Skip to content
OpenAdvisories

Archive

March 2024

Vulnerabilities first published in this month (UTC), newest first.

← February 2024 2024 / March April 2024 →
  1. 1124
  2. 269
  3. 330
  4. 4116
  5. 5116
  6. 6120
  7. 795
  8. 8103
  9. 924
  10. 1010
  11. 1191
  12. 12187
  13. 13222
  14. 1469
  15. 15131
  16. 1650
  17. 1731
  18. 18194
  19. 19132
  20. 20167
  21. 21127
  22. 2281
  23. 2317
  24. 2416
  25. 25123
  26. 26158
  27. 27285
  28. 28180
  29. 29156
  30. 3026
  31. 3167
All Critical High Medium Low Exploited only Public exploit

1,626 results · Clear filters · Feed

  • Medium 6.5
    CVE-2024-29914

    WordPress Stratum – Elementor Widgets plugin <= 1.3.15 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MotoPress Stratum allows Stored XSS.This issue affects Stratum: from n/a through 1.3.15.

    MotoPress Stratum
  • Medium 6.5
    CVE-2024-29913

    WordPress Tutor LMS Elementor Addons plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS Elementor Addons allows Stored XSS.This issue affects Tutor LMS Elementor Addons: from n/a through 2.1.3.

    Themeum Tutor LMS Elementor Addons
  • Medium 6.5
    CVE-2024-29912

    WordPress iCalendrier plugin <= 1.80 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Baptiste Placé iCalendrier allows Stored XSS.This issue affects iCalendrier: from n/a through 1.80.

    Baptiste Placé iCalendrier
  • Medium 6.5
    CVE-2024-29911

    WordPress Master Addons for Elementor plugin <= 2.0.5.4.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jewel Theme Master Addons for Elementor allows Stored XSS.This issue affects Master Addons for Elementor: from n/a through 2.0.5.4.1.

    Jewel Theme Master Addons for Elementor
  • Medium 6.5
    CVE-2024-29910

    WordPress Dropdown Multisite selector plugin <= 0.9.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alordiel Dropdown Multisite selector allows Stored XSS.This issue affects Dropdown Multisite selector: from n/a through 0.9.2.

    alordiel Dropdown Multisite selector
  • Medium 6.5
    CVE-2024-29909

    WordPress Travelers' Map plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Camille Verrier Travelers' Map allows Stored XSS.This issue affects Travelers' Map: from n/a through 2.2.0.

    Camille Verrier Travelers' Map
  • Medium 6.5
    CVE-2024-29908

    WordPress Co-marquage service-public.fr plugin <= 0.5.71 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kienso Co-marquage service-public.Fr allows Stored XSS.This issue affects Co-marquage service-public.Fr: from n/a through 0.5.71.

    Kienso Co-marquage service-public.fr
  • Medium 6.5
    CVE-2024-29820

    WordPress PDF Builder for WPForms plugin <= 1.2.88 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RedNao PDF Builder for WPForms allows Stored XSS.This issue affects PDF Builder for WPForms: from n/a through 1.2.88.

    RedNao PDF Builder for WPForms
  • Medium 5.9
    CVE-2024-29906

    WordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF) allows Stored XSS.This issue affects WordPress Meta Data and Taxonomies Filter (MDTF): from n/a t…

    RealMag777 WordPress Meta Data and Taxonomies Filter (MDTF) Web / CMS
  • Medium 6.5
    CVE-2024-30192

    WordPress Pinterest Plugin <= 1.8.2 - Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GS Plugins GS Pins for Pinterest allows Stored XSS.This issue affects GS Pins for Pinterest: from n/a through 1.8.2.

