Skip to content
OpenAdvisories

Archive

June 2024

Vulnerabilities first published in this month (UTC), newest first.

← May 2024 2024 / June July 2024 →
  1. 121
  2. 210
  3. 3117
  4. 4187
  5. 5116
  6. 6179
  7. 7136
  8. 878
  9. 9107
  10. 10149
  11. 11227
  12. 12113
  13. 13321
  14. 14156
  15. 1530
  16. 1626
  17. 1775
  18. 1865
  19. 19223
  20. 20159
  21. 21137
  22. 2222
  23. 239
  24. 2497
  25. 25144
  26. 2682
  27. 27111
  28. 2880
  29. 2916
  30. 3021
All Critical High Medium Low Exploited only Public exploit

1,633 results · Clear filters · Feed

  • Medium 5.3
    CVE-2024-35735

    WordPress WP Time Slots Booking Form plugin <= 1.2.11 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form.This issue affects WP Time Slots Booking Form: from n/a through 1.2.11.

    codepeople WP Time Slots Booking Form
  • Medium 4.3
    CVE-2024-35741

    WordPress Awesome Support plugin <= 6.1.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Awesome Support Team Awesome Support.This issue affects Awesome Support: from n/a through 6.1.7.

    Awesome Support Team Awesome Support
  • Medium 5.3
    CVE-2024-35742

    WordPress Easy Forms for Mailchimp plugin <= 6.9.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Code Parrots Easy Forms for Mailchimp.This issue affects Easy Forms for Mailchimp: from n/a through 6.9.0.

    Code Parrots Easy Forms for Mailchimp
  • Medium 4.0
    CVE-2024-4328

    CSRF in clear_personality_files_list in parisneo/lollms-webui

    A Cross-Site Request Forgery (CSRF) vulnerability exists in the clear_personality_files_list function of the parisneo/lollms-webui v9.6. The vulnerability arises from the use of a GET request to clear personality files list, which lacks proper CSRF protection…

    parisneo parisneo/lollms-webui
  • Medium 6.5
    CVE-2022-45168

    An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Bypass of Two-Factor Authentication can occur un…

  • Medium 6.1
    CVE-2022-45176

    An issue was discovered in LIVEBOX Collaboration vDesk through v018. Stored Cross-site Scripting (XSS) can occur under …

  • Medium 4.3
    CVE-2024-33850

    Pexip Infinity before 34.1 has Improper Access Control for persons in a waiting room. They can see the conference roste…

  • Medium 6.5
    CVE-2024-35474

    A Directory Traversal vulnerability in iceice666 ResourcePack Server before v1.0.8 allows a remote attacker to disclose…

  • Medium 5.7
    CVE-2024-36531

    nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before are vulnerable to arbitrary code execution via the /adm…

  • Medium 5.4
    CVE-2024-31612

    Emlog pro2.3 is vulnerable to Cross Site Request Forgery (CSRF) via twitter.php which can be used with a XSS vulnerabil…

  • Medium 5.4
    CVE-2024-31613

    BOSSCMS v3.10 is vulnerable to Cross Site Request Forgery (CSRF) in name="head_code" or name="foot_code."

  • Medium 5.7
    CVE-2024-5389

    Insufficient Access Control in lunary-ai/lunary

    In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users to create, update, get, and delete prompt variations for datasets not owned by their organization. This issue arises due to the application not proper…

    lunary-ai lunary-ai/lunary
  • Medium 5.9
    CVE-2024-2408

    PHP is vulnerable to the Marvin Attack

    The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.…

    PHP Group PHP php5 php Debian Ubuntu Azure Linux Wolfi
  • Medium 5.3
    CVE-2024-35748

    WordPress WooCommerce Dropshipping plugin <= 5.0.4 - Unauthenticated Arbitrary Email Sending vulnerability

    Missing Authorization vulnerability in OPMC WooCommerce Dropshipping.This issue affects WooCommerce Dropshipping: from n/a through 5.0.4.

