Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 499 of 521.
- CVE-2024-11306 Altenergy Power Control Software database improper authorization
- CVE-2024-11305 Altenergy Power Control Software status_zigbee get_status_zigbee sql injection
- CVE-2024-11304 Multiple Stored Cross-Site Scripting
- CVE-2024-11303 Path Traversal
- CVE-2024-11302 Missing check_access in lollms_binding_infos in parisneo/lollms
- CVE-2024-11301 Improper Enforcement of Unique Constraint in lunary-ai/lunary
- CVE-2024-11300 Improper Access Control in lunary-ai/lunary
- CVE-2024-1130 NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_read()
- CVE-2024-11299 Memberpress <= 1.11.37 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
- CVE-2024-11297 Information disclosure in Page and Post Restriction
- CVE-2024-11295 Simple Page Access Restriction <= 1.0.29 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
- CVE-2024-11294 Memberful <= 1.73.9 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
- CVE-2024-11293 Auth bypass in Pie Register - Social Sites Login (Add on)
- CVE-2024-11292 WP Private Content Plus <= 3.6.1 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
- CVE-2024-11291 Information disclosure in Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
- CVE-2024-11290 Member Access <= 1.1.6 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
- CVE-2024-1129 NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_starred()
- CVE-2024-11289 Soledad <= 8.5.9 - Unauthenticated Limited Local File Inclusion
- CVE-2024-11287 Ebook Store <= 5.8001 - Reflected Cross-Site Scripting
- CVE-2024-11286 WP JobHunt <= 7.1 - Authentication Bypass
- CVE-2024-11285 WP JobHunt <= 7.1 - Unauthenticated Privilege Escalation via Email Update/Account Takeover
- CVE-2024-11284 WP JobHunt <= 7.1 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover
- CVE-2024-11283 WP JobHunt <= 7.1 - Authentication Bypass to Candidate
- CVE-2024-11282 Information disclosure in Passster – Password Protect Pages and Content
- CVE-2024-11281 Missing authorization in WooCommerce Point of Sale
- CVE-2024-11280 PPWP – Password Protect Pages <= 1.9.5 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
- CVE-2024-1128 Tutor LMS <= 2.6.0 - Authenticated(Student+) HTML Injection via Q&A
- CVE-2024-11279 Schema App Structured Data <= 2.2.4 - Reflected Cross-Site Scripting
- CVE-2024-11278 GD bbPress Attachments <= 4.7.2 - Reflected Cross-Site Scripting
- CVE-2024-11277 404 Solution <= 2.35.19 - Reflected Cross-Site Scripting
- CVE-2024-11276 PDF Builder for WooCommerce. Create invoices,packing slips and more <= 1.2.136 - Reflected Cross-Site Scripting
- CVE-2024-11275 Missing authorization in Timetics – Appointment Booking & Scheduling
- CVE-2024-11274 URL Redirection to Untrusted Site ('Open Redirect') in GitLab
- CVE-2024-11273 Contact Form & SMTP Plugin for WordPress by PirateForms < 2.6.0 - Admin+ Stored XSS
- CVE-2024-11272 Contact Form & SMTP Plugin for WordPress by PirateForms < 2.6.0 - Admin+ Stored XSS
- CVE-2024-11271 Missing authorization in WebinarPress – Webinar System for WordPress
- CVE-2024-11270 Missing authorization in WebinarPress – Webinar System for WordPress
- CVE-2024-1127 Missing authorization in EventPrime – Events Calendar, Bookings and Tickets
- CVE-2024-11269 AHAthat Plugin <= 1.6 - Admin+ SQL Injection
- CVE-2024-11268 PDF File Parsing Vulnerability in Autodesk Revit
- CVE-2024-11267 JSP Store Locator <= 1.0 - Contributor+ SQL Injection
- CVE-2024-11266 Geocache Stat Bar Widget <= 0.911 - Admin+ Stored XSS
- CVE-2024-11265 Wp Maximum Upload File Size <= 1.1.3 - Authenticated (Author+) Full Path Disclosure
- CVE-2024-11263 arch: riscv: userspace: potential security risk when CONFIG_RISCV_GP=y
- CVE-2024-11262 SourceCodester Student Record Management System View All Student Marks main stack-based overflow
- CVE-2024-11261 Memory corruption in Student Record Management System
- CVE-2024-11260 SQL injection in Events Manager – Calendar, Bookings, Tickets, and more!
