Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 505 of 521.
- CVE-2024-10715 MapPress Maps for WordPress <= 2.94.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Block
- CVE-2024-10714 Denial of Service in binary-husky/gpt_academic
- CVE-2024-10713 Denial of Service (DoS) via Multipart Request in szad670401/hyperlpr
- CVE-2024-10711 WooCommerce Report <= 1.5.1 - Cross-Site Request Forgery to Arbitrary Options Update
- CVE-2024-10710 YaDisk Files <= 1.2.5 - Admin+ Stored XSS
- CVE-2024-1071 SQL injection in Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
- CVE-2024-10709 YaDisk Files <= 1.2.5 - Contributor+ Stored XSS via Shortcode
- CVE-2024-10708 System Dashboard < 2.8.15 - Admin+ Path Traversal
- CVE-2024-10707 Local File Inclusion in gaizhenbiao/chuanhuchatgpt
- CVE-2024-10706 Download Manager < 3.3.03 - Admin+ Stored XSS
- CVE-2024-10705 Multiple Page Generator Plugin – MPG <= 4.0.5 - Authenticated (Editor+) Server-Side Request Forgery via fileUrl
- CVE-2024-10704 Photo Gallery by 10Web < 1.8.31 - Admin+ Stored XSS
- CVE-2024-10703 Registrations for The Events Calendar < 2.13.4 - Admin+ Stored XSS
- CVE-2024-10702 code-projects Simple Car Rental System signup.php sql injection
- CVE-2024-10701 PHPGurukul Car Rental Portal search.php cross site scripting
- CVE-2024-10700 code-projects University Event Management System submit.php sql injection
- CVE-2024-1070 SiteOrigin Widgets Bundle <= 1.58.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-10699 code-projects Wazifa System logincontrol.php sql injection
- CVE-2024-10698 Tenda AC6 SetOnlineDevName formSetDeviceName stack-based overflow
- CVE-2024-10697 Tenda AC6 API Endpoint WriteFacMac formWriteFacMac command injection
- CVE-2024-10696 Missing authorization in UltraAddons for Elementor
- CVE-2024-10695 Futurio Extra <= 2.0.13 - Authenticated (Contributor+) Post Disclosure
- CVE-2024-10693 SKT Addons for Elementor <= 3.3 - Authenticated (Contributor+) Post Disclosure
- CVE-2024-10692 Information disclosure in PowerPack Addons for Elementor (Free Widgets, Extensions and Templates)
- CVE-2024-10690 Shortcodes for Elementor <= 1.0.4 - Authenticated (Contributor+) Post Disclosure
- CVE-2024-1069 Contact Form Entries <= 1.3.2 - Authenticated (Administrator+) Arbitrary File Upload
- CVE-2024-10689 XLTab – Accordions and Tabs for Elementor Page Builder <= 1.4 - Authenticated (Contributor+) Post Disclosure
- CVE-2024-10688 Attesa Extra <= 1.4.2 - Authenticated (Contributor+) Post Disclosure
- CVE-2024-10687 SQL injection in Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe
- CVE-2024-10685 Contact Form 7 Redirect & Thank You Page <= 1.0.6 - Reflected Cross-Site Scripting
- CVE-2024-10684 Kognetiks Chatbot for WordPress <= 2.1.7 - Reflected Cross-Site Scripting
- CVE-2024-10683 Contact Form 7 - PayPal & Stripe Add-on <= 2.3.1 - Reflected Cross-Site Scripting
- CVE-2024-10682 Bulletin Announcements <= 3.11.7 - Reflected Cross-Site Scripting
- CVE-2024-10681 Code injection in ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
- CVE-2024-10680 Form Maker by 10Web < 1.15.32 - Admin+ Stored XSS
- CVE-2024-1068 404 Solution < 2.35.8 - Admin+ SQL Injection
- CVE-2024-10679 Quiz and Survey Master (QSM) < 9.2.1 - Author+ Stored XSS
- CVE-2024-10678 Ultimate Blocks < 3.2.4 - Contributor+ Stored XSS
- CVE-2024-10677 BTEV <= 2.0.2 - Settings Update via CSRF
- CVE-2024-10676 WordPress Conversion Helper plugin <= 1.12 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-10675 affiliate-toolkit <= 3.6.7 - Reflected Cross-Site Scripting
- CVE-2024-10674 Th Shop Mania <= 1.4.9 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation
- CVE-2024-10673 Top Store <= 1.5.4 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation
- CVE-2024-10672 Multiple Page Generator Plugin – MPG <= 4.0.2 - Authenticated (Editor+) Directory Traversal to Limited File Deletion
- CVE-2024-10671 Information disclosure in Button Block – Design Stylish, Interactive, and Multi-Functional Buttons
- CVE-2024-10670 Primary Addon for Elementor <= 1.6.2 - Authenticated (Contributor+) Post Disclosure
- CVE-2024-1067 Mali GPU Kernel Driver allows improper GPU memory processing operations