    OPMC WooCommerce Dropshipping Web / CMS
  • Medium 4.3
    CVE-2024-32081

    WordPress Filter Custom Fields & Taxonomies Light plugin <= 1.05 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Websupporter Filter Custom Fields & Taxonomies Light.This issue affects Filter Custom Fields & Taxonomies Light: from n/a through 1.05.

    Websupporter Filter Custom Fields & Taxonomies Light
  • Medium 5.3
    CVE-2024-34802

    WordPress AdFoxly plugin <= 1.8.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in AdFoxly AdFoxly – Ad Manager, AdSense Ads & Ads.Txt.This issue affects AdFoxly – Ad Manager, AdSense Ads & Ads.Txt: from n/a through 1.8.5.

    AdFoxly AdFoxly – Ad Manager, AdSense Ads & Ads.txt
  • Medium 5.3
    CVE-2024-35661

    WordPress Upload Fields for WPForms plugin <= 1.0.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in SoftLab Upload Fields for WPForms.This issue affects Upload Fields for WPForms: from n/a through 1.0.2.

    SoftLab Upload Fields for WPForms
  • Medium 5.4
    CVE-2024-35662

    WordPress Simple COD Fees for WooCommerce plugin <= 2.0.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Andreas Sofantzis Simple COD Fees for WooCommerce.This issue affects Simple COD Fees for WooCommerce: from n/a through 2.0.2.

    Andreas Sofantzis Simple COD Fees for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2024-5458 EPSS 12%

    Filter bypass in filter_var (FILTER_VALIDATE_URL)

    In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user infor…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.3
    CVE-2024-31276

    WordPress Products, Order & Customers Export for WooCommerce plugin <= 2.0.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPFactory Products, Order & Customers Export for WooCommerce.This issue affects Products, Order & Customers Export for WooCommerce: from n/a through 2.0.8.

    WPFactory Products, Order & Customers Export for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2024-31284

    WordPress EmbedPress plugin <= 3.9.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPDeveloper EmbedPress.This issue affects EmbedPress: from n/a through 3.9.8.

    WPDeveloper EmbedPress
  • Medium 6.3
    CVE-2024-31307

    WordPress Easy Social Share Buttons plugin <= 9.4 - Multiple Broken Access Control vulnerability

    Missing Authorization vulnerability in appscreo Easy Social Share Buttons.This issue affects Easy Social Share Buttons: from n/a through 9.4.

    appscreo Easy Social Share Buttons
  • Medium 4.3
    CVE-2024-31347

    WordPress Tracking Code Manager plugin <= 2.1.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Data443 Tracking Code Manager.This issue affects Tracking Code Manager: from n/a through 2.1.0.

    data443 Tracking Code Manager
  • Medium 4.3
    CVE-2024-31350

    WordPress AWP Classifieds plugin <= 4.3.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in AWP Classifieds Team AWP Classifieds.This issue affects AWP Classifieds: from n/a through 4.3.1.

    AWP Classifieds Team AWP Classifieds
  • Medium 5.3
    CVE-2024-31352

    WordPress Icegram Express plugin <= 5.7.13 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Email Subscribers & Newsletters.This issue affects Email Subscribers & Newsletters: from n/a through 5.7.13.

  • Medium 4.3
    CVE-2024-31359

    WordPress Premmerce Product Filter for WooCommerce plugin <= 3.7.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Premmerce Premmerce Product Filter for WooCommerce premmerce-woocommerce-product-filter.This issue affects Premmerce Product Filter for WooCommerce: from n/a through <= 3.7.2.

    Premmerce Premmerce Product Filter for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2024-32701

    WordPress InstaWP Connect plugin <= 0.1.0.24 - Broken Access Control vulnerability

    Missing Authorization vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through <= 0.1.0.24.

