Skip to content
OpenAdvisories

Archive

8 June 2024

Vulnerabilities first published on this day (UTC), newest first.

← May 2024 2024 / June /8 July 2024 →
  1. 121
  2. 210
  3. 3117
  4. 4187
  5. 5116
  6. 6179
  7. 7136
  8. 878
  9. 9107
  10. 10149
  11. 11227
  12. 12113
  13. 13321
  14. 14156
  15. 1530
  16. 1626
  17. 1775
  18. 1865
  19. 19223
  20. 20159
  21. 21137
  22. 2222
  23. 239
  24. 2497
  25. 25144
  26. 2682
  27. 27111
  28. 2880
  29. 2916
  30. 3021
All Critical High Medium Low Exploited only Public exploit

78 results · Feed

  • Medium 6.3
    CVE-2024-5771

    LabVantage LIMS POST Request sql injection

    A vulnerability classified as critical was found in LabVantage LIMS 2017. This vulnerability affects unknown code of the file /labvantage/rc?command=page&page=SampleList&_iframename=list of the component POST Request Handler. The manipulation of the argument …

    LabVantage LIMS
  • Critical 9.8
    CVE-2024-4146

    Incorrect Authorization in lunary-ai/lunary

    In lunary-ai/lunary version v1.2.13, an incorrect authorization vulnerability exists that allows unauthorized users to access and manipulate projects within an organization they should not have access to. Specifically, the vulnerability is located in the `che…

    lunary-ai lunary-ai/lunary
  • Low 3.9
    CVE-2024-4680

    Insufficient Session Expiration in zenml-io/zenml

    A vulnerability in zenml-io/zenml version 0.56.3 allows attackers to reuse old session credentials or session IDs due to insufficient session expiration. Specifically, the session does not expire after a password change, enabling an attacker to maintain acces…

    zenml-io zenml-io/zenml zenml PyPI
  • Medium 5.3
    CVE-2024-22151

    WordPress Import and export users and customers plugin <= 1.24.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Codection Import and export users and customers.This issue affects Import and export users and customers: from n/a through 1.24.6.

    Codection Import and export users and customers
  • Medium 4.3
    CVE-2024-21748

    WordPress Icegram Engage plugin <= 3.1.21 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Icegram.This issue affects Icegram: from n/a through 3.1.21.

    Icegram Icegram
  • Medium 5.4
    CVE-2024-35657

    WordPress WP-Recall plugin <= 16.26.6 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Plechev Andrey WP-Recall.This issue affects WP-Recall: from n/a through 16.26.6.

    Plechev Andrey WP-Recall
  • Medium 5.3
    CVE-2024-35659

    WordPress KiviCare plugin <= 3.6.6 - Insecure Direct Object References (IDOR) vulnerability

    Missing Authorization vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects KiviCare: from n/a through <= 3.6.6.

    Iqonic Design KiviCare
  • Medium 6.5
    CVE-2024-35675

    WordPress Advanced Woo Labels plugin <= 1.93 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ILLID Advanced Woo Labels allows Cross-Site Scripting (XSS).This issue affects Advanced Woo Labels: from n/a through 1.93.

    ILLID Advanced Woo Labels
  • Medium 6.5
    CVE-2024-35676

    WordPress Recurring PayPal Donations plugin <= 1.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in wpecommerce Recurring PayPal Donations allows Stored XSS.This issue affects Recurring PayPal Donations: from n/a through 1.7.

    wpecommerce Recurring PayPal Donations
  • High 8.5
    CVE-2024-35678

    WordPress Contact Form to DB by BestWebSoft plugin <= 1.7.2 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BestWebSoft Contact Form to DB by BestWebSoft.This issue affects Contact Form to DB by BestWebSoft: from n/a through 1.7.2.

    bestwebsoft Contact Form to DB by BestWebSoft
  • Medium 4.4
    CVE-2023-45707

    HCL Connections Docs is vulnerable to Cross-Site Scripting (XSS)

    HCL Connections Docs is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary code. This may lead to credentials disclosure and possibly launch additional attacks.

