Skip to content
OpenAdvisories

Archive

28 February 2024

Vulnerabilities first published on this day (UTC), newest first.

← January 2024 2024 / February /28 March 2024 →
  1. 198
  2. 2153
  3. 331
  4. 414
  5. 5157
  6. 6156
  7. 773
  8. 888
  9. 987
  10. 1030
  11. 1121
  12. 1291
  13. 13182
  14. 14170
  15. 15103
  16. 1652
  17. 1766
  18. 1829
  19. 1940
  20. 20203
  21. 21145
  22. 22105
  23. 2379
  24. 2420
  25. 2520
  26. 2676
  27. 27167
  28. 28226
  29. 29144
All Critical High Medium Low Exploited only Public exploit

226 results · Feed

  • Critical 9.8
    CVE-2024-27516

    livehelperchat Server-Side Template Injection

    Server-Side Template Injection (SSTI) vulnerability in livehelperchat before 4.34v, allows remote attackers to execute arbitrary code and obtain sensitive information via the search parameter in lhc_web/modules/lhfaq/faqweight.php.

    remdex/livehelperchat Packagist
  • Medium 5.4
    CVE-2024-27517

    Webasyst 2.9.9 has a Cross-Site Scripting (XSS) vulnerability, Attackers can create blogs containing malicious code aft…

  • High 7.5
    CVE-2024-23302

    Couchbase Server before 7.2.4 has a private key leak in goxdcr.log.

  • Critical 9.8
    CVE-2024-25833

    F-logic DataCube3 v1.0 is vulnerable to unauthenticated SQL injection, which could allow an unauthenticated malicious a…

  • Medium 6.1
    CVE-2024-25868

    A Cross Site Scripting (XSS) vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attac…

  • Medium 6.1
    CVE-2024-25202 Public exploit

    Cross Site Scripting vulnerability in Phpgurukul User Registration & Login and User Management System 1.0 allows attack…

  • High 7.1
    CVE-2024-25859

    A path traversal vulnerability in the /path/to/uploads/ directory of Blesta before v5.9.2 allows attackers to takeover …

  • High 8.8
    CVE-2024-25866

    A SQL Injection vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execut…

  • Critical 9.1
    CVE-2024-25867

    A SQL Injection vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execut…

  • Critical 9.8
    CVE-2024-25169 Public exploit

    Mezzanine allows attackers to bypass access control mechanisms

    An issue in Mezzanine v6.0.0 allows attackers to bypass access control mechanisms in the admin panel via a crafted request.

    mezzanine PyPI
  • Medium 6.1
    CVE-2024-25831

    F-logic DataCube3 Version 1.0 is affected by a reflected cross-site scripting (XSS) vulnerability due to improper input…

  • High 8.8
    CVE-2024-25832 Public exploit EPSS 13%

    F-logic DataCube3 v1.0 is vulnerable to unrestricted file upload, which could allow an authenticated malicious actor to…

  • Critical 9.8
    CVE-2024-25350

    SQL Injection vulnerability in /zms/admin/edit-ticket.php in PHPGurukul Zoo Management System 1.0 via tickettype and tp…

  • Critical 9.1
    CVE-2024-25170 Public exploit

    Mezzanine allows attackers to bypass access controls via manipulating the Host header

    An issue in Mezzanine v6.0.0 allows attackers to bypass access controls via manipulating the Host header.

    mezzanine PyPI
  • Medium 6.1
    CVE-2024-25435

    A cross-site scripting (XSS) vulnerability in Md1health Md1patient v2.0.0 allows attackers to execute arbitrary web scr…

  • High 8.8
    CVE-2024-25869 EPSS 19%

    An Unrestricted File Upload vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attack…

  • Critical 9.8
    CVE-2024-25830 Public exploit EPSS 24%

    F-logic DataCube3 v1.0 is vulnerable to Incorrect Access Control due to an improper directory access restriction. An un…

  • Low 3.8
    CVE-2024-25351

    SQL Injection vulnerability in /zms/admin/changeimage.php in PHPGurukul Zoo Management System 1.0 allows attackers to r…

  • Critical 9.8
    CVE-2024-25422 Public exploit

    SQL Injection vulnerability in SEMCMS v.4.8 allows a remote attacker to execute arbitrary code and obtain sensitive inf…

  • High 8.1
    CVE-2024-22983 Public exploit

    SQL injection vulnerability in Projectworlds Visitor Management System in PHP v.1.0 allows a remote attacker to escalat…

  • Medium 6.5
    CVE-2024-22532 Public exploit

    Buffer Overflow vulnerability in XNSoft NConvert 7.163 (for Windows x86) allows attackers to cause a denial of service …

  • Medium 4.9
    CVE-2024-22723

    Webtrees Path Traversal vulnerability

    Webtrees 2.1.18 is vulnerable to Directory Traversal. By manipulating the "media_folder" parameter in the URL, an attacker (in this case, an administrator) can navigate beyond the intended directory (the 'media/' directory) to access sensitive files in other …

    fisharebest/webtrees Packagist
  • Medium 5.4
    CVE-2024-26450

    An issue exists within Piwigo before v.14.2.0 allowing a malicious user to take over the application. This exploit invo…

  • Low 3.5
    CVE-2024-26476

    An issue in open-emr before v.7.0.2 allows a remote attacker to escalate privileges via a crafted script to the formid …

  • High 7.5
    CVE-2024-26342

    A Null pointer dereference in usr/sbin/httpd in ASUS AC68U 3.0.0.4.384.82230 allows remote attackers to trigger DoS via…

  • Medium 5.3
    CVE-2024-26559

    An issue in uverif v.2.0 allows a remote attacker to obtain sensitive information.