Archive
18 June 2024
Vulnerabilities first published on this day (UTC), newest first.
65 results · Feed
-
Medium 5.4
Simple Share Buttons Adder < 8.5.1 - Admin+ Stored XSS
The Simple Share Buttons Adder WordPress plugin before 8.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
-
Medium 6.1
FooBox (Free and Premium) < 2.7.28 - Admin+ Stored XSS
The Lightbox & Modal Popup WordPress Plugin WordPress plugin before 2.7.28, foobox-image-lightbox-premium WordPress plugin before 2.7.28 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored …
-
Medium 4.8
Expert Invoice <= 1.0.2 -Admin+ Stored XSS
The Expert Invoice WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (fo…
-
Medium 6.3
Observable response discrepancy issue exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerabilit…
-
High 8.6
Absolute path traversal vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerabilit…
-
Medium 6.5
Missing authentication for critical function vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR.…
-
High 7.8CVE-2024-37081 Public exploit
The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An aut…
-
Critical 9.8CVE-2024-37080 EPSS 12%
vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor w…
-
Critical 9.8
vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor w…
KEV Jan 23, 2026 -
High 7.4
Business Directory Plugin <= 6.4.3 - Authenticated (Author+) CSV Injection
The Business Directory Plugin plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 6.4.3 via the class-csv-exporter.php file. This allows authenticated attackers, with author-level permissions and above, to embed untrusted inp…
-
Medium 4.3
Tickera <= 3.5.2.8 - Missing Authorization to Authenticated (Susbcriber+) Ticket Deletion
The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the tc_dl_delete_tickets AJAX action in all versions up to, and including, 3.5.2.8. This makes it possible for authent…
-
Medium 5.3
Ibtana - WordPress Website Builder <= 1.2.3.3 - Unauthenticated reCAPTCHA Settings Update
The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ibtana_visual_editor_register_ajax_json_endpont' function in all versions up to, and including, 1.2.3.3. T…
-
Medium 6.4
PDF Viewer for Elementor <= 2.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via render
The PDF Viewer for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the render function in all versions up to, and including, 2.9.3 due to insufficient input sanitization and output escaping. This makes it possible for authentic…
-
Medium 6.5
Scheduling Plugin – Online Booking for WordPress <= 3.5.10 - Missing Authorization to Unauthenticated Service Disconnection
The Scheduling Plugin – Online Booking for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'cbsb_disconnect_settings' function in all versions up to, and including, 3.5.10. This makes it possi…
-
Medium 6.4
Master Slider – Responsive Touch Slider <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via ms_layer Shortcode
The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ms_layer' shortcode in all versions up to, and including, 3.9.10 due to insufficient input sanitization and output escaping on the …
-
High 7.3
itsourcecode Pool of Bethesda Online Reservation System uploadImage unrestricted upload
A vulnerability has been found in itsourcecode Pool of Bethesda Online Reservation System up to 1.0 and classified as critical. Affected by this vulnerability is the function uploadImage of the file /admin/mod_room/controller.php?action=add. The manipulation …
-
High 8.8
CodeProjects Health Care hospital Management System v1.0 was discovered to contain a SQL injection vulnerability in the…
-
Medium 6.5
CodeProjects Health Care hospital Management System v1.0 was discovered to contain a SQL injection vulnerability in the…
-
High 8.8
Dolibarr arbitrary file upload vulnerability
An arbitrary file upload vulnerability in the Upload Template function of Dolibarr ERP CRM up to v19.0.1 allows attackers to execute arbitrary code via uploading a crafted .SQL file.
-
Medium 6.1
CodeProjects Restaurant Reservation System v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulner…
-
Medium 5.4
Multiple stored cross-site scripting (XSS) vulnerabilities in CodeProjects Health Care hospital Management System v1.0 …
-
Critical 9.4
CodeProjects Health Care hospital Management System v1.0 was discovered to contain a SQL injection vulnerability in the…
-
Medium 5.4
CodeProjects Restaurant Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the reserv_…
-
Medium 6.0CVE-2024-37791 Public exploit
DuxCMS3 v3.1.3 was discovered to contain a SQL injection vulnerability via the keyword parameter at /article/Content/in…
-
High 7.8CVE-2024-22002 Public exploit
CORSAIR iCUE 5.9.105 with iCUE Murals on Windows allows unprivileged users to insert DLL files in the cuepkg-1.2.6 subd…