Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 486 of 521.
- CVE-2024-12558 Missing authorization in WP BASE Booking of Appointments, Services and Events
- CVE-2024-12557 Transporters.io <= 2.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- CVE-2024-12556 Kibana Prototype Pollution can lead to code injection
- CVE-2024-12555 SIP Calculator <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- CVE-2024-12554 Peter’s Custom Anti-Spam <= 3.2.3 - Cross-Site Request Forgery via cas_register_post Function
- CVE-2024-12553 GeoVision GV-ASManager Missing Authorization Information Disclosure Vulnerability
- CVE-2024-12552 Wacom Center WTabletServicePro Link Following Local Privilege Escalation Vulnerability
- CVE-2024-12551 Tungsten Automation Power PDF JP2 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
- CVE-2024-12550 Tungsten Automation Power PDF JP2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
- CVE-2024-1255 sepidz SepidzDigitalMenu Waiters information disclosure
- CVE-2024-12549 Tungsten Automation Power PDF JP2 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
- CVE-2024-12548 Tungsten Automation Power PDF JP2 File Parsing Use-After-Free Information Disclosure Vulnerability
- CVE-2024-12547 Tungsten Automation Power PDF JPF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
- CVE-2024-12545 Scratch & Win – Giveaways and Contests <= 2.7.1 - Cross-Site Request Forgery via reset_installation Function
- CVE-2024-12544 Missing authorization in SurveyJS: Drag & Drop Form Builder
- CVE-2024-12543 A user enumeration and subsequent data integrity vulnerability affecting barcode functionality
- CVE-2024-12542 linkID <= 0.1.2 - Missing Authorization to Unauthenticated Sensitive Information Exposure
- CVE-2024-12541 Chative Live chat and Chatbot <= 1.1 - Cross-Site Request Forgery via add_chative_widget_action Function
- CVE-2024-1254 Byzoro Smart S20 Management Platform sysmanageajax.php sql injection
- CVE-2024-12539 Elasticsearch Incorrect Authorization
- CVE-2024-12538 Duplicate Post, Page and Any Custom Post <= 3.5.5 - Authenticated (Contributor+) Post Disclosure via Post Duplication
- CVE-2024-12536 SourceCodester Kortex Lite Advocate Office Management System client_data.php cross site scripting
- CVE-2024-12535 Host PHP Info <= 1.0.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure
- CVE-2024-12533 Other in SecureCore Technology 4
- CVE-2024-12532 BWD Elementor Addons <= 4.3.18 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates
- CVE-2024-12530 Insecure Dynamic-Link Library (DLL) Load vulnerability
- CVE-2024-1253 Byzoro Smart S40 Management Platform Import web.php unrestricted upload
- CVE-2024-12529 brodos.net Onlineshop Plugin <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12528 Cross-site scripting in WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress
- CVE-2024-12527 Perfect Portal Widgets <= 3.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12526 Arena.IM – Live Blogging for real-time events <= 0.4.1 - Cross-Site Request Forgery to Settings Update
- CVE-2024-12525 Easy MLS Listings Import <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12524 Clinked Client Portal <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12523 States Map US <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12522 Cross-site scripting in Yay! Forms
- CVE-2024-12521 Slotti Ajanvaraus <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12520 Dominion – Domain Checker for WPBakery <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-1252 Tongda OA 2017 delete.php sql injection
- CVE-2024-12519 TCBD Auto Refresher <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12518 shMapper by Teplitsa <= 1.4.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12517 WooCommerce Cart Count Shortcode <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12516 Coupon Plugin <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12515 Muslim Prayer Time-Salah/Iqamah <= 1.8.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12514 3DVieweronline <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12513 Contests by Rewards Fuel <= 2.0.65 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12512 Ask Me Anything (Anonymously) <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12511 SMB/FTP Address Book Scan Pass-back attack
- CVE-2024-12510 LDAP Authentication Sever Pass-back attack