    InstaWP InstaWP Connect
  • Medium 4.3
    CVE-2024-31423

    WordPress WP Accessibility Helper (WAH) plugin <= 0.6.2.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Alex Volkov WP Accessibility Helper (WAH).This issue affects WP Accessibility Helper (WAH): from n/a through 0.6.2.5.

    Alex Volkov WP Accessibility Helper (WAH)
  • Medium 5.4
    CVE-2024-32713

    WordPress AI Post Generator | AutoWriter plugin <= 3.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in AutoWriter AI Post Generator | AutoWriter.This issue affects AI Post Generator | AutoWriter: from n/a through 3.3.

    AutoWriter AI Post Generator | AutoWriter
  • Medium 4.3
    CVE-2024-32714

    WordPress Academy LMS plugin <= 1.9.16 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Academy LMS academy.This issue affects Academy LMS: from n/a through 1.9.16.

    Academy LMS Academy LMS
  • Medium 5.3
    CVE-2024-32725

    WordPress 5 Stars Rating Funnel plugin 1.2.67 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Saleswonder Team: Tobias 5 Stars Rating Funnel 5-stars-rating-funnel.This issue affects 5 Stars Rating Funnel: from n/a through <= 1.2.67.

    Saleswonder Team: Tobias 5 Stars Rating Funnel
  • Medium 5.3
    CVE-2024-32727

    WordPress RomethemeForm For Elementor plugin <= 1.1.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Rometheme RomethemeForm For Elementor.This issue affects RomethemeForm For Elementor: from n/a through 1.1.2.

    rometheme RomethemeForm For Elementor
  • Medium 5.3
    CVE-2024-32779

    WordPress Vision – Image Map Builder plugin <= 1.7.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Avirtum Vision Interactive.This issue affects Vision Interactive: from n/a through 1.7.1.

    Avirtum Vision Interactive
  • Medium 4.3
    CVE-2024-32783

    WordPress Advanced Testimonial Carousel for Elementor plugin <= 3.0.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in wpcreativeidea Advanced Testimonial Carousel for Elementor.This issue affects Advanced Testimonial Carousel for Elementor: from n/a through 3.0.0.

    wpcreativeidea Advanced Testimonial Carousel for Elementor
  • Medium 4.3
    CVE-2024-32784

    WordPress CookieHub plugin <= 1.1.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CookieHub.This issue affects CookieHub: from n/a through 1.1.0.

    CookieHub CookieHub
  • Medium 4.3
    CVE-2024-32787

    WordPress Secure Copy Content Protection and Content Locking plugin <= 3.7.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Copy Content Protection Team Secure Copy Content Protection and Content Locking.This issue affects Secure Copy Content Protection and Content Locking: from n/a through 3.7.1.

    Copy Content Protection Team Secure Copy Content Protection and Content Locking
  • Medium 4.3
    CVE-2024-32792

    WordPress Hummingbird plugin <= 3.7.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hummingbird hummingbird-performance.This issue affects Hummingbird: from n/a through <= 3.7.3.

    WPMU DEV - Your All-in-One WordPress Platform Hummingbird
  • Medium 5.4
    CVE-2024-32797

    WordPress WP LinkedIn Auto Publish plugin <= 8.11 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Martin Gibson WP LinkedIn Auto Publish.This issue affects WP LinkedIn Auto Publish: from n/a through 8.11.

    Martin Gibson WP LinkedIn Auto Publish
  • Medium 5.3
    CVE-2024-32799

    WordPress Easy Property Listings plugin <= 3.5.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Merv Barrett Easy Property Listings.This issue affects Easy Property Listings: from n/a through 3.5.3.

    Merv Barrett Easy Property Listings
  • Medium 4.3
    CVE-2024-32804

    WordPress WP GoToWebinar plugin <= 14.46 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Martin Gibson WP GoToWebinar.This issue affects WP GoToWebinar: from n/a through 14.46.

    Martin Gibson WP GoToWebinar