Skip to content
OpenAdvisories

Archive

21 March 2024

Vulnerabilities first published on this day (UTC), newest first.

← February 2024 2024 / March /21 April 2024 →
  1. 1124
  2. 269
  3. 330
  4. 4116
  5. 5116
  6. 6120
  7. 795
  8. 8103
  9. 924
  10. 1010
  11. 1191
  12. 12187
  13. 13222
  14. 1469
  15. 15131
  16. 1650
  17. 1731
  18. 18194
  19. 19132
  20. 20167
  21. 21127
  22. 2281
  23. 2317
  24. 2416
  25. 25123
  26. 26158
  27. 27285
  28. 28180
  29. 29156
  30. 3026
  31. 3167
All Critical High Medium Low Exploited only Public exploit

59 results · Clear filters · Feed

  • Medium 6.3
    CVE-2024-2776

    Campcodes Online Marriage Registration System search.php sql injection

    A vulnerability, which was classified as critical, was found in Campcodes Online Marriage Registration System 1.0. Affected is an unknown function of the file /admin/search.php. The manipulation of the argument searchdata leads to sql injection. It is possibl…

    Campcodes Online Marriage Registration System
  • Medium 6.3
    CVE-2024-2774

    Campcodes Online Marriage Registration System search.php sql injection

    A vulnerability classified as critical was found in Campcodes Online Marriage Registration System 1.0. This vulnerability affects unknown code of the file /user/search.php. The manipulation of the argument searchdata leads to sql injection. The attack can be …

    Campcodes Online Marriage Registration System
  • Medium 6.4
    CVE-2024-2453

    Advantech WebAccess/SCADA SQL Injection

    There is an SQL injection vulnerability in Advantech WebAccess/SCADA software that allows an authenticated attacker to remotely inject SQL code in the database. Successful exploitation of this vulnerability could allow an attacker to read or modify data on th…

    Advantech WebAccess/SCADA
  • Medium 6.3
    CVE-2024-2770

    Campcodes Complete Online Beauty Parlor Management System contact-us.php sql injection

    A vulnerability was found in Campcodes Complete Online Beauty Parlor Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/contact-us.php. The manipulation of the argument email leads to …

    Campcodes Complete Online Beauty Parlor Management System
  • Medium 6.5
    CVE-2023-42954

    A privilege escalation issue existed in FileMaker Server, potentially exposing sensitive information to front-end websi…

    Claris FileMaker Server
  • Medium 4.6
    CVE-2024-28045

    Delta Electronics DIAEnergie Cross-site scripting

    Improper neutralization of input within the affected product could lead to cross-site scripting.

    Delta Electronics DIAEnergie ICS / OT
  • Medium 6.5
    CVE-2024-28863

    node-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validation

    node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even…

    isaacs node-tar nodejs lerna Debian Ubuntu Azure Linux Wolfi npm
  • Medium 6.3
    CVE-2024-2769

    Campcodes Complete Online Beauty Parlor Management System admin-profile.php sql injection

    A vulnerability was detected in Campcodes Complete Online Beauty Parlor Management System 1.0. The affected element is an unknown function of the file /admin/admin-profile.php. The manipulation of the argument adminname/email results in sql injection. The att…

    Campcodes Complete Online Beauty Parlor Management System
  • Medium 6.3
    CVE-2024-2768

    Campcodes Complete Online Beauty Parlor Management System edit-services.php sql injection

    A vulnerability was found in Campcodes Complete Online Beauty Parlor Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/edit-services.php. The manipulation of the argument editid leads to sql injectio…

    Campcodes Complete Online Beauty Parlor Management System
  • Medium 6.3
    CVE-2024-2767

    Campcodes Complete Online Beauty Parlor Management System forgot-password.php sql injection

    A vulnerability was found in Campcodes Complete Online Beauty Parlor Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/forgot-password.php. The manipulation of the argument email leads to sql injec…

    Campcodes Complete Online Beauty Parlor Management System
  • Medium 6.3
    CVE-2024-2766

    Campcodes Complete Online Beauty Parlor Management System index.php sql injection

    A vulnerability has been found in Campcodes Complete Online Beauty Parlor Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/index.php. The manipulation of the argument username leads to sql injection.…

    Campcodes Complete Online Beauty Parlor Management System
  • Medium 4.3
    CVE-2024-1727

