Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 501 of 521.
- CVE-2024-11109 WP Google Review Slider < 15.6 - Admin+ Stored XSS
- CVE-2024-11108 Serious Slider < 1.2.7 - Contributor+ Stored XSS via Shortcode
- CVE-2024-11107 System Dashboard < 2.8.15 - Unauthenticated Stored XSS
- CVE-2024-11106 Simple Restrict <= 1.2.7 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
- CVE-2024-11104 Missing authorization in Sky Addons – Elementor Addons with Widgets & Templates
- CVE-2024-11103 Contest Gallery <= 24.0.7 - Unauthenticated Arbitrary Password Reset to Privilege Escalation/Account Takeover
- CVE-2024-11102 SourceCodester Hospital Management System edit-doc.php cross site scripting
- CVE-2024-11101 1000 Projects Beauty Parlour Management System search-invoices.php sql injection
- CVE-2024-11100 1000 Projects Beauty Parlour Management System index.php sql injection
- CVE-2024-1110 Podlove Podcast Publisher <= 4.0.11 - Missing Authorization to Settings Import
- CVE-2024-11099 code-projects Job Recruitment login.php sql injection
- CVE-2024-11098 SVG Block <= 1.1.24 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2024-11097 SourceCodester Student Record Management System Main Menu infinite loop
- CVE-2024-11096 code-projects Task Manager newProject.php sql injection
- CVE-2024-11095 Visualmodo Elements <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2024-11094 404 Solution <= 2.35.17 - Missing Authentication to Sensitive Information Exposure
- CVE-2024-11093 SG Helper <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2024-11092 SVGPlus <= 1.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2024-11091 Cross-site scripting in Support SVG – Upload svg files in wordpress without hassle
- CVE-2024-11090 Information disclosure in Membership Plugin – Restrict Content
- CVE-2024-1109 Podlove Podcast Publisher <= 4.0.11 - Missing Authorization to Unauthenticated Data Export
- CVE-2024-11089 Anonymous Restricted Content <= 1.6.5 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
- CVE-2024-11088 Simple Membership <= 4.5.5 - Exposure of Private Personal Information to an Unauthorized Actor
- CVE-2024-11087 miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon <= 200.3.9 - Authentication Bypass
- CVE-2024-11085 WP Log Viewer <= 1.2.1 - Missing Authorization
- CVE-2024-11084 Potential Username Enumeration in Helix ALM
- CVE-2024-11083 ProfilePress <= 4.15.18 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
- CVE-2024-11082 Tumult Hype Animations <= 1.9.15 - Authenticated (Author+) Arbitrary File Upload via hypeanimations_panel Function
- CVE-2024-11080 Post Grid and Gutenberg Blocks – ComboBlocks 2.2.85 - 2.3.32 - Unauthenticated Hook Injection
- CVE-2024-1108 Plugin Groups <= 2.0.6 - Missing Authorization to Unauthenticated Denial of Service
- CVE-2024-11079 Ansible-core: unsafe tagging bypass via hostvars object in ansible-core
- CVE-2024-11078 code-projects Job Recruitment register.php cross site scripting
- CVE-2024-11077 code-projects Job Recruitment index.php sql injection
- CVE-2024-11076 code-projects Job Recruitment activation.php sql injection
- CVE-2024-11075 SICK Incoming Goods Suite privilege escalation vulnerability
- CVE-2024-11074 itsourcecode Tailoring Management System incadd.php sql injection
- CVE-2024-11073 SourceCodester Hospital Management System delete-account.php improper authorization
- CVE-2024-11071 Improper Access Control In DestinyECM
- CVE-2024-11070 Sanluan PublicCMS Tag Type save cross site scripting
- CVE-2024-1107 IDOR in Talya Informatics' Travel APPS
- CVE-2024-11069 WordPress GDPR <= 2.0.2 - Missing Authorization to Unauthenticated Arbitrary User Deletion
- CVE-2024-11068 D-Link DSL6740C - Incorrect Use of Privileged APIs
- CVE-2024-11067 D-Link DSL6740C - Arbitrary File Reading through Path Traversal
- CVE-2024-11066 D-Link DSL6740C - OS Command Injection
- CVE-2024-11065 D-Link DSL6740C - OS Command Injection
- CVE-2024-11064 D-Link DSL6740C - OS Command Injection
- CVE-2024-11063 D-Link DSL6740C - OS Command Injection
- CVE-2024-11062 D-Link DSL6740C - OS Command Injection