    GS Plugins GS Pins for Pinterest
  • Medium 6.5
    CVE-2024-30193

    WordPress Church Admin plugin <= 4.1.17 - Stored Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.17.

    andy_moyle Church Admin
  • Medium 6.4
    CVE-2024-1521

    Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Widget SVGZ File Upload

    The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an SVGZ file uploaded via the Form widget in all versions up to, and including, 3.20.1 due to insufficient input sanitization and output escaping. This mak…

    https://elementor.com/ Elementor Website Builder Pro Web / CMS
  • Medium 5.4
    CVE-2024-2120

    Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Navigation

    The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Post Navigation widget in all versions up to, and including, 3.20.1 due to insufficient input sanitization and output escaping on user supplie…

    https://elementor.com/ Elementor Website Builder Pro Web / CMS
  • Medium 6.4
    CVE-2024-2781

    Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via video_html_tag

    The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the video_html_tag attribute in all versions up to, and including, 3.20.1 due to insufficient input sanitization and output escaping. This makes it possibl…

    https://elementor.com/ Elementor Website Builder Pro Web / CMS
  • Medium 5.4
    CVE-2024-2121

    Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Media Carousel widget in all versions up to, and including, 3.20.1 due to insufficient input sanitization and output escaping on user supplied…

    https://elementor.com/ Elementor Website Builder Pro Web / CMS
  • Medium 6.4
    CVE-2024-1364

    Elementor Website Builder Pro <= 3.20.1 - Authententicated (Contributor+) Stored Cross-Site Scripting

    The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget's custom_id in all versions up to, and including, 3.20.1 due to insufficient input sanitization and output escaping on user supplied attributes. Thi…

    https://elementor.com/ Elementor Website Builder Pro Web / CMS
  • Medium 5.9
    CVE-2024-27188

    WordPress Breeze plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cloudways Breeze breeze.This issue affects Breeze: from n/a through <= 2.1.3.

    Cloudways Breeze
  • Medium 6.5
    CVE-2024-30197

    WordPress Church Admin plugin <= 4.0.26 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.0.26.

    andy_moyle Church Admin
  • Medium 5.8
    CVE-2024-30198

    WordPress Buddyforms plugin <= 2.8.5 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeKraft BuddyForms allows Reflected XSS.This issue affects BuddyForms: from n/a through 2.8.5.

    Themekraft BuddyForms
  • Medium 6.5
    CVE-2023-52228

    WordPress Beds24 Online Booking plugin <= 2.0.24 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mark Kinchin Beds24 Online Booking allows Stored XSS.This issue affects Beds24 Online Booking: from n/a through 2.0.24.

    Mark Kinchin Beds24 Online Booking
  • Medium 6.5
    CVE-2024-25920

    WordPress WP SMS plugin <= 6.3.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP SMS allows Stored XSS.This issue affects WP SMS: from n/a through 6.3.4.

    VeronaLabs WP SMS
  • Medium 6.3
    CVE-2024-2945

    Campcodes Online Examination System updateExaminee.php sql injection

    A vulnerability was found in Campcodes Online Examination System 1.0. It has been classified as critical. Affected is an unknown function of the file /adminpanel/admin/facebox_modal/updateExaminee.php. The manipulation of the argument id leads to sql injectio…

    Campcodes Online Examination System
  • Medium 6.3
    CVE-2024-2944

    Campcodes Online Examination System deleteCourseExe.php sql injection

    A vulnerability was found in Campcodes Online Examination System 1.0 and classified as critical. This issue affects some unknown processing of the file /adminpanel/admin/query/deleteCourseExe.php. The manipulation of the argument id leads to sql injection. Th…

    Campcodes Online Examination System
  • Medium 6.3
    CVE-2024-2943

    Campcodes Online Examination System deleteExamExe.php sql injection

    A vulnerability has been found in Campcodes Online Examination System 1.0 and classified as critical. This vulnerability affects unknown code of the file /adminpanel/admin/query/deleteExamExe.php. The manipulation of the argument id leads to sql injection. Th…

    Campcodes Online Examination System
  • Medium 6.3
    CVE-2024-2942

    Campcodes Online Examination System deleteQuestionExe.php sql injection

    A vulnerability, which was classified as critical, was found in Campcodes Online Examination System 1.0. This affects an unknown part of the file /adminpanel/admin/query/deleteQuestionExe.php. The manipulation of the argument id leads to sql injection. It is …

