Skip to content
OpenAdvisories

Archive

March 2024

Vulnerabilities first published in this month (UTC), newest first.

← February 2024 2024 / March April 2024 →
  1. 1124
  2. 269
  3. 330
  4. 4116
  5. 5116
  6. 6120
  7. 795
  8. 8103
  9. 924
  10. 1010
  11. 1191
  12. 12187
  13. 13222
  14. 1469
  15. 15131
  16. 1650
  17. 1731
  18. 18194
  19. 19132
  20. 20167
  21. 21127
  22. 2281
  23. 2317
  24. 2416
  25. 25123
  26. 26158
  27. 27285
  28. 28180
  29. 29156
  30. 3026
  31. 3167
All Critical High Medium Low Exploited only Public exploit

3,317 results · Feed

  • Medium 5.4
    CVE-2024-29234

    Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Group.Save webapi…

    Synology Surveillance Station
  • Medium 5.4
    CVE-2024-29233

    Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Emap.Delete webap…

    Synology Surveillance Station
  • Medium 5.4
    CVE-2024-29232

    Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Alert.Enum webapi…

    Synology Surveillance Station
  • Medium 5.4
    CVE-2024-29231

    Improper validation of array index vulnerability in UserPrivilege.Enum webapi component in Synology Surveillance Statio…

    Synology Surveillance Station
  • Medium 5.4
    CVE-2024-29230

    Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in SnapShot.CountByC…

    Synology Surveillance Station
  • High 7.7
    CVE-2024-29229

    Missing authorization vulnerability in GetLiveViewPath webapi component in Synology Surveillance Station before 9.2.0-9…

    Synology Surveillance Station
  • Medium 5.3
    CVE-2024-25923

    WordPress Community by PeepSo plugin <= 6.2.7.0 - Sensitive Data Exposure via Log File vulnerability

    Insertion of Sensitive Information into Log File vulnerability in PeepSo Community by PeepSo.This issue affects Community by PeepSo: from n/a through 6.2.7.0.

    PeepSo Community by PeepSo
  • Critical 9.1
    CVE-2024-2890

    WordPress Tumult Hype Animations plugin <= 1.9.12 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Tumult Inc. Tumult Hype Animations.This issue affects Tumult Hype Animations: from n/a through 1.9.12.

    Tumult Tumult Hype Animations
  • High 7.7
    CVE-2024-29228

    Missing authorization vulnerability in GetStmUrlPath webapi component in Synology Surveillance Station before 9.2.0-928…

    Synology Surveillance Station
  • High 8.1
    CVE-2023-23649

    WordPress MainWP Links Manager Extension Plugin <= 2.1 - Unauthenticated PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in MainWP MainWP Links Manager Extension.This issue affects MainWP Links Manager Extension: from n/a through 2.1.

    mainwp MainWP Links Manager Extension
  • Medium 5.4
    CVE-2024-29227

    Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Layout.LayoutSave…

    Synology Surveillance Station
  • High 7.1
    CVE-2023-34370

    Server Side Request Forgery (SSRF) vulnerability in Starter Templates plugins

    Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Starter Templates — Elementor, WordPress & Beaver Builder Templates, Brainstorm Force Premium Starter Templates.This issue affects Starter Templates — Elementor, WordPress & Beaver Builder T…

    Brainstorm Force Starter Templates — Elementor, WordPress & Beaver Builder Templates Premium Starter Templates Web / CMS
  • High 7.1
    CVE-2023-36679

    WordPress Spectra plugin <= 2.6.6 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Spectra.This issue affects Spectra: from n/a through 2.6.6.

    Brainstorm Force Spectra
  • High 7.7
    CVE-2023-39313

    WordPress Avada theme <= 7.11.1 - Authenticated Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1.

    ThemeFusion Avada
  • High 7.7
    CVE-2024-23500

    WordPress Kadence Blocks plugin <= 3.2.19 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through <= 3.2.19.

    stellarwp Gutenberg Blocks by Kadence Blocks
  • Medium 5.4
    CVE-2024-28003

    WordPress Max Mega Menu plugin <= 3.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Megamenu Max Mega Menu.This issue affects Max Mega Menu: from n/a through 3.3.

    Megamenu Max Mega Menu
  • Medium 5.4
    CVE-2024-28004

    WordPress Colibri Page Builder plugin <= 1.0.248 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ExtendThemes Colibri Page Builder.This issue affects Colibri Page Builder: from n/a through 1.0.248.

    Extend Themes Colibri Page Builder
  • Medium 6.8
    CVE-2024-29090

    WordPress AI Engine plugin <= 2.1.4 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 2.1.4.

    Jordy Meow AI Engine: ChatGPT Chatbot
  • Critical 9.1
    CVE-2024-29100

    WordPress AI Engine plugin <= 2.1.4 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 2.1.4.

    Jordy Meow AI Engine: ChatGPT Chatbot
  • High 7.1
    CVE-2024-30200

    WordPress BEAR plugin <= 1.1.4.2 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 BEAR allows Reflected XSS.This issue affects BEAR: from n/a through 1.1.4.2.

