information disclosure in Yunfan Learning Examination System
- CVE-2024-1311 Brizy – Page Builder <= 2.4.40 - Authenticated (Contributor+) Arbitrary File Upload
- CVE-2024-13109 Beijing Yunfan Internet Technology Yunfan Learning Examination System doc.html improper authorization
- CVE-2024-13108 D-Link DIR-816 A2 form2NetSniper.cgi access control
- CVE-2024-13107 D-Link DIR-816 A2 ACL form2LocalAclEditcfg.cgi access control
- CVE-2024-13106 D-Link DIR-816 A2 IP QoS form2IPQoSTcAdd access control
- CVE-2024-13105 D-Link DIR-816 A2 DHCPD Setting form2Dhcpd.cgi access control
- CVE-2024-13104 D-Link DIR-816 A2 WiFi Settings form2AdvanceSetup.cgi access control
- CVE-2024-13103 D-Link DIR-816 A2 Virtual Service form2AddVrtsrv.cgi access control
- CVE-2024-13102 D-Link DIR-816 A2 DDNS Service access control
- CVE-2024-13101 WP MediaTagger <= 4.1.1 - Contributor+ Stored XSS
- CVE-2024-13100 Woo UPS Pickup <= 2.6.3 - Reflected XSS
- CVE-2024-1310 WooCommerce < 8.6 - Contributor+ Private/Draft Products Access
- CVE-2024-13099 Widget4call <= 1.0.7 - Reflected XSS
- CVE-2024-13098 WP Email Newsletter <= 1.1 - Reflected XSS
- CVE-2024-13097 WP Finance <= 1.3.6 - Reflected XSS
- CVE-2024-13096 WP Finance <= 1.3.6 - Stored XSS via CSRF
- CVE-2024-13095 WP Triggers Lite <= 2.5.3 - Admin+ SQL Injection
- CVE-2024-13094 WP Triggers Lite <= 2.5.3 - Reflected XSS
- CVE-2024-13093 code-projects Job Recruitment Seeker Profile _call_main_search_ajax.php sql injection
- CVE-2024-13092 code-projects Job Recruitment Job Post search_ajax.php sql injection
- CVE-2024-13091 WPBot Pro Wordpress Chatbot <= 13.5.4 - Unauthenticated Arbitrary File Upload
- CVE-2024-13090 Privilege escalation in Guardian/CMC before 24.6.0
- CVE-2024-1309 Resource Consumption Identified in NTP before 4.2.4p8 and 4.2.5
- CVE-2024-13089 Authenticated RCE in update functionality in Guardian/CMC before 24.6.0
- CVE-2024-13088 QHora
- CVE-2024-13087 QHora
- CVE-2024-13086 QTS, QuTS hero
- CVE-2024-13085 PHPGurukul Land Record System login.php sql injection
- CVE-2024-13084 PHPGurukul Land Record System search-property.php sql injection
- CVE-2024-13083 PHPGurukul Land Record System admin-profile.php cross site scripting
- CVE-2024-13082 PHPGurukul Land Record System search-property.php cross site scripting
- CVE-2024-13081 PHPGurukul Land Record System contactus.php cross site scripting
- CVE-2024-13080 PHPGurukul Land Record System aboutus.php cross site scripting
- CVE-2024-1308 WooCommerce Cloak Affiliate Links <= 1.0.33 - Missing Authorization to Unauthenticated Permalink Modification
- CVE-2024-13079 PHPGurukul Land Record System property-details.php sql injection
- CVE-2024-13078 PHPGurukul Land Record System index.php sql injection
- CVE-2024-13077 PHPGurukul Land Record System add-property.php cross site scripting
- CVE-2024-13076 PHPGurukul Land Record System edit-propertytype.php cross site scripting
- CVE-2024-13075 PHPGurukul Land Record System add-propertytype.php cross site scripting
- CVE-2024-13074 PHPGurukul Land Record System index.php cross site scripting
- CVE-2024-13073 XSS in Akinsoft's TaskPano
- CVE-2024-13072 1000 Projects Beauty Parlour Management System Customer Detail add-customer-services.php sql injection
- CVE-2024-13071 XSS in Akinsoft's e-Mutabakat
- CVE-2024-13070 CodeAstro Online Food Ordering System Update User Page update_users.php sql injection
- CVE-2024-1307 Smart Forms < 2.6.94 - Subscriber+ Edit Entries via Broken Access Control
- CVE-2024-13069 SourceCodester Multi Role Login System add-user.php cross site scripting
- CVE-2024-13068 Host Header Injection in Akinsoft's LimonDesk
- CVE-2024-13067 CodeAstro Online Food Ordering System All Users Page all_users.php access control
- CVE-2024-13066 iFrame Injection in Akinsoft's LimonDesk
- CVE-2024-13065 Business Logic Error in Akinsoft's MyRezzta
- CVE-2024-13064 XSS in Akinsoft's MyRezzta
- CVE-2024-13063 IDOR in Akinsoft's MyRezzta
- CVE-2024-13062 Command injection in Router
- CVE-2024-13061 2100 Technology Electronic Official Document Management System - Authentication Bypass
- CVE-2024-13060 Improper Authorization in mintplex-labs/anything-llm
- CVE-2024-1306 Smart Forms < 2.6.94 - Edit Entries via CSRF
- CVE-2024-13059 Path Traversal in mintplex-labs/anything-llm