    HCL Software Connections Docs
  • High 7.1
    CVE-2024-35679

    WordPress GiveWP plugin <= 3.12.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP GiveWP give.This issue affects GiveWP: from n/a through <= 3.12.0.

    stellarwp GiveWP
  • Medium 6.5
    CVE-2024-35681

    WordPress wpDiscuz plugin <= 7.6.18 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in gVectors Team wpDiscuz allows Stored XSS.This issue affects wpDiscuz: from n/a through 7.6.18.

    gVectors Team wpDiscuz
  • Medium 4.3
    CVE-2024-35682

    WordPress Otter Blocks PRO plugin <= 2.6.11 - Authenticated Sensitive Data Exposure vulnerability

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Themeisle Otter Blocks PRO.This issue affects Otter Blocks PRO: from n/a through 2.6.11.

    themeisle Otter Blocks PRO
  • Medium 4.3
    CVE-2024-35684

    WordPress ElasticPress plugin <= 5.1.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in 10up ElasticPress elasticpress.This issue affects ElasticPress: from n/a through <= 5.1.1.

    10up ElasticPress
  • Medium 6.5
    CVE-2024-34765

    WordPress Sensei Pro (WC Paid Courses) plugin <= 4.23.1.1.23.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Sensei Sensei Pro (WC Paid Courses) allows Stored XSS.This issue affects Sensei Pro (WC Paid Courses): from n/a through 4.23.1.1.23.1.

    Sensei Sensei Pro (WC Paid Courses)
  • High 7.1
    CVE-2024-35687

    WordPress Link Library plugin <= 7.6.3 - Reflected Cross-Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Yannick Lefebvre Link Library link-library allows Reflected XSS.This issue affects Link Library: from n/a through 7.6.3.

    Yannick Lefebvre Link Library
  • Medium 6.5
    CVE-2024-35688

    WordPress Master Addons for Elementor plugin <= 2.0.5.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jewel Theme Master Addons for Elementor allows Stored XSS.This issue affects Master Addons for Elementor: from n/a through 2.0.5.9.

    Jewel Theme Master Addons for Elementor
  • Medium 5.4
    CVE-2024-35689

    WordPress Analytify plugin <= 5.2.3 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Analytify.This issue affects Analytify: from n/a through 5.2.3.

    Analytify Analytify
  • Medium 6.5
    CVE-2024-35691

    WordPress Widget Options - Extended plugin <= 5.1.0 - Multiple Data Exposure Vulnerability

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Marketing Fire, LLC Widget Options - Extended.This issue affects Widget Options - Extended: from n/a through 5.1.0.

    Marketing Fire Widget Options - Extended
  • High 7.1
    CVE-2024-35693 Scanner template

    WordPress 12 Step Meeting List plugin <= 3.14.33 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list.This issue affects 12 Step Meeting List: from n/a through <= 3.14.33.

    AA Web Servant 12 Step Meeting List
  • High 7.1
    CVE-2024-35694 Scanner template

    WordPress WPMobile.App plugin <= 11.41 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amauri WPMobile.App wpappninja.This issue affects WPMobile.App: from n/a through <= 11.41.

    Amauri WPMobile.App
  • Medium 6.5
    CVE-2024-35695

    WordPress WP Docs plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Fahad Mahmood WP Docs allows Stored XSS.This issue affects WP Docs: from n/a through 2.1.3.

    Fahad Mahmood WP Docs
  • High 7.1
    CVE-2024-35696

    WordPress WP Docs plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Fahad Mahmood WP Docs allows Reflected XSS.This issue affects WP Docs: from n/a through 2.1.3.

    Fahad Mahmood WP Docs
  • High 7.1
    CVE-2024-35697

    WordPress Eduma theme <= 5.4.7 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ThimPress Eduma allows Reflected XSS.This issue affects Eduma: from n/a through 5.4.7.

    ThimPress Eduma
  • Medium 5.9
    CVE-2024-35698

    WordPress YITH WooCommerce Tab Manager plugin <= 1.35.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH WooCommerce Tab Manager yith-woocommerce-tab-manager.This issue affects YITH WooCommerce Tab Manager: from n/a through <= 1.35.0.

