Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 494 of 521.
- CVE-2024-11784 Cross-site scripting in TicketSource Ticket Shop
- CVE-2024-11783 Financial Calculator <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11782 WP Mailster <= 1.8.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11781 Smart Agenda – Prise de rendez-vous en ligne <= 4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11780 Site Search 360 <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-1178 SportsPress – Sports Club & League Manager <= 2.7.17 - Missing Authorization to Unauthenticated Event Permalink Update
- CVE-2024-11779 WIP WooCarousel Lite <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11778 CanadaHelps Embedded Donation <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11777 Sell Media <= 2.5.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11776 PCRecruiter Extensions <= 1.4.22 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11775 Particle Background <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11774 Outdooractive Embed <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11773 SQL injection in Cloud Services Application
- CVE-2024-11772 Command injection in Cloud Services Application
- CVE-2024-11771 Path traversal in Cloud Services Application
- CVE-2024-11770 Post Carousel & Slider <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-1177 Missing authorization in WP Club Manager – WordPress Sports Club Plugin
- CVE-2024-11769 Flower Delivery by Florist One <= 3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11768 Download manager <= 3.3.03 - Improper Authorization to Unauthenticated Download of Password-Protected Files
- CVE-2024-11767 NewsmanApp <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11766 Cross-site scripting in GS Books Showcase – Display Books in Grid, Slider & More | Library for WordPress
- CVE-2024-11765 Cross-site scripting in GS Portfolio – A Plugin for Making Filterable Portfolio Grid, Portfolio Slider and more
- CVE-2024-11764 Solar Wizard Lite <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11763 Plezi <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11761 LegalWeb Cloud <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11760 Currency Converter Widget ⚡ PRO <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-1176 HT Easy GA4 – Google Analytics WordPress Plugin <= 1.1.5 - Missing Authorization to Unauthenticated GA4 Email Update
- CVE-2024-11759 Bukza <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11758 WP SPID Italia <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11757 WP GeoNames <= 1.9.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11756 Cross-site scripting in SweepWidget – Contests, Giveaways, Sweepstakes & Photo Contests
- CVE-2024-11755 IMS Countdown <= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11754 Booking System Trafft <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11753 UMich OIDC Login <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11752 Eveeno <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11751 TCBD Popover <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11750 ONLYOFFICE DocSpace <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-1175 WP-Recall – Registration, Profile, Commerce & More <= 16.26.6 - Unauthenticated Payment Deletion via delete_payment
- CVE-2024-11749 App Embed <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11748 Taeggie Feed <= 0.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11747 Responsive Videos <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11746 Cross-site scripting in GS Brands for WooCommerce
- CVE-2024-11745 Tenda AC8 SetStaticRouteCfg route_static_check stack-based overflow
- CVE-2024-11744 1000 Projects Portfolio Management System MCA register.php sql injection
- CVE-2024-11743 SourceCodester Best House Rental Management System POST Request ajax.php cross-site request forgery
- CVE-2024-11742 SourceCodester Best House Rental Management System ajax.php cross site scripting
- CVE-2024-11741 Grafana Alerting VictorOps integration could be exposed to users with Viewer permission
- CVE-2024-11740 Download Manager <= 3.3.03 - Unauthenticated Arbitrary Shortcode Execution
- CVE-2024-1174 Memory corruption in HP ThinPro 8.0
- CVE-2024-11739 SQLi in Case Informatics' Case ERP
- CVE-2024-11738 Rustls: rustls network-reachable panic in `acceptor::accept`
- CVE-2024-11737 Denial of service in Modicon Controllers M241 / M251
- CVE-2024-11736 Org.keycloak:keycloak-quarkus-server: unrestricted admin use of system and environment variables
- CVE-2024-11734 Org.keycloak:keycloak-quarkus-server: denial of service in keycloak server via security headers
- CVE-2024-11733 WordPress Popular Posts <= 7.1.0 - Unauthenticated Arbitrary Shortcode Execution
- CVE-2024-11732 BP Profile Shortcodes Extra <= 2.6.0 - Authenticated (Contributor+) SQL Injection via tab Parameter
- CVE-2024-11731 Cross-site scripting in Master Slider – Responsive Touch Slider
- CVE-2024-11730 KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Doctor/Receptionist+) SQL Injection
- CVE-2024-1173 SQL injection in ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support
- CVE-2024-11729 KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Subscriber+) SQL Injection
- CVE-2024-11728 KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Unauthenticated SQL Injection
- CVE-2024-11727 Cross-site scripting in NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar
- CVE-2024-11726 SQL injection in Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress
- CVE-2024-11725 Missing authorization in SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery
- CVE-2024-11724 Missing authorization in Cookie Banner for GDPR / CCPA – WPLP Cookie Consent
- CVE-2024-11723 kvCORE IDX <= 2.3.35 - Reflected Cross-Site Scripting
- CVE-2024-11722 Frontend Admin by DynamiApps <= 3.25.1 - Unauthenticated SQL Injection
- CVE-2024-11721 Frontend Admin by DynamiApps <= 3.24.5 - Unauthenticated Privilege Escalation
- CVE-2024-11720 Frontend Admin by DynamiApps <= 3.24.5 - Unauthenticated Stored Cross-Site Scripting
- CVE-2024-1172 Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets
- CVE-2024-11719 tarteaucitron.js for WordPress < 0.3.0 - Stored XSS via CSRF
- CVE-2024-11718 tarteaucitron.js for WordPress < 0.3.0 - Author+ Stored XSS
- CVE-2024-11717 Auth bypass in CTFd
- CVE-2024-11716 Business logic in CTFd
- CVE-2024-11715 WP Job Portal <= 2.2.2 - Missing Authorization to Limited Privilege Escalation
- CVE-2024-11714 WP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL Injection via getFieldsForVisibleCombobox()
- CVE-2024-11713 WP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL Injection via wpjobportal_deactivate()
- CVE-2024-11712 WP Job Portal <= 2.2.2 - Missing Authorization to Unauthenticated Arbitrary Resume Download
- CVE-2024-11711 WP Job Portal <= 2.2.1 - Unauthenticated SQL Injection
- CVE-2024-11710 WP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL Injection
- CVE-2024-1171 Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets
- CVE-2024-11709 AI Post Generator | AutoWriter <= 3.5 - Missing Authorization to Authenticated (Contributor+) Post/Page Deletion
- CVE-2024-11708 Race condition in Firefox
- CVE-2024-11707 My auctions allegro <= 3.6.17 - Reflected Cross-Site Scripting
- CVE-2024-11706 Null dereference in Firefox
- CVE-2024-11705 Null dereference in Firefox
- CVE-2024-11704 Memory corruption in Firefox
- CVE-2024-11703 Auth bypass in Firefox
- CVE-2024-11702 Information disclosure in Firefox
- CVE-2024-11701 Other in Firefox
- CVE-2024-11700 Security feature bypass in Firefox
- CVE-2024-1170 Missing authorization in Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)
- CVE-2024-11699 Memory corruption in Firefox
- CVE-2024-11698 Denial of service in Firefox
- CVE-2024-11697 Security feature bypass in Firefox
- CVE-2024-11696 Security feature bypass in Firefox
- CVE-2024-11695 Other in Firefox
- CVE-2024-11694 Cross-site scripting in Firefox
- CVE-2024-11693 Security feature bypass in Firefox
- CVE-2024-11692 Security feature bypass in Firefox