- CVE-2024-11061 Tenda AC10 fast_setting_wifi_set FUN_0044db3c stack-based overflow
- CVE-2024-11060 Jinher Network Collaborative Management Platform 金和数字化智能办公平台 AcceptShow.aspx sql injection
- CVE-2024-1106 Shariff Wrapper < 4.6.10 - Admin+ Stored XSS
- CVE-2024-11059 Project Worlds Free Download Online Shopping System success.php sql injection
- CVE-2024-11058 CodeAstro Real Estate Management System About Us Page aboutedit.php sql injection
- CVE-2024-11057 Codezips Hospital Appointment System removeBranchResult.php sql injection
- CVE-2024-11056 Tenda AC10 WifiExtraSet FUN_0046AC38 stack-based overflow
- CVE-2024-11055 1000 Projects Beauty Parlour Management System admin-profile.php sql injection
- CVE-2024-11054 SourceCodester Simple Music Cloud Community System ajax.php unrestricted upload
- CVE-2024-11053 netrc and redirect credential leak
- CVE-2024-11052 Cross-site scripting in Ninja Forms – The Contact Form Builder That Grows With You
- CVE-2024-11051 AMTT Hotel Broadband Operation System online_status.php sql injection
- CVE-2024-11050 AMTT Hotel Broadband Operation System language.php cross site scripting
- CVE-2024-11049 ZKTeco ZKBio Time Image File photo direct request
- CVE-2024-11048 D-Link DI-8003 dbsrv.asp dbsrv_asp stack-based overflow
- CVE-2024-11047 D-Link DI-8003 upgrade_filter.asp upgrade_filter_asp stack-based overflow
- CVE-2024-11046 D-Link DI-8003 upgrade_filter.asp upgrade_filter_asp os command injection
- CVE-2024-11045 Cross-Site WebSocket Hijacking (CSWSH) in automatic1111/stable-diffusion-webui
- CVE-2024-11044 Open Redirect in automatic1111/stable-diffusion-webui
- CVE-2024-11043 Denial of Service (DoS) via Large Payload in Board Name Field in invoke-ai/invokeai
- CVE-2024-11042 Arbitrary File Delete in invoke-ai/invokeai
- CVE-2024-11041 Remote Code Execution in vllm-project/vllm
- CVE-2024-1104 Temporary denial of service during a brute force attack
- CVE-2024-11039 Deserialization of Untrusted Data in binary-husky/gpt_academic
- CVE-2024-11038 Code injection in WPB Popup for Contact Form 7 – Showing Contact Form 7 Popup on Button Click
- CVE-2024-11037 Path Traversal in binary-husky/gpt_academic
- CVE-2024-11036 Code injection in GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress
- CVE-2024-11035 Carbon Black Cloud Windows Sensor Information Leak
- CVE-2024-11034 Code injection in Request a Quote for WooCommerce – Get a Quote Button
- CVE-2024-11033 Denial of Service (DoS) in binary-husky/gpt_academic
- CVE-2024-11032 Parsi Date <= 5.1.1 - Reflected Cross-Site Scripting via add_query_arg Parameter
- CVE-2024-11031 SSRF in binary-husky/gpt_academic
- CVE-2024-11030 SSRF in binary-husky/gpt_academic
- CVE-2024-1103 CodeAstro Real Estate Management System Feedback Form profile.php cross site scripting
- CVE-2024-11029 Freeipa: administrative user data leaked through systemd journal
- CVE-2024-11028 MultiManager WP – Manage All Your WordPress Sites Easily <= 1.0.5 - Authentication Bypass via User Impersonation
- CVE-2024-11026 Intelligent Apps Freenow App Keystore SSL.java hard-coded password
- CVE-2024-11025 SMA: SQL injection in Sunny Central UP
- CVE-2024-11024 AppPresser – Mobile App Framework <= 4.4.6 - Unauthenticated Privilege Escalation via Password Reset
- CVE-2024-11023 Session Hijacking in Firebase JavaScript SDK
- CVE-2024-11022 SICK InspectorP61x and SICK InspectorP62x are vulnerable for a replay attack
- CVE-2024-11021 Grand Vice info Webopac - Stored XSS
- CVE-2024-11020 Grand Vice info Webopac7 - SQL Injection
- CVE-2024-1102 Jberet: jberet-core logging database credentials
- CVE-2024-11019 Grand Vice info Webopac7 - Reflected XSS
- CVE-2024-11018 Grand Vice info Webopac - Arbitrary File Upload
- CVE-2024-11017 Grand Vice info Webopac - Arbitrary File Upload
- CVE-2024-11016 Grand Vice info Webopac - SQL Injection
- CVE-2024-11015 Sign In With Google <= 1.8.0 - Authentication Bypass in authenticate_user
- CVE-2024-11014 Cross-site request forgery in UNIVERGE IX
- CVE-2024-11013 Command injection in UNIVERGE IX
- CVE-2024-11012 Code injection in Notibar – Notification Bar for WordPress