Skip to content
OpenAdvisories

Archive

21 July 2024

Vulnerabilities first published on this day (UTC), newest first.

← June 2024 2024 / July /21 August 2024 →
  1. 1121
  2. 2135
  3. 360
  4. 438
  5. 566
  6. 624
  7. 74
  8. 866
  9. 9474
  10. 10122
  11. 1181
  12. 12201
  13. 1349
  14. 1411
  15. 1588
  16. 16255
  17. 1788
  18. 1849
  19. 1950
  20. 2083
  21. 2178
  22. 22136
  23. 2338
  24. 2485
  25. 2547
  26. 2672
  27. 2729
  28. 2827
  29. 29280
  30. 30171
  31. 31111
All Critical High Medium Low Exploited only Public exploit

78 results · Feed

  • Medium 6.5
    CVE-2024-37507

    WordPress Eventin plugin <= 3.3.57 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themewinter Eventin allows Stored XSS.This issue affects Eventin: from n/a through 3.3.57.

    Themewinter Eventin
  • Critical 9.8
    CVE-2024-38438

    D-Link - CWE-294: Authentication Bypass by Capture-replay

    D-Link - CWE-294: Authentication Bypass by Capture-replay

    D-Link DSL-225 Network devices
  • High 7.1
    CVE-2024-37509

    WordPress MakeCommerce for WooCommerce plugin <= 3.5.1 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Maksekeskus AS MakeCommerce for WooCommerce allows Reflected XSS.This issue affects MakeCommerce for WooCommerce: from n/a through 3.5.1.

    Maksekeskus AS MakeCommerce for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2024-37512

    WordPress NEX-Forms – Ultimate Form Builder plugin <= 8.5.10 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Basix NEX-Forms – Ultimate Form Builder allows Stored XSS.This issue affects NEX-Forms – Ultimate Form Builder: from n/a through 8.5.10.

    Basix NEX-Forms – Ultimate Form Builder
  • Critical 9.8
    CVE-2024-38437

    D-Link - CWE-288: Authentication Bypass Using an Alternate Path or Channel

    D-Link - CWE-288:Authentication Bypass Using an Alternate Path or Channel

    D-Link DSL-225 Network devices
  • Medium 6.5
    CVE-2024-37514

    WordPress CopySafe Web Protection plugin <= 3.14 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ArtistScope CopySafe Web Protection allows Stored XSS.This issue affects CopySafe Web Protection: from n/a through 3.14.

    ArtistScope CopySafe Web Protection
  • Medium 5.8
    CVE-2024-37515

    WordPress XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Optemiz XPlainer - WooCommerce Product FAQ allows Reflected XSS.This issue affects XPlainer - WooCommerce Product FAQ: from n/a through 1.6.3.

    Optemiz XPlainer - WooCommerce Product FAQ Web / CMS
  • Medium 6.5
    CVE-2024-37519

    WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.1.27 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Leap13 Premium Blocks – Gutenberg Blocks for WordPress premium-blocks-for-gutenberg.This issue affects Premium Blocks – Gutenberg Blocks for WordPress: from …

    leap13 Premium Blocks – Gutenberg Blocks for WordPress Web / CMS
  • Medium 6.1
    CVE-2024-38436

    Commugen SOX 365 – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    Commugen SOX 365 – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    Commugen SOX 365
  • Medium 6.5
    CVE-2024-37521

    WordPress zBench theme <= 1.4.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in zwwooooo zBench allows Stored XSS.This issue affects zBench: from n/a through 1.4.2.

    zwwooooo zBench
  • Medium 5.9
    CVE-2024-37522

    WordPress CC & BCC for Woocommerce Order Emails plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dario Curasì CC & BCC for Woocommerce Order Emails allows Stored XSS.This issue affects CC & BCC for Woocommerce Order Emails: from n/a through 1.4.1.

    Dario Curasì CC & BCC for Woocommerce Order Emails Web / CMS
  • Medium 6.5
    CVE-2024-38435

    Unitronics Vision PLC - CWE-703: Improper Check or Handling of Exceptional Conditions

    Unitronics Vision PLC – CWE-703: Improper Check or Handling of Exceptional Conditions may allow denial of service

    Unitronics Vision PLC
  • Medium 5.9
    CVE-2024-37523

    WordPress Login Logo Editor plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AMP-MODE Login Logo Editor allows Stored XSS.This issue affects Login Logo Editor: from n/a through 1.3.3.