- CVE-2024-1126 Missing authorization in EventPrime – Events Calendar, Bookings and Tickets
- CVE-2024-11259 code-projects Farmacia fornecedores.php cross site scripting
- CVE-2024-11258 1000 Projects Beauty Parlour Management System index.php sql injection
- CVE-2024-11257 1000 Projects Beauty Parlour Management System forgot-password.php sql injection
- CVE-2024-11256 1000 Projects Portfolio Management System MCA login.php sql injection
- CVE-2024-11254 AMP for WP – Accelerated Mobile Pages <= 1.1.1 - Reflected Cross-Site Scripting
- CVE-2024-11253 Command injection in VMG8825-T50K firmware
- CVE-2024-11252 Cross-site scripting in Social Sharing Plugin – Sassy Social Share
- CVE-2024-11251 erzhongxmu Jeewms AuthInterceptor cgReportController.do sql injection
- CVE-2024-11250 code-projects Inventory Management editProduct.php sql injection
- CVE-2024-1125 Missing authorization in EventPrime – Events Calendar, Bookings and Tickets
- CVE-2024-11248 Tenda AC10 SetSysAutoRebbotCfg formSetRebootTimer stack-based overflow
- CVE-2024-11247 SourceCodester Online Eyewear Shop Inventory Page Master.php cross site scripting
- CVE-2024-11246 code-projects Farmacia adicionar-cliente.php cross site scripting
- CVE-2024-11245 code-projects Farmacia editar-produto.php sql injection
- CVE-2024-11244 code-projects Farmacia editar-cliente.php sql injection
- CVE-2024-11243 code-projects Online Shop Store signup.php cross site scripting
- CVE-2024-11242 ZZCMS Keyword Filtering ad_list.php sql injection
- CVE-2024-11241 code-projects Job Recruitment reset.php sql injection
- CVE-2024-11240 IBPhoenix ibWebAdmin Banco de Dados Tab database.php cross site scripting
- CVE-2024-1124 Missing authorization in EventPrime – Events Calendar, Bookings and Tickets
- CVE-2024-11239 Landray EKP API Interface import.do deleteFile path traversal
- CVE-2024-11238 Landray EKP sysUiComponent.do delPreviewFile path traversal
- CVE-2024-11237 TP-Link VN020 F3v(T) DHCP DISCOVER Packet Parser TP-Thumper stack-based overflow
- CVE-2024-11236 Integer overflow in the firebird and dblib quoters causing OOB writes
- CVE-2024-11235 Reference counting in php_request_shutdown causes Use-After-Free
- CVE-2024-11234 Configuring a proxy in a stream context might allow for CRLF injection in URIs
- CVE-2024-11233 Single byte overread with convert.quoted-printable-decode filter
- CVE-2024-11231 우커머스 네이버페이 <= 3.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via mnp_purchase Shortcode
- CVE-2024-11230 Cross-site scripting in Ultimate Addons for Elementor
- CVE-2024-1123 EventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Arbitrary Post Overwrite
- CVE-2024-11229 Cross-site scripting in 코드엠샵 소셜톡
- CVE-2024-11228 Cross-site scripting in 워드프레스 결제 심플페이 – 우커머스 결제 플러그인
- CVE-2024-11227 Cross-site scripting in Memberlite Shortcodes
- CVE-2024-11226 FireCask Like & Share Button <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter
- CVE-2024-11225 Premium Packages – Sell Digital Products Securely <= 5.9.3 - Reflected Cross-Site Scripting via add_query_arg
- CVE-2024-11224 Parallax Image <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via position Parameter
- CVE-2024-11223 WPForms < 1.9.2.3 - Admin+ Stored XSS
- CVE-2024-11222 Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab
- CVE-2024-11221 Full Screen (Page) Background Image Slideshow <= 1.1 - Admin+ Stored XSS
- CVE-2024-11220 Open Automation Software Incorrect Execution-Assigned Permissions
- CVE-2024-1122 Missing authorization in Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)
- CVE-2024-11219 Path traversal in Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
- CVE-2024-11218 Podman: buildah: container breakout by using --jobs=2 and a race condition when building a malicious containerfile
- CVE-2024-11217 Oauth-server-container: oauth-server-container logs client secret in debug level
- CVE-2024-11216 Broken Access Control in PozitifIK's Pik Online
- CVE-2024-11215 Path traversal vulnerability in EasyPHP
- CVE-2024-11214 SourceCodester Best Employee Management System profile.php unrestricted upload
- CVE-2024-11213 SourceCodester Best Employee Management System edit_role.php sql injection
- CVE-2024-11212 SourceCodester Best Employee Management System fetch_product_details.php sql injection
- CVE-2024-11211 EyouCMS Website Logo unrestricted upload
- CVE-2024-11210 EyouCMS FilemanagerLogic.php editFile path traversal
- CVE-2024-1121 Advanced Forms for ACF <= 1.9.3.2 - Missing Authorization to Unauthenticated Form Settings Export