Skip to content
OpenAdvisories

Archive

5 February 2024

Vulnerabilities first published on this day (UTC), newest first.

← January 2024 2024 / February /5 March 2024 →
  1. 198
  2. 2153
  3. 331
  4. 414
  5. 5157
  6. 6156
  7. 773
  8. 888
  9. 987
  10. 1030
  11. 1121
  12. 1291
  13. 13182
  14. 14170
  15. 15103
  16. 1652
  17. 1766
  18. 1829
  19. 1940
  20. 20203
  21. 21145
  22. 22105
  23. 2379
  24. 2420
  25. 2520
  26. 2676
  27. 27167
  28. 28226
  29. 29144
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • Medium 5.3
    CVE-2024-1208 Public exploit Scanner template

    LearnDash LMS <= 4.10.2 - Sensitive Information Exposure via API

    The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.2 via API. This makes it possible for unauthenticated attackers to obtain access to quiz questions.

    stellarwp LearnDash LMS Web / CMS
  • High 8.8
    CVE-2023-6933 Public exploit Scanner template EPSS 68%

    Better Search Replace <= 1.4.4 - Unauthenticated PHP Object Injection

    The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain …

    WP Engine Better Search Replace Web / CMS
  • Medium 5.3
    CVE-2024-1209 Public exploit Scanner template

    LearnDash LMS <= 4.10.1 - Sensitive Information Exposure via assignments

    The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.1 via direct file access due to insufficient protection of uploaded assignments. This makes it possible for unauthenticated attac…

    stellarwp LearnDash LMS Web / CMS
  • Medium 6.1
    CVE-2024-0509 Public exploit

    WP 404 Auto Redirect to Similar Post <= 1.0.3 - Reflected Cross-Site Scripting via request

    The WP 404 Auto Redirect to Similar Post plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘request’ parameter in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it pos…

    hwk-fr WP 404 Auto Redirect to Similar Post Web / CMS
  • High 8.8
    CVE-2023-6700 Public exploit

    Cookie Information | Free GDPR Consent Solution <= 2.0.22 - Authenticated (Subscriber+) Arbitrary Options Update

    The Cookie Information | Free GDPR Consent Solution plugin for WordPress is vulnerable to arbitrary option updates due to a missing capability check on its AJAX request handler in versions up to, and including, 2.0.22. This makes it possible for authenticated…

    cookieinformation Cookie Information | Free GDPR Consent Solution Web / CMS
  • High 8.2
    CVE-2024-0324 Public exploit

    User Profile Builder <= 3.10.8 - Missing Authorization to Plugin Settings Change via wppb_two_factor_authentication_settings_update

    The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wppb_two_factor_authentication_settings_update' fu…

    Cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor Web / CMS
  • Medium 6.5
    CVE-2023-6985 Public exploit

    10Web AI Assistant – AI content writing assistant <= 1.0.18 - Missing Authorization to Arbitrary Plugin Installation

    The 10Web AI Assistant – AI content writing assistant plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the install_plugin AJAX action in all versions up to, and including, 1.0.18. This makes it possi…

    10web 10Web AI Assistant – AI content writing assistant Web / CMS
  • Critical 9.7
    CVE-2024-23108 Public exploit Scanner template EPSS 80%

    An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet…

    Fortinet FortiSIEM Network devices
  • Medium 6.5
    CVE-2023-51504 Public exploit

    WordPress Dan's Embedder for Google Calendar Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Dulaney Dan's Embedder for Google Calendar allows Stored XSS.This issue affects Dan's Embedder for Google Calendar: from n/a through 1.2.

    Dan Dulaney Dan's Embedder for Google Calendar
  • High 7.5
    CVE-2023-47355 Public exploit

    The com.eypcnnapps.quickreboot (aka Eyuep Can Yilmaz {ROOT] Quick Reboot) application 1.0.8 for Android has exposed bro…

  • Medium 5.4
    CVE-2024-24397 Public exploit

    Stimulsoft Dashboard.JS Cross Site Scripting vulnerability

    Cross Site Scripting vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload to the ReportName field.

    stimulsoft-dashboards-js npm
  • Medium 6.1
    CVE-2024-24396 Public exploit

    Stimulsoft Dashboard.JS Cross Site Scripting vulnerability

    Cross Site Scripting vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload to the search bar component.

    stimulsoft-dashboards-js npm