    AMP-MODE Login Logo Editor
  • Medium 6.5
    CVE-2024-38434

    Unitronics Vision PLC - CWE-676: Use of Potentially Dangerous Function

    Unitronics Vision PLC – CWE-676: Use of Potentially Dangerous Function may allow security feature bypass

    Unitronics Vision PLC
  • Medium 5.9
    CVE-2024-37536

    WordPress Easy Custom Code (LESS/CSS/JS) Plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Web357 Easy Custom Code (LESS/CSS/JS) – Live editing allows Stored XSS.This issue affects Easy Custom Code (LESS/CSS/JS) – Live editing: from n/a thro…

    Web357 Easy Custom Code (LESS/CSS/JS) – Live editing
  • Medium 5.9
    CVE-2024-37537

    WordPress WS Contact Form plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in UusWeb.Ee WS Contact Form allows Stored XSS.This issue affects WS Contact Form: from n/a through 1.3.7.

    UusWeb.ee WS Contact Form
  • Medium 5.9
    CVE-2024-37538

    WordPress Link To Bible plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Thomas Kuhlmann Link To Bible allows Stored XSS.This issue affects Link To Bible: from n/a through 2.5.9.

    Thomas Kuhlmann Link To Bible
  • Medium 5.9
    CVE-2024-37545

    WordPress Floating Social Media Links plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Nick Halsey Floating Social Media Links allows Stored XSS.This issue affects Floating Social Media Links: from n/a through 1.5.2.

    Nick Halsey Floating Social Media Links
  • Medium 5.9
    CVE-2024-37548

    WordPress Meks Easy Ads Widget plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Meks Meks Easy Ads Widget allows Stored XSS.This issue affects Meks Easy Ads Widget: from n/a through 2.0.8.

    Meks Meks Easy Ads Widget
  • Medium 5.9
    CVE-2024-37549

    WordPress Save as PDF plugin by Pdfcrowd plugin <= 4.0.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Pdfcrowd Save as PDF plugin by Pdfcrowd allows Stored XSS.This issue affects Save as PDF plugin by Pdfcrowd: from n/a through 4.0.0.

    pdfcrowd Save as PDF Plugin by PDFCrowd
  • Medium 6.3
    CVE-2024-6943

    ZhongBangKeJi CRMEB CopyTaobaoServices.php downloadImage deserialization

    A vulnerability has been found in ZhongBangKeJi CRMEB up to 5.4.0 and classified as critical. Affected by this vulnerability is the function downloadImage of the file app/services/product/product/CopyTaobaoServices.php. The manipulation leads to deserializati…

    ZhongBangKeJi CRMEB
  • Medium 5.9
    CVE-2024-37550

    WordPress Template Kit – Export plugin <= 1.0.22 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Envato Template Kit – Export allows Stored XSS.This issue affects Template Kit – Export: from n/a through 1.0.22.

    envato Template Kit – Export
  • Medium 5.9
    CVE-2024-37551

    WordPress Simple Social Share plugin <= 3.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Perials Simple Social Share allows Stored XSS.This issue affects Simple Social Share: from n/a through 3.0.

    Perials Simple Social Share
  • Medium 5.9
    CVE-2024-37552

    WordPress Social Media Share Buttons & Social Sharing Icons plugin <= 2.9.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Inisev Social Media & Share Icons allows Stored XSS.This issue affects Social Media & Share Icons: from n/a through 2.9.1.

    Inisev Social Media & Share Icons
  • Medium 5.9
    CVE-2024-37556

    WordPress WordPress Notification Bar plugin <= 1.3.10 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SeedProd WordPress Notification Bar allows Stored XSS.This issue affects WordPress Notification Bar: from n/a through 1.3.10.

    SeedProd WordPress Notification Bar Web / CMS
  • Medium 5.9
    CVE-2024-37557

    WordPress WP Cookie Law Info plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Soham Web Solution WP Cookie Law Info allows Stored XSS.This issue affects WP Cookie Law Info: from n/a through 1.1.