    RealMag777 BEAR
  • Medium 5.4
    CVE-2024-30221

    WordPress Sunshine Photo Cart plugin <= 3.1.1 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through <= 3.1.1.

    sunshinephotocart Sunshine Photo Cart
  • High 8.5
    CVE-2024-30222

    WordPress ARMember plugin <= 4.0.26 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember.This issue affects ARMember: from n/a through 4.0.26.

    Repute InfoSystems ARMember
  • Critical 9.0
    CVE-2024-30223

    WordPress ARMember plugin <= 4.0.26 - Unauthenticated PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember.This issue affects ARMember: from n/a through 4.0.26.

    Repute InfoSystems ARMember
  • Critical 10.0
    CVE-2024-30224

    WordPress WholesaleX plugin <= 1.3.2 - Unauthenticated PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in Wholesale Team WholesaleX.This issue affects WholesaleX: from n/a through 1.3.2.

    Wholesale Team WholesaleX
  • Critical 10.0
    CVE-2024-30225

    WordPress WP Migrate plugin <= 2.6.10 - Unauthenticated PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in WPENGINE, INC. WP Migrate.This issue affects WP Migrate: from n/a through 2.6.10.

    WP Engine WP Migrate
  • Medium 5.1
    CVE-2024-0677

    Pz-LinkCard <= 2.5.1 - Contributor+ SSRF

    The Pz-LinkCard WordPress plugin through 2.5.1 does not prevent users from pinging arbitrary hosts via some of its shortcodes, which could allow high privilege users such as contributors to perform SSRF attacks.

    Web / CMS
  • Medium 6.1
    CVE-2024-0673

    Pz-LinkCard <= 2.5.1 - Admin+ Stored XSS

    The Pz-LinkCard WordPress plugin through 2.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

    Web / CMS
  • High 7.1
    CVE-2024-0672

    Pz-LinkCard <= 2.5.1 - Reflected XSS

    The Pz-LinkCard WordPress plugin through 2.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

    Web / CMS
  • Critical 9.0
    CVE-2024-30226

    WordPress BetterDocs plugin <= 3.3.3 - Unauthenticated PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in WPDeveloper BetterDocs.This issue affects BetterDocs: from n/a through 3.3.3.

    WPDeveloper BetterDocs
  • Critical 9.0
    CVE-2024-30227

    WordPress Geo Controller plugin <= 8.6.4 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in INFINITUM FORM Geo Controller.This issue affects Geo Controller: from n/a through 8.6.4.

    INFINITUM FORM Geo Controller
  • Critical 9.9
    CVE-2024-30228

    WordPress Hercules Core plugin <= 6.4 - Auth. PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in Hercules Design Hercules Core.This issue affects Hercules Core : from n/a through 6.4.

    Hercules Design Hercules Core
  • High 8.0
    CVE-2024-30229

    WordPress Give plugin <= 3.4.2 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in StellarWP GiveWP give.This issue affects GiveWP: from n/a through <= 3.4.2.

    stellarwp GiveWP
  • High 8.2
    CVE-2024-30230

    WordPress PDF Invoices and Packing Slips For WooCommerce plugin <= 1.3.7 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in Acowebs PDF Invoices and Packing Slips For WooCommerce.This issue affects PDF Invoices and Packing Slips For WooCommerce: from n/a through 1.3.7.

    acowebs PDF Invoices and Packing Slips For WooCommerce Web / CMS
  • High 8.5
    CVE-2024-30236

    WordPress Contest Gallery plugin <= 21.3.4 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery.This issue affects Contest Gallery: from n/a through <= 21.3.4.

    Wasiliy Strecker / ContestGallery developer Contest Gallery
  • High 7.6
    CVE-2024-30237

    WordPress Slider by Supsystic plugin <= 1.8.10 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Supsystic Slider by Supsystic.This issue affects Slider by Supsystic: from n/a through 1.8.10.

    supsystic Slider by Supsystic
  • High 8.5
    CVE-2024-30239

    WordPress Zoho Campaigns plugin <= 2.0.6 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zoho Campaigns.This issue affects Zoho Campaigns: from n/a through 2.0.6.

    Zoho Campaigns Zoho Campaigns
  • High 8.5
    CVE-2024-30240

    WordPress Calendarista plugin <= 15.5.7 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Typps Calendarista.This issue affects Calendarista: from n/a through 15.5.7.

    Typps Calendarista
  • High 8.5
    CVE-2024-30241

    WordPress ProfileGrid – User Profiles, Memberships, Groups and Communities plugin <= 5.7.1 - Contributor+ SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.1.

    Metagauss ProfileGrid
  • High 8.5
    CVE-2024-30242

    WordPress Contact Form to Any API plugin <= 1.1.8 - Auth. SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in IT Path Solutions Contact Form to Any API.This issue affects Contact Form to Any API: from n/a through 1.1.8.

    IT Path Solutions Contact Form to Any API
  • High 8.5
    CVE-2024-30243

    WordPress Tooltips plugin < 9.4.5 - Auth. SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tomas WordPress Tooltips.This issue affects WordPress Tooltips: from n/a before 9.4.5.

    Tomas WordPress Tooltips Web / CMS