Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 488 of 521.
- CVE-2024-12365 W3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgery
- CVE-2024-12364 SQLi in Mavi Yeşil Software's Guest Tracking Software
- CVE-2024-12363 Insufficient permissions in the TeamViewer Patch & Asset Management component
- CVE-2024-12362 InvoicePlane invoices.php download path traversal
- CVE-2024-12360 code-projects Online Class and Exam Scheduling System class_update.php sql injection
- CVE-2024-1236 Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets
- CVE-2024-12359 code-projects Admin Dashboard vendor_management.php cross site scripting
- CVE-2024-12358 WeiYe-Jing datax-web add os command injection
- CVE-2024-12357 SourceCodester Best House Rental Management System index.php file inclusion
- CVE-2024-12356 BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability
- CVE-2024-12355 SourceCodester Phone Contact Manager System ContactBook.cpp adding input validation
- CVE-2024-12354 SourceCodester Phone Contact Manager System User Menu MenuDisplayStart buffer overflow
- CVE-2024-12353 SourceCodester Phone Contact Manager System User Menu MenuDisplayStart input validation
- CVE-2024-12352 TOTOLINK EX1800T cstecgi.cgi sub_40662C stack-based overflow
- CVE-2024-12351 JFinalCMS File Content ContentModel.java findPage sql injection
- CVE-2024-12350 JFinalCMS Template TemplateController.java update command injection
- CVE-2024-1235 Elementor Addons by Livemesh <= 8.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12349 JFinalCMS save cross-site request forgery
- CVE-2024-12348 Guizhou Xiaoma Technology jpress Attachment Upload upload AttachmentUtils.isUnSafe cross site scripting
- CVE-2024-12347 Guangzhou Huayi Intelligent Technology Jeewms Druid Monitoring Interface index.html improper authorization
- CVE-2024-12346 Talentera byt_cv_manager cross site scripting
- CVE-2024-12345 INW Krbyyyzo Daily Huddle Site gbo.aspx resource consumption
- CVE-2024-12344 TP-Link VN020 F3v(T) FTP USER Command memory corruption
- CVE-2024-12343 TP-Link VN020 F3v(T) SOAP Request WANIPConnection buffer overflow
- CVE-2024-12342 TP-Link VN020 F3v(T) Incomplete SOAP Request WANIPConnection denial of service
- CVE-2024-12341 Missing authorization in Custom Skins Contact Form 7
- CVE-2024-12340 Information disclosure in Animation Addons for Elementor – GSAP Motion Elementor Addons & Website Templates
- CVE-2024-1234 Exclusive Addons for Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12339 Digihood HTML Sitemap <= 3.1.1 - Reflected Cross-Site Scripting via 'channel'
- CVE-2024-12338 Website Toolbox Community <= 2.0.1 - Reflected Cross-Site Scripting via websitetoolbox_username
- CVE-2024-12337 Shipping via Planzer for WooCommerce <= 1.0.25 - Reflected Cross-Site Scripting via processed-ids
- CVE-2024-12336 Missing authorization in WC Affiliate – WooCommerce Affiliate Plugin
- CVE-2024-12335 Avada Builder <= 3.11.12 - Authenticated (Contributor+) Protected Post Disclosure
- CVE-2024-12334 WC Affiliate – A Complete WooCommerce Affiliate Plugin <= 2.4 - Reflected Cross-Site Scripting
- CVE-2024-12333 WoodMart <= 8.0.3 - Unauthenticated Arbitrary Shortcode Execution
- CVE-2024-12332 School Management System – WPSchoolPress <= 2.2.14 - Authenticated (Student/Parent+) SQL Injection
- CVE-2024-12331 Missing authorization in File Manager Pro – Filester
- CVE-2024-12330 Information disclosure in WP Database Backup – Unlimited Database & Files Backup by Backup for WP
- CVE-2024-1233 Eap: wildfly-elytron has a ssrf security issue
- CVE-2024-12329 Essential Real Estate <= 5.1.6 - Missing Authorization to Authenticated (Contributor+) Information Exposure
- CVE-2024-12328 MAS Elementor <= 1.1.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
- CVE-2024-12327 LazyLoad Background Images <= 1.0.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update
- CVE-2024-12326 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Jirafeau
- CVE-2024-12325 Waymark <= 1.4.1 - Reflected Cross-Site Scripting via 'content'
- CVE-2024-12324 Unilevel MLM Plan <= 1.1.0 - Reflected Cross-Site Scripting via 'page'
- CVE-2024-12323 turboSMTP <= 4.6 - Reflected Cross-Site Scripting via 'page'
- CVE-2024-12322 ThePerfectWedding.nl Widget <= 2.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- CVE-2024-12321 WC Affiliate <= 2.3.9 - Reflected XSS
- CVE-2024-12320 Team Rosters <= 4.7 - Reflected Cross-Site Scripting via 'tab'