    YITHEMES YITH WooCommerce Tab Manager Web / CMS
  • Medium 6.5
    CVE-2024-35699

    WordPress HT Feed plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in HasThemes HT Feed allows Stored XSS.This issue affects HT Feed: from n/a through 1.2.8.

    HasThemes HT Feed
  • Medium 6.5
    CVE-2024-35701

    WordPress PropertyHive plugin <= 2.0.13 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PropertyHive allows Stored XSS.This issue affects PropertyHive: from n/a through 2.0.13.

    Property Hive PropertyHive
  • Medium 6.5
    CVE-2024-35702

    WordPress Master Addons for Elementor plugin <= 2.0.6.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jewel Theme Master Addons for Elementor allows Stored XSS.This issue affects Master Addons for Elementor: from n/a through 2.0.6.0.

    Jewel Theme Master Addons for Elementor
  • Medium 6.5
    CVE-2024-35703

    WordPress Sina Extension for Elementor plugin <= 3.5.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SinaExtra Sina Extension for Elementor allows Stored XSS.This issue affects Sina Extension for Elementor: from n/a through 3.5.3.

    SinaExtra Sina Extension for Elementor
  • Medium 6.5
    CVE-2024-35704

    WordPress BlockArt Blocks plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPBlockArt BlockArt Blocks allows Stored XSS.This issue affects BlockArt Blocks: from n/a through 2.1.5.

    wpblockart BlockArt Blocks
  • Medium 6.5
    CVE-2024-35705

    WordPress Block for Font Awesome plugin <= 1.4.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ciprian Popescu Block for Font Awesome allows Stored XSS.This issue affects Block for Font Awesome: from n/a through 1.4.4.

    Ciprian Popescu Block for Font Awesome
  • High 7.1
    CVE-2024-35706

    WordPress Heateor Social Login WordPress plugin <= 1.1.32 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Team Heateor Heateor Social Login allows Cross-Site Scripting (XSS).This issue affects Heateor Social Login: from n/a through 1.1.32.

    Team Heateor Heateor Social Login Web / CMS
  • Medium 6.5
    CVE-2024-35707

    WordPress Heateor Social Login WordPress plugin <= 1.1.32 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Team Heateor Heateor Social Login allows Stored XSS.This issue affects Heateor Social Login: from n/a through 1.1.32.

    Team Heateor Heateor Social Login Web / CMS
  • Medium 6.5
    CVE-2024-35708

    WordPress Rife Free theme <= 2.4.19 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in apollo13themes Rife Free allows Stored XSS.This issue affects Rife Free: from n/a through 2.4.19.

    apollo13themes Rife Free
  • Medium 6.5
    CVE-2024-35709

    WordPress The Plus Addons for Elementor plugin <= 5.5.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder.This issue affects The Plus Addons for Elementor Page Bui…

    POSIMYTH The Plus Addons for Elementor Page Builder Lite
  • Medium 5.3
    CVE-2024-35710

    WordPress Podlove Web Player plugin <= 5.7.3 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Podlove Podlove Web Player.This issue affects Podlove Web Player: from n/a through 5.7.3.

    Podlove Podlove Web Player
  • Medium 6.5
    CVE-2024-35711

    WordPress Event theme <= 1.2.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Theme Freesia Event allows Stored XSS.This issue affects Event: from n/a through 1.2.2.

    Theme Freesia Event
  • Medium 6.5
    CVE-2024-35713

    WordPress Testimonial Carousel For Elementor plugin <= 10.1.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in UAPP GROUP Testimonial Carousel For Elementor allows Stored XSS.This issue affects Testimonial Carousel For Elementor: from n/a through 10.1.1.

    UAPP GROUP Testimonial Carousel For Elementor
  • Medium 6.5
    CVE-2024-35714

    WordPress Idyllic theme <= 1.1.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Theme Freesia Idyllic allows Stored XSS.This issue affects Idyllic: from n/a through 1.1.8.

    Theme Freesia Idyllic