    CSRF Vulnerability in gradio-app/gradio

    A Cross-Site Request Forgery (CSRF) vulnerability in gradio-app/gradio allows attackers to upload multiple large files to a victim's system if they are running Gradio locally. By crafting a malicious HTML page that triggers an unauthorized file upload to the …

    gradio-app gradio-app/gradio gradio PyPI
  • Medium 4.3
    CVE-2024-24883

    WordPress Prime Slider plugin <= 3.11.10 - Broken Access Control on Duplicate Post vulnerability

    Missing Authorization vulnerability in BdThemes Prime Slider – Addons For Elementor.This issue affects Prime Slider – Addons For Elementor: from n/a through 3.11.10.

    bdthemes Prime Slider – Addons For Elementor
  • Medium 5.4
    CVE-2024-25907

    WordPress WP Media folder plugin <= 5.7.2 - Plugin Settings Change vulnerability

    Missing Authorization vulnerability in JoomUnited WP Media folder.This issue affects WP Media folder: from n/a through 5.7.2.

    JoomUnited WP Media folder
  • Medium 5.3
    CVE-2024-24850

    WordPress Quicksand Post Filter jQuery plugin <= 3.1.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Mark Stockton Quicksand Post Filter jQuery Plugin.This issue affects Quicksand Post Filter jQuery Plugin: from n/a through 3.1.1.

    Mark Stockton Quicksand Post Filter jQuery Plugin
  • Medium 6.5
    CVE-2022-44633

    WordPress YITH WooCommerce Gift Cards Premium plugin <= 3.23.1 - Unauth. Gift Card Creation Leading to Stored XSS vulnerability

    Missing Authorization vulnerability in YITH YITH WooCommerce Gift Cards Premium.This issue affects YITH WooCommerce Gift Cards Premium: from n/a through 3.23.1.

    Yith YITH WooCommerce Gift Cards Premium Web / CMS
  • Medium 4.3
    CVE-2022-47604

    WordPress AJAX Thumbnail Rebuild plugin <= 1.13 - Broken Access Control vulnerability

    Missing Authorization vulnerability in junkcoder, ristoniinemets AJAX Thumbnail Rebuild.This issue affects AJAX Thumbnail Rebuild: from n/a through 1.13.

    junkcoder, ristoniinemets AJAX Thumbnail Rebuild
  • Medium 4.3
    CVE-2024-25908

    WordPress WP Media folder plugin <= 5.7.2 - Subscriber+ Arbitrary Post/Page Modification vulnerability

    Missing Authorization vulnerability in JoomUnited WP Media folder.This issue affects WP Media folder: from n/a through 5.7.2.

    JoomUnited WP Media folder
  • Medium 5.4
    CVE-2024-25922

    WordPress Peach Payments Gateway plugin <= 3.1.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Peach Payments Peach Payments Gateway.This issue affects Peach Payments Gateway: from n/a through 3.1.9.

    Peach Payments Peach Payments Gateway
  • Medium 4.3
    CVE-2024-25935

    WordPress RegistrationMagic plugin <= 5.2.5.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Metagauss RegistrationMagic.This issue affects RegistrationMagic: from n/a through 5.2.5.9.

    Metagauss RegistrationMagic
  • Medium 5.4
    CVE-2023-27607

    WordPress Points and Rewards for WooCommerce plugin <= 1.5.0 - Settings Change vulnerability

    Missing Authorization vulnerability in WP Swings Points and Rewards for WooCommerce.This issue affects Points and Rewards for WooCommerce: from n/a through 1.5.0.

    WP Swings Points and Rewards for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2022-44595

    WordPress WP2FA plugin <= 2.2.0 - Broken Authentication vulnerability

    Improper Authentication vulnerability in Melapress WP 2FA allows Authentication Bypass.This issue affects WP 2FA: from n/a through 2.2.0.

    melapress WP 2FA
  • Medium 6.2
    CVE-2024-27277

    IBM Storage Protect Plus Server information disclosure

    The private key for the IBM Storage Protect Plus Server 10.1.0 through 10.1.16 certificate can be disclosed, undermining the security of the certificate. IBM X-Force ID: 285205.

    IBM Storage Protect Plus Server
  • Medium 6.5
    CVE-2023-49837

    WordPress embed-code plugin <= 2.3.6 - Denial of Service Attack vulnerability

    Uncontrolled Resource Consumption vulnerability in David Artiss Code Embed.This issue affects Code Embed: from n/a through 2.3.6.