    Campcodes Online Examination System
  • Medium 6.3
    CVE-2024-2941

    Campcodes Online Examination System loginExe.php sql injection

    A vulnerability, which was classified as critical, has been found in Campcodes Online Examination System 1.0. Affected by this issue is some unknown functionality of the file /adminpanel/admin/query/loginExe.php. The manipulation of the argument pass leads to…

    Campcodes Online Examination System
  • Medium 6.4
    CVE-2024-2203

    The Plus Addons for Elementor <= 5.4.1 - Authenticated (Contributor+) Local File Inclusion via Clients Widget

    The The Plus Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.4.1 via the Clients widget. This makes it possible for authenticated attackers, with contributor-level access and above, to in…

    posimyththemes The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Web / CMS
  • Medium 6.4
    CVE-2024-2139

    Master Addons for Elementor <= 2.0.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget

    The Master Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Pricing Table widget in all versions up to, and including, 2.0.5.6 due to insufficient input sanitization and output escaping. This makes it possible for…

    litonice13 Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits Web / CMS
  • Medium 6.4
    CVE-2024-2210

    The Plus Addons for Elementor <= 5.4.1 - Authenticated (Contributor+) Local File Inclusion via Team Member Listing

    The The Plus Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.4.1 via the Team Member Listing widget. This makes it possible for authenticated attackers, with contributor-level access and …

    posimyththemes The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Web / CMS
  • Medium 6.8
    CVE-2024-1532

    A vulnerability exists in the stb-language file handling that affects the RTU500 series product versions listed below. …

    Hitachi Energy RTU500 series CMU firmware ICS / OT
  • Medium 5.3
    CVE-2024-2244

    REST service authentication anomaly with “valid username/no password” credential combination for batch job processing r…

    Hitachi Energy Asset Suite EAM ICS / OT
  • Medium 6.3
    CVE-2024-2938

    Campcodes Online Examination System updateCourse.php sql injection

    A vulnerability was found in Campcodes Online Examination System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /adminpanel/admin/facebox_modal/updateCourse.php. The manipulation of the argument id leads to sql inje…

    Campcodes Online Examination System
  • Medium 6.3
    CVE-2024-2934

    SourceCodester Todo List in Kanban Board delete-todo.php sql injection

    A vulnerability classified as critical was found in SourceCodester Todo List in Kanban Board 1.0. Affected by this vulnerability is an unknown functionality of the file /endpoint/delete-todo.php. The manipulation of the argument list leads to sql injection. T…

    SourceCodester Todo List in Kanban Board
  • Medium 6.3
    CVE-2024-2932

    SourceCodester Online Chatting System update_room.php sql injection

    A vulnerability classified as critical has been found in SourceCodester Online Chatting System 1.0. Affected is an unknown function of the file admin/update_room.php. The manipulation of the argument id leads to sql injection. It is possible to launch the att…

    SourceCodester Online Chatting System
  • Medium 6.2
    CVE-2023-39804

    In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c.

    tar tar tar Debian Ubuntu Azure Linux
  • Medium 5.3
    CVE-2023-46049

    LLVM 15.0.0 has a NULL pointer dereference in the parseOneMetadata() function via a crafted pdflatex.fmt file (or perha…

  • Medium 5.5
    CVE-2023-46046

    An issue in MiniZinc before 2.8.0 allows a NULL pointer dereference via ti_expr in a crafted .mzn file. NOTE: this is d…

    minizinc Debian
  • Medium 6.2
    CVE-2023-46048

    Tex Live 944e257 has a NULL pointer dereference in texk/web2c/pdftexdir/writet1.c. NOTE: this is disputed because it sh…

    texlive-bin Debian
  • Medium 5.3
    CVE-2023-45919

    Mesa 23.0.4 was discovered to contain a buffer over-read in glXQueryServerString(). NOTE: this is disputed because ther…

    mesa Debian
  • Medium 6.2
    CVE-2023-45913

    Mesa v23.0.4 was discovered to contain a NULL pointer dereference via the function dri2GetGlxDrawableFromXDrawableId().…

    mesa Debian