- CVE-2024-1251 Tongda OA 2017 delete.php sql injection
- CVE-2024-12509 Embed Twine <= 0.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12508 Glofox Shortcodes <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12507 Optio Dentistry <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12506 NACC WordPress Plugin <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12505 Trackserver <= 5.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12504 Cross-site scripting in Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
- CVE-2024-12503 ClassCMS Model Management Page admin cross site scripting
- CVE-2024-12502 My IDX Home Search <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12501 Simple Locator <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12500 Philantro – Donations and Donor Management <= 5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-1250 Privilege Chaining in GitLab
- CVE-2024-12499 WP jQuery DataTable <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12497 1000 Projects Attendance Tracking Management System check_admin_login.php sql injection
- CVE-2024-12496 Linear <= 2.7.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12495 Bootstrap Blocks for WP Editor v2 <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12494 BMLT Meeting Map <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12493 Files Download Delay <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12492 code-projects Farmacia visualizar-usuario.php sql injection
- CVE-2024-12491 SimplyRETS Real Estate IDX <= 2.11.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12490 code-projects Online Class and Exam Scheduling System teacher_save.php sql injection
- CVE-2024-1249 Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos
- CVE-2024-12489 code-projects Online Class and Exam Scheduling System term.php sql injection
- CVE-2024-12488 code-projects Online Class and Exam Scheduling System subject_update.php sql injection
- CVE-2024-12487 code-projects Online Class and Exam Scheduling System room_update.php sql injection
- CVE-2024-12486 code-projects Online Class and Exam Scheduling System rank_update.php sql injection
- CVE-2024-12485 code-projects Online Class and Exam Scheduling System department.php sql injection
- CVE-2024-12484 Codezips Technical Discussion Forum signuppost.php sql injection
- CVE-2024-12483 Dromara UJCMS User ID id authorization
- CVE-2024-12482 cjbi wetech-cms Database Backup BackupFileUtil.java backup path traversal
- CVE-2024-12481 cjbi wetech-cms UserDao.java findUser sql injection
- CVE-2024-12480 cjbi wetech-cms TopicDao.java searchTopic sql injection
- CVE-2024-1248 Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation
- CVE-2024-12479 cjbi wetech-cms TopicDao.java searchTopicByKeyword sql injection
- CVE-2024-12478 InvoicePlane 1 upload_file unrestricted upload
- CVE-2024-12477 Avada Builder <= 3.11.11 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets
- CVE-2024-12476 XML external entity in Web Designer for BMENOC0311(C)
- CVE-2024-12475 WP Multi Store Locator <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12474 GeoDataSource Country Region DropDown <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12473 SQL injection in Opace AI Scribe: SEO Content Creator & Humaizer for OpenAI & Anthropic
- CVE-2024-12472 Post Duplicator <= 2.36 - Authenticated (Contributor+) Protected Post Disclosure
- CVE-2024-12471 File upload in Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator
- CVE-2024-12470 School Management System – SakolaWP <= 1.0.8 - Unauthenticated Privilege Escalation
- CVE-2024-1247 Concrete CMS version 9 before 9.2.5 vulnerable to stored XSS via the Role Name field
- CVE-2024-12469 WP BASE Booking of Appointments, Services and Events <= 4.9.1 - Reflected Cross-Site Scripting via status Parameter
- CVE-2024-12468 WP Datepicker <= 2.1.4 - Reflected Cross-Site Scripting
- CVE-2024-12467 Pago por Redsys <= 1.0.12 - Reflected Cross-Site Scripting
- CVE-2024-12466 Proofreading <= 1.2.1.1 - Reflected Cross-Site Scripting
- CVE-2024-12465 Property Hive Stamp Duty Calculator <= 1.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12464 Chatroll Live Chat <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12463 Cross-site scripting in Arena.IM – Live Blogging for real-time events
- CVE-2024-12462 YOGO Booking <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting