Skip to content
OpenAdvisories

Archive

9 June 2024

Vulnerabilities first published on this day (UTC), newest first.

← May 2024 2024 / June /9 July 2024 →
  1. 121
  2. 210
  3. 3117
  4. 4187
  5. 5116
  6. 6179
  7. 7136
  8. 878
  9. 9107
  10. 10149
  11. 11227
  12. 12113
  13. 13321
  14. 14156
  15. 1530
  16. 1626
  17. 1775
  18. 1865
  19. 19223
  20. 20159
  21. 21137
  22. 2222
  23. 239
  24. 2497
  25. 25144
  26. 2682
  27. 27111
  28. 2880
  29. 2916
  30. 3021
All Critical High Medium Low Exploited only Public exploit

107 results · Feed

  • Medium 6.5
    CVE-2024-30465

    WordPress PageLayer plugin <= 1.8.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Pagelayer Team PageLayer.This issue affects PageLayer: from n/a through 1.8.1.

    Pagelayer Team PageLayer
  • Medium 5.4
    CVE-2024-30464 Scanner template

    WordPress Social Icons Widget & Block by WPZOOM plugin <= 4.2.15 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPZOOM Social Icons Widget & Block by WPZOOM.This issue affects Social Icons Widget & Block by WPZOOM: from n/a through 4.2.15.

    WPZOOM Social Icons Widget & Block by WPZOOM
  • Medium 6.5
    CVE-2024-25929

    WordPress Product Catalog Mode For Woocommerce plugin <= 5.0.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX.This issue affects Product Catalog Enquiry for WooCommerce by MultiVendorX: from n/a through 5.0.5.

    MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX Web / CMS
  • High 8.8
    CVE-2024-25092 Public exploit

    WordPress NextMove Lite plugin <= 2.17.0 - Subscriber+ Arbitrary Plugin Installation/Activation vulnerability

    Missing Authorization vulnerability in XLPlugins NextMove Lite.This issue affects NextMove Lite: from n/a through 2.17.0.

    XLPlugins NextMove Lite
  • Medium 5.4
    CVE-2024-24716

    WordPress Awesome Support plugin <= 6.1.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Awesome Support Team Awesome Support.This issue affects Awesome Support: from n/a through 6.1.6.

    Awesome Support Team Awesome Support
  • Medium 6.5
    CVE-2023-34003

    WordPress WooCommerce Box Office plugin <= 1.1.51 - Unauthenticated Save Ticket Barcode vulnerability

    Missing Authorization vulnerability in Woo WooCommerce Box Office.This issue affects WooCommerce Box Office: from n/a through 1.1.51.

    Woo WooCommerce Box Office Web / CMS
  • High 8.3
    CVE-2023-31080

    WordPress Unlimited Elements For Elementor plugin <= 1.5.65 - Multiple Broken Access Control vulnerability

    Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates).This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 1.5.65.

    Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
  • Medium 5.4
    CVE-2023-23640

    WordPress MainWP UpdraftPlus Extension Plugin <= 4.0.6 - Subscriber+ Arbitrary Plugin Activation Vulnerability

    Missing Authorization vulnerability in MainWP MainWP UpdraftPlus Extension.This issue affects MainWP UpdraftPlus Extension: from n/a through 4.0.6.

    mainwp MainWP UpdraftPlus Extension
  • Medium 5.4
    CVE-2023-23639

    WordPress MainWP Staging Extension Plugin <= 4.0.3 - Subscriber+ Arbitrary Plugin Activation Vulnerability

    Missing Authorization vulnerability in MainWP MainWP Staging Extension.This issue affects MainWP Staging Extension: from n/a through 4.0.3.

    mainwp MainWP Staging Extension
  • Medium 5.3
    CVE-2023-51494

    WordPress WooCommerce Product Vendors plugin <= 2.2.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Woo WooCommerce Product Vendors.This issue affects WooCommerce Product Vendors: from n/a through 2.2.1.

    Woo WooCommerce Product Vendors Web / CMS
  • Medium 6.5
    CVE-2023-52230

    WordPress Booster Plus for WooCommerce plugin < 7.1.3 - Authenticated Arbitrary WordPress Option Disclosure Vulnerability

    Missing Authorization vulnerability in Pluggabl LLC Booster Plus for WooCommerce.This issue affects Booster Plus for WooCommerce: from n/a before 7.1.3.

    Pluggabl Booster Plus for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2023-52232

    WordPress Booster Plus for WooCommerce plugin < 7.1.2 - Authenticated Arbitrary Post/Page Deletion Vulnerability

    Missing Authorization vulnerability in Pluggabl LLC Booster Plus for WooCommerce.This issue affects Booster Plus for WooCommerce: from n/a before 7.1.2.

    Pluggabl Booster Plus for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2024-30539

    WordPress Awesome Support plugin <= 6.1.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Awesome Support Team Awesome Support.This issue affects Awesome Support: from n/a through 6.1.7.

    Awesome Support Team Awesome Support
  • Medium 6.5
    CVE-2024-30534

    WordPress Calendarista Basic Edition plugin <= 3.0.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in typps Calendarista Basic Edition calendarista-basic-edition.This issue affects Calendarista Basic Edition: from n/a through <= 3.0.5.

    Typps Calendarista Basic Edition
  • Medium 4.3
    CVE-2024-30537

    WordPress WPC Badge Management for WooCommerce plugin <= 2.4.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPClever WPC Badge Management for WooCommerce.This issue affects WPC Badge Management for WooCommerce: from n/a through 2.4.0.

    wpclever WPC Badge Management for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2024-30538

    WordPress DELUCKS SEO plugin <= 2.5.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in DELUCKS GmbH DELUCKS SEO.This issue affects DELUCKS SEO: from n/a through 2.5.4.

    delucks DELUCKS SEO
  • High 7.1
    CVE-2024-31098

    WordPress New Order Notification for Woocommerce plugin <= 2.0.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Mr.Ebabi New Order Notification for Woocommerce.This issue affects New Order Notification for Woocommerce: from n/a through 2.0.2.

    Mr.Ebabi New Order Notification for Woocommerce Web / CMS
  • Medium 5.4
    CVE-2024-31246

    WordPress PostX plugin <= 3.2.3 - Author+ Post/Page Duplication vulnerability

    Missing Authorization vulnerability in WPXPO PostX ultimate-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PostX: from n/a through <= 3.2.3.

    wpxpo PostX
  • Medium 4.3
    CVE-2024-31294

    WordPress WP Sort Order plugin <= 1.3.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Fahad Mahmood WP Sort Order.This issue affects WP Sort Order: from n/a through 1.3.1.

    Fahad Mahmood WP Sort Order
  • Medium 6.3
    CVE-2024-5775

    SourceCodester Vehicle Management System updatebill.php sql injection

    A vulnerability was found in SourceCodester Vehicle Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file updatebill.php. The manipulation of the argument id leads to sql injection. The attack may b…

    SourceCodester Vehicle Management System
  • High 7.3
    CVE-2024-5774

    SourceCodester Stock Management System Login index.php sql injection

    A vulnerability has been found in SourceCodester Stock Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file index.php of the component Login. The manipulation of the argument username/passwor…

    SourceCodester Stock Management System
  • Medium 6.3
    CVE-2024-5773

    Netentsec NS-ASG Application Security Gateway deletemacbind.php sql injection

    A vulnerability, which was classified as critical, was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected is an unknown function of the file /protocol/firewall/deletemacbind.php. The manipulation of the argument messagecontent leads to sql i…

    Netentsec NS-ASG Application Security Gateway
  • Medium 6.3
    CVE-2024-5772

    Netentsec NS-ASG Application Security Gateway deleteiscuser.php sql injection

    A vulnerability, which was classified as critical, has been found in Netentsec NS-ASG Application Security Gateway 6.3. This issue affects some unknown processing of the file /protocol/iscuser/deleteiscuser.php. The manipulation of the argument messagecontent…

    Netentsec NS-ASG Application Security Gateway
  • High 8.8
    CVE-2024-37570

    On Mitel 6869i 4.5.0.41 devices, the Manual Firmware Update (upgrade.html) page does not perform sanitization on the us…

  • High 7.5
    CVE-2024-37568

    Authlib has algorithm confusion with asymmetric public keys

    lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys. Unless an algorithm is specified in a jwt.decode call, HMAC verification is allowed with any asymmetric public key. (This is similar to CVE-2022-29217 and CVE-2024-33663.)

    python-authlib python-authlib authlib Debian Ubuntu PyPI
  • High 8.3
    CVE-2024-37569

    An issue was discovered on Mitel 6869i through 4.5.0.41 and 5.x through 5.0.0.1018 devices. A command injection vulnera…

  • Medium 4.4
    CVE-2024-37535

    GNOME VTE before 0.76.3 allows an attacker to cause a denial of service (memory consumption) via a window resize escape…

    vte vte2.91 vte2.91 vte291 Debian Ubuntu Azure Linux