- CVE-2024-1232 CM Download Manager < 2.9.0 - Download Deletion via CSRF
- CVE-2024-12316 Jupiter X Core <= 4.8.5 - Missing Authorization to Unauthenticated Popup Template Export
- CVE-2024-12315 Export All Posts, Products, Orders, Refunds & Users <= 2.9.3 - Information Disclosure Through Unprotected Directory
- CVE-2024-12314 Rapid Cache <= 1.2.3 - Unauthenticated Cache Poisoning
- CVE-2024-12313 Compare Products for WooCommerce <= 3.2.1 - Unauthenticated PHP Object Injection
- CVE-2024-12312 Print Science Designer <= 1.3.152 - Unauthenticated PHP Object Injection
- CVE-2024-12311 Email Subscribers < 5.7.44 - Admin+ SQL Injection
- CVE-2024-12310 Bypass of Login Screen on Shared Kiosk Workstations
- CVE-2024-1231 CM Download and File Manager < 2.9.0 - Download Unpublish via CSRF
- CVE-2024-12309 Rate My Post – Star Rating Plugin by FeedbackWP <= 4.2.4 - Unauthenticated Voting On Scheduled Posts
- CVE-2024-12308 Logo Slider < 4.6.0 - Contributor+ Stored XSS
- CVE-2024-12307 Function-Level Access Control Vulnerability Allows Unauthorized Modification of Student Data in Unifiedtransform
- CVE-2024-12306 Access Control Vulnerabilities Allow Unauthorized Access to User Profiles in Unifiedtransform
- CVE-2024-12305 Object-Level Access Control Vulnerability Allows Unauthorized Access to Student Grades in Unifiedtransform
- CVE-2024-12304 Cross-site scripting in Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- CVE-2024-12303 Incorrect Privilege Assignment in GitLab
- CVE-2024-12302 Icegram Engage < 3.1.32 - Author+ Stored XSS
- CVE-2024-12301 JSP Store Locator <= 1.0 - Deletion via Missing CSRF
- CVE-2024-12300 AR for WordPress <= 7.3 - Missing Authorization to Unauthenticated Limited File Upload
- CVE-2024-1230 SimpleShop <= 2.10.0 - Cross-Site Request Forgery
- CVE-2024-12299 System Dashboard <= 2.8.17 - Reflected Cross-Site Scripting via Filename Parameter
- CVE-2024-12298 Vulnerability Report on Improper Restriction of XML External Entity Reference in NB-Designer
- CVE-2024-12297 Frontend Authorization Logic Disclosure Vulnerability
- CVE-2024-12296 Apus Framework <= 2.4 - Authenticated (Subscriber+) Arbitrary Options Update in import_page_options
- CVE-2024-12295 Auth bypass in BoomBox Theme Extensions
- CVE-2024-12294 Last Viewed Posts by WPBeginner <= 1.0.1 - Unauthenticated Sensitive Information Exposure
- CVE-2024-12293 User Role Editor <= 4.64.3 - Cross-Site Request Forgery to Privilege Escalation
- CVE-2024-12292 Insertion of Sensitive Information into Log File in GitLab
- CVE-2024-12291 ViewMedica 9 <= 1.4.17 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
- CVE-2024-12290 Infility Global <= 2.9.8 - Reflected Cross-Site Scripting via set_type Parameter
- CVE-2024-1229 SimpleShop <= 2.10.2 - Missing Authorization
- CVE-2024-12289 Boundary Controller Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of Service
- CVE-2024-12288 Simple add pages or posts <= 2.0.0 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
- CVE-2024-12287 Biagiotti Membership <= 1.0.2 - Authentication Bypass via biagiotti_membership_check_facebook_user
- CVE-2024-12286 MOBATIME Network Master Clock has a use of default credentials vulnerability
- CVE-2024-12285 SEMA API <= 5.27 - Reflected Cross-Site Scripting via catid Parameter
- CVE-2024-12284 Authenticated privilege escalation
- CVE-2024-12283 WP Pipes <= 1.4.1 - Reflected Cross-Site Scripting via x1 Parameter
- CVE-2024-12282 WordPress连接微博 <= 2.5.6 - Stored XSS via CSRF
- CVE-2024-12281 Homey <= 2.4.2 - Unauthenticated Privilege Escalation in homey_save_profile
- CVE-2024-12280 WP Customer Area <= 8.2.4 - Event Log Deletion via CSRF
- CVE-2024-1228 Hardcoded password in Eurosoft Przychodnia
- CVE-2024-12279 WP Social AutoConnect <= 4.6.2 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
- CVE-2024-12278 Booster for WooCommerce <= 7.2.4 - Unauthenticated Stored Cross-Site Scripting
- CVE-2024-12276 Ultimate Member <= 2.9.2 - Authenticated SQL Injection
- CVE-2024-12275 CanvasFlow <= 1.5.5 - Reflected XSS
- CVE-2024-12274 BookingPress < 1.1.23 - Unauthenticated Export File Download
- CVE-2024-12273 Calculated Fields Form < 5.2.62 - Admin+ Stored XSS
- CVE-2024-12272 Path traversal in WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor
- CVE-2024-12271 360 Javascript Viewer <= 1.7.29 - Authenticated (Administrator+) Stored Cross-Site Scripting
- CVE-2024-12270 Beautiful Taxonomy Filters <= 2.4.3 - Unauthenticated SQL Injection