- CVE-2024-10669 Countdown Timer block – Display the event's date into a timer. <= 1.2.4 - Authenticated (Contributor+) Post Disclosure
- CVE-2024-10668 Auth Bypass in Quickshare
- CVE-2024-10667 Information disclosure in Content Slider Block – Slide Through Text or Media Content
- CVE-2024-10666 Easy Twitter Feed – Twitter feeds plugin for WP <= 1.2.6 - Authenticated (Contributor+) Post Exposure
- CVE-2024-10665 Yaad Sarig Payment Gateway For WC <= 2.2.4 - Missing Authorization to Authenticated (Subscriber+) Log Read/Deletion
- CVE-2024-10664 Missing authorization in Knowledge Base documentation & wiki plugin – BasePress Docs
- CVE-2024-10663 Missing authorization in Eleblog – Elementor Blog And Magazine Addons
- CVE-2024-10662 Tenda AC15 SetOnlineDevName formSetDeviceName stack-based overflow
- CVE-2024-10661 Tenda AC15 SetDlnaCfg stack-based overflow
- CVE-2024-10660 ESAFENET CDG HookService.java deleteHook sql injection
- CVE-2024-1066 Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2024-10659 ESAFENET CDG CDGAuthoriseTempletService.java delSystemEncryptPolicy sql injection
- CVE-2024-10658 Tongda OA check_seal.php sql injection
- CVE-2024-10657 Tongda OA prcs_info.php sql injection
- CVE-2024-10656 Tongda OA 2017 apply.php sql injection
- CVE-2024-10655 Tongda OA 2017 new.php sql injection
- CVE-2024-10654 TOTOLINK LR350 formLoginAuth.htm authorization
- CVE-2024-10653 CHANGING Information Technology IDExpert - OS Command Injection
- CVE-2024-10652 CHANGING Information Technology IDExpert - Reflected XSS
- CVE-2024-10651 CHANGING Information Technology IDExpert - Arbitrary File Read through Path Traversal
- CVE-2024-10650 Denial of Service (DoS) in gaizhenbiao/chuanhuchatgpt
- CVE-2024-1065 Mali GPU Kernel Driver allows improper GPU memory processing operations
- CVE-2024-10649 Unauthenticated File Upload in wandb/openui
- CVE-2024-10648 Path Traversal in gradio-app/gradio
- CVE-2024-10647 WS Form LITE – Drag & Drop Contact Form Builder for WordPress <= 1.9.244 - Reflected Cross-Site Scripting via URL
- CVE-2024-10646 Cross-site scripting in Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
- CVE-2024-10645 Blogger 301 Redirect <= 2.5.3 - Unauthenticated SQL Injection via br
- CVE-2024-10644 Code injection in Connect Secure
- CVE-2024-10640 The FOX – Currency Switcher Professional for WooCommerce <= 1.4.2.2 - Unauthenticated Arbitrary Shortcode Execution
- CVE-2024-1064 Improper Neutralization of HTTP Headers for Scripting Syntax in Crafty Controller 4
- CVE-2024-10639 Auto Prune Posts < 3.0.0- Admin+ Stored XSS
- CVE-2024-10638 Product Labels For Woocommerce < 1.5.11 - Admin+ SQLi
- CVE-2024-10637 Kadence Blocks < 3.2.54 - Admin+ Stored XSS
- CVE-2024-10636 Cross-site scripting in Quiz Maker Agency
- CVE-2024-10635 Enterprise Protection S/MIME Opaque Signature Attachment Scanning Bypass
- CVE-2024-10634 Nokaut Offers Box <= 1.4.0 - Plugin Reset via CSRF
- CVE-2024-10633 Code injection in Quiz Maker Agency
- CVE-2024-10632 Nokaut Offers Box <= 1.4.0 - Admin+ Stored XSS
- CVE-2024-10631 Countdown Timer <= 1.0.5 - Contributor+ Stored XSS
- CVE-2024-10630 Race condition in Application Control Engine
- CVE-2024-1063 Server-side request forgery in Appwrite
- CVE-2024-10629 GPX Viewer <= 2.2.9 - Authenticated (Subscriber+) Arbitrary File Creation
- CVE-2024-10628 Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Unauthenticated SQL Injection via id
- CVE-2024-10627 WooCommerce Support Ticket System <= 17.7 - Unauthenticated Arbitrary File Upload
- CVE-2024-10626 WooCommerce Support Ticket System <= 17.7 - Authenticated (Subscriber+) Arbitrary File Deletion
- CVE-2024-10625 WooCommerce Support Ticket System <= 17.7 - Unauthenticated Arbitrary File Deletion
- CVE-2024-10624 Regular Expression Denial of Service (ReDoS) in gradio-app/gradio
- CVE-2024-10623 ForumEngine <= 1.8 - Reflected Cross-Site Scripting
- CVE-2024-10621 Simple Shortcode for Google Maps <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-10620 knightliao Disconf Configuration Center list improper authentication
- CVE-2024-1062 Memory corruption in Red Hat Directory Server 11.5 E4S for RHEL 8
- CVE-2024-10619 Tongda OA 2017 next_detail.php sql injection
- CVE-2024-10618 Tongda OA 2017 record_detail.php sql injection