    Soham Web Solution WP Cookie Law Info
  • Medium 5.9
    CVE-2024-37558

    WordPress WPFavicon plugin <= 2.1.1 - Cross-Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Nazmul Hossain Nihal WPFavicon allows Stored XSS.This issue affects WPFavicon: from n/a through 2.1.1.

    Nazmul Hossain Nihal WPFavicon
  • High 7.1
    CVE-2024-37559

    WordPress counterpoint theme <= 1.8.1 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Echenley Counterpoint allows Reflected XSS.This issue affects Counterpoint: from n/a through 1.8.1.

    Echenley Counterpoint
  • Low 3.5
    CVE-2024-6942

    ThinkSAAS Admin Panel Security Center anti.php cross site scripting

    A vulnerability, which was classified as problematic, was found in ThinkSAAS 3.7.0. Affected is an unknown function of the file app/system/action/anti.php of the component Admin Panel Security Center. The manipulation of the argument ip/email/phone leads to c…

  • Low 3.5
    CVE-2024-6941

    ThinkSAAS do.php cross site scripting

    A vulnerability, which was classified as problematic, has been found in ThinkSAAS 3.7.0. This issue affects some unknown processing of the file app/system/action/do.php. The manipulation of the argument site_title/site_subtitle/site_key/site_desc/site_url/sit…

  • Medium 4.7
    CVE-2024-6940

    DedeCMS article_template_rand.php code injection

    A vulnerability was found in DedeCMS 5.7.114. It has been classified as critical. This affects an unknown part of the file article_template_rand.php. The manipulation leads to code injection. It is possible to initiate the attack remotely. The exploit has bee…

  • Low 3.5
    CVE-2024-6939

    Xinhu RockOA tpl_upload.html okla cross site scripting

    A vulnerability was found in Xinhu RockOA 2.6.3 and classified as problematic. Affected by this issue is the function okla of the file /webmain/public/upload/tpl_upload.html. The manipulation of the argument callback leads to cross site scripting. The attack …

    Xinhu RockOA
  • Low 3.5
    CVE-2024-6938

    SiYuan PDF PDF.js cross site scripting

    A vulnerability has been found in SiYuan 3.1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file PDF.js of the component PDF Handler. The manipulation leads to cross site scripting. The attack can be launche…

  • Low 2.7
    CVE-2024-6937

    formtools.org Form Tools Import Option List edit.php curl_exec file inclusion

    A vulnerability, which was classified as problematic, was found in formtools.org Form Tools 3.1.1. Affected is the function curl_exec of the file /admin/forms/option_lists/edit.php of the component Import Option List. The manipulation of the argument url lead…

    formtools.org Form Tools
  • Low 2.7
    CVE-2024-6936

    formtools.org Form Tools Setting code injection

    A vulnerability, which was classified as problematic, has been found in formtools.org Form Tools 3.1.1. This issue affects some unknown processing of the file /admin/settings/index.php?page=accounts of the component Setting Handler. The manipulation of the ar…

    formtools.org Form Tools
  • Low 2.4
    CVE-2024-6935

    formtools.org Form Tools User Settings Page cross site scripting

    A vulnerability classified as problematic was found in formtools.org Form Tools 3.1.1. This vulnerability affects unknown code of the file /admin/clients/ of the component User Settings Page. The manipulation leads to cross site scripting. The attack can be i…

    formtools.org Form Tools
  • Low 2.4
    CVE-2024-6934

    formtools.org Form Tools cross site scripting

    A vulnerability classified as problematic has been found in formtools.org Form Tools 3.1.1. This affects an unknown part of the file /admin/forms/add/step2.php?submission_type=direct. The manipulation of the argument Form URL leads to cross site scripting. It…

    formtools.org Form Tools
  • Medium 6.3
    CVE-2024-6933

    LimeSurvey Survey General Settings updatesurveylocalesettings_generalsettings actionUpdateSurveyLocaleSettingsGeneralSettings sql injection

    A flaw has been found in LimeSurvey 6.5.14-240624. Affected by this issue is the function actionUpdateSurveyLocaleSettingsGeneralSettings of the file /index.php?r=admin/database/index/updatesurveylocalesettings_generalsettings of the component Survey General …