    David Artiss Code Embed
  • Medium 4.3
    CVE-2024-27190

    WordPress Download Media plugin <= 1.4.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Jean-David Daviet Download Media.This issue affects Download Media: from n/a through 1.4.2.

    Jean-David Daviet Download Media
  • Medium 5.9
    CVE-2024-2578

    WordPress WP Coder plugin <= 3.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPCoder WP Coder allows Stored XSS.This issue affects WP Coder: from n/a through 3.5.

    WPCoder WP Coder
  • Medium 5.9
    CVE-2024-2579

    WordPress Tracking Code Manager plugin <= 2.0.16 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Data443 Tracking Code Manager.This issue affects Tracking Code Manager: from n/a through 2.0.16.

    data443 Tracking Code Manager
  • Medium 6.5
    CVE-2024-2580

    WordPress Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin <= 2.8.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FunnelKit Automation By Autonami allows Stored XSS.This issue affects Automation By Autonami: from n/a through 2.8.2.

    FunnelKit Automation By Autonami
  • Medium 6.5
    CVE-2024-27963

    WordPress Crisp – Live Chat and Chatbot plugin <= 0.44 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crisp allows Stored XSS.This issue affects Crisp: from n/a through 0.44.

    Crisp Crisp
  • Medium 5.9
    CVE-2024-27965

    WordPress WPFunnels plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels WPFunnels wpfunnels.This issue affects WPFunnels: from n/a through <= 3.0.6.

    WPFunnels WPFunnels
  • Medium 5.9
    CVE-2024-27966

    WordPress Quiz And Survey Master plugin <= 8.2.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master allows Stored XSS.This issue affects Quiz And Survey Master: from n/a through 8.2.2.

    ExpressTech Systems Quiz And Survey Master
  • Medium 4.3
    CVE-2024-27967

    WordPress DSGVO All in one for WP plugin <= 4.3 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Michael Leithold DSGVO All in one for WP.This issue affects DSGVO All in one for WP: from n/a through 4.3.

    Michael Leithold DSGVO All in one for WP
  • Medium 6.5
    CVE-2024-27969

    WordPress Free Downloads WooCommerce plugin <= 3.5.8.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Enhanced Free Downloads WooCommerce allows Stored XSS.This issue affects Free Downloads WooCommerce: from n/a through 3.5.8.2.

    Wp Enhanced Free Downloads WooCommerce Web / CMS
  • Medium 5.4
    CVE-2024-27970

    WordPress WP SendFox plugin <= 1.3.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in BogdanFix WP SendFox.This issue affects WP SendFox: from n/a through 1.3.0.

    BogdanFix WP SendFox
  • Medium 5.4
    CVE-2024-27985

    WordPress PropertyHive plugin <= 2.0.9 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in PropertyHive.This issue affects PropertyHive: from n/a through 2.0.9.

    Property Hive PropertyHive
  • Medium 6.5
    CVE-2024-27988

    WordPress WEN Responsive Columns plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WEN Themes WEN Responsive Columns allows Stored XSS.This issue affects WEN Responsive Columns: from n/a through 1.3.2.

    WEN Themes WEN Responsive Columns
  • Medium 6.5
    CVE-2024-27989

    WordPress WP Responsive Tabs horizontal vertical and accordion Tabs plugin <= 1.1.17 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in I Thirteen Web Solution WP Responsive Tabs horizontal vertical and accordion Tabs allows Stored XSS.This issue affects WP Responsive Tabs horizontal vertical…

    I Thirteen Web Solution WP Responsive Tabs horizontal vertical and accordion Tabs
  • Medium 6.5
    CVE-2024-27990

    WordPress The Moneytizer plugin <= 9.5.20 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The Moneytizer allows Stored XSS.This issue affects The Moneytizer: from n/a through 9.5.20.

    The Moneytizer The Moneytizer
  • Medium 6.5
    CVE-2024-27991

    WordPress SupportCandy plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SupportCandy allows Stored XSS.This issue affects SupportCandy: from n/a through 3.2.3.

    SupportCandy SupportCandy
  • Medium 5.9
    CVE-2024-27995

    WordPress ARMember plugin <= 4.0.23 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Repute Infosystems ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup allows Stored XSS.This issue affects ARMember…

    Repute InfoSystems ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup