Skip to content
OpenAdvisories

Archive

July 2024

Vulnerabilities first published in this month (UTC), newest first.

← June 2024 2024 / July August 2024 →
  1. 1121
  2. 2135
  3. 360
  4. 438
  5. 566
  6. 624
  7. 74
  8. 866
  9. 9474
  10. 10122
  11. 1181
  12. 12201
  13. 1349
  14. 1411
  15. 1588
  16. 16255
  17. 1788
  18. 1849
  19. 1950
  20. 2083
  21. 2178
  22. 22136
  23. 2338
  24. 2485
  25. 2547
  26. 2672
  27. 2729
  28. 2827
  29. 29280
  30. 30171
  31. 31111
All Critical High Medium Low Exploited only Public exploit

1,322 results · Clear filters · Feed

  • Medium 6.3
    CVE-2024-6948

    Gargaj wuhu Slide Editor slideeditor.php unrestricted upload

    A vulnerability classified as critical has been found in Gargaj wuhu up to 3faad49bfcc3895e9ff76a591d05c8941273d120. Affected is an unknown function of the file /slideeditor.php of the component Slide Editor. The manipulation of the argument newSlideFile lead…

    Gargaj wuhu
  • Medium 4.7
    CVE-2024-6947

    Flute CMS Notification ContentParser.php replaceContent code injection

    A vulnerability was found in Flute CMS 0.2.2.4-alpha. It has been rated as critical. This issue affects the function replaceContent of the file app/Core/Support/ContentParser.php of the component Notification Handler. The manipulation leads to code injection.…

    Flute CMS
  • Medium 4.7
    CVE-2024-6946

    Flute CMS list code injection

    A vulnerability was found in Flute CMS 0.2.2.4-alpha. It has been declared as critical. This vulnerability affects unknown code of the file /admin/pages/list. The manipulation of the argument blocks leads to code injection. The attack can be initiated remotel…

    Flute CMS
  • Medium 6.3
    CVE-2024-6945

    Flute CMS Avatar Upload Page ImagesController.php unrestricted upload

    A vulnerability was found in Flute CMS 0.2.2.4-alpha. It has been classified as critical. This affects an unknown part of the file app/Core/Http/Controllers/Profile/ImagesController.php of the component Avatar Upload Page. The manipulation of the argument ava…

    Flute CMS
  • Medium 6.3
    CVE-2024-6944

    ZhongBangKeJi CRMEB PublicController.php get_image_base64 deserialization

    A vulnerability was found in ZhongBangKeJi CRMEB up to 5.4.0 and classified as critical. Affected by this issue is the function get_image_base64 of the file PublicController.php. The manipulation of the argument file leads to deserialization. The attack may b…

    ZhongBangKeJi CRMEB
  • Medium 6.5
    CVE-2024-37488

    WordPress HelloAsso plugin <= 1.1.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HelloAsso HelloAsso helloasso.This issue affects HelloAsso: from n/a through <= 1.1.9.

    HelloAsso HelloAsso
  • Medium 6.5
    CVE-2024-37489

    WordPress Ocean Extra plugin <= 2.2.9 - Authenticated Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OceanWP Ocean Extra allows Stored XSS.This issue affects Ocean Extra: from n/a through 2.2.9.

    OceanWP Ocean Extra
  • Medium 6.5
    CVE-2024-37492

    WordPress Gutenberg plugin <= 18.6.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gutenberg Team Gutenberg allows Stored XSS.This issue affects Gutenberg: from n/a through 18.6.0.

    Gutenberg Team Gutenberg
  • Medium 6.5
    CVE-2024-37495

    WordPress Create by Mediavine plugin <= 1.9.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mischiefmarmot Create by Mediavine mediavine-create.This issue affects Create by Mediavine: from n/a through <= 1.9.7.

    mischiefmarmot Create by Mediavine
  • Medium 6.5
    CVE-2024-37500

    WordPress Beaver Builder plugin <= 2.8.2.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Beaver Builder Team Beaver Builder allows Stored XSS.This issue affects Beaver Builder: from n/a through 2.8.2.2.

    The Beaver Builder Team Beaver Builder
  • Medium 6.5
    CVE-2024-37507

    WordPress Eventin plugin <= 3.3.57 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themewinter Eventin allows Stored XSS.This issue affects Eventin: from n/a through 3.3.57.

    Themewinter Eventin
  • Medium 6.5
    CVE-2024-37512

    WordPress NEX-Forms – Ultimate Form Builder plugin <= 8.5.10 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Basix NEX-Forms – Ultimate Form Builder allows Stored XSS.This issue affects NEX-Forms – Ultimate Form Builder: from n/a through 8.5.10.

    Basix NEX-Forms – Ultimate Form Builder
  • Medium 6.5
    CVE-2024-37514

    WordPress CopySafe Web Protection plugin <= 3.14 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ArtistScope CopySafe Web Protection allows Stored XSS.This issue affects CopySafe Web Protection: from n/a through 3.14.

    ArtistScope CopySafe Web Protection
  • Medium 5.8
    CVE-2024-37515

    WordPress XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Optemiz XPlainer - WooCommerce Product FAQ allows Reflected XSS.This issue affects XPlainer - WooCommerce Product FAQ: from n/a through 1.6.3.

    Optemiz XPlainer - WooCommerce Product FAQ Web / CMS
  • Medium 6.5
    CVE-2024-37519

    WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.1.27 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Leap13 Premium Blocks – Gutenberg Blocks for WordPress premium-blocks-for-gutenberg.This issue affects Premium Blocks – Gutenberg Blocks for WordPress: from …

    leap13 Premium Blocks – Gutenberg Blocks for WordPress Web / CMS
  • Medium 6.1
    CVE-2024-38436

    Commugen SOX 365 – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    Commugen SOX 365 – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    Commugen SOX 365
  • Medium 6.5
    CVE-2024-37521

    WordPress zBench theme <= 1.4.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in zwwooooo zBench allows Stored XSS.This issue affects zBench: from n/a through 1.4.2.

    zwwooooo zBench
  • Medium 5.9
    CVE-2024-37522

    WordPress CC & BCC for Woocommerce Order Emails plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dario Curasì CC & BCC for Woocommerce Order Emails allows Stored XSS.This issue affects CC & BCC for Woocommerce Order Emails: from n/a through 1.4.1.

    Dario Curasì CC & BCC for Woocommerce Order Emails Web / CMS
  • Medium 6.5
    CVE-2024-38435

    Unitronics Vision PLC - CWE-703: Improper Check or Handling of Exceptional Conditions

    Unitronics Vision PLC – CWE-703: Improper Check or Handling of Exceptional Conditions may allow denial of service

    Unitronics Vision PLC
  • Medium 5.9
    CVE-2024-37523

    WordPress Login Logo Editor plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AMP-MODE Login Logo Editor allows Stored XSS.This issue affects Login Logo Editor: from n/a through 1.3.3.

    AMP-MODE Login Logo Editor
  • Medium 6.5
    CVE-2024-38434

    Unitronics Vision PLC - CWE-676: Use of Potentially Dangerous Function

    Unitronics Vision PLC – CWE-676: Use of Potentially Dangerous Function may allow security feature bypass

    Unitronics Vision PLC
  • Medium 5.9
    CVE-2024-37536

    WordPress Easy Custom Code (LESS/CSS/JS) Plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Web357 Easy Custom Code (LESS/CSS/JS) – Live editing allows Stored XSS.This issue affects Easy Custom Code (LESS/CSS/JS) – Live editing: from n/a thro…

    Web357 Easy Custom Code (LESS/CSS/JS) – Live editing
  • Medium 5.9
    CVE-2024-37537

    WordPress WS Contact Form plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in UusWeb.Ee WS Contact Form allows Stored XSS.This issue affects WS Contact Form: from n/a through 1.3.7.

    UusWeb.ee WS Contact Form
  • Medium 5.9
    CVE-2024-37538

    WordPress Link To Bible plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Thomas Kuhlmann Link To Bible allows Stored XSS.This issue affects Link To Bible: from n/a through 2.5.9.

    Thomas Kuhlmann Link To Bible
  • Medium 5.9
    CVE-2024-37545

    WordPress Floating Social Media Links plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Nick Halsey Floating Social Media Links allows Stored XSS.This issue affects Floating Social Media Links: from n/a through 1.5.2.

    Nick Halsey Floating Social Media Links
  • Medium 5.9
    CVE-2024-37548

    WordPress Meks Easy Ads Widget plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Meks Meks Easy Ads Widget allows Stored XSS.This issue affects Meks Easy Ads Widget: from n/a through 2.0.8.

    Meks Meks Easy Ads Widget
  • Medium 5.9
    CVE-2024-37549

    WordPress Save as PDF plugin by Pdfcrowd plugin <= 4.0.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Pdfcrowd Save as PDF plugin by Pdfcrowd allows Stored XSS.This issue affects Save as PDF plugin by Pdfcrowd: from n/a through 4.0.0.

    pdfcrowd Save as PDF Plugin by PDFCrowd
  • Medium 6.3
    CVE-2024-6943

    ZhongBangKeJi CRMEB CopyTaobaoServices.php downloadImage deserialization

    A vulnerability has been found in ZhongBangKeJi CRMEB up to 5.4.0 and classified as critical. Affected by this vulnerability is the function downloadImage of the file app/services/product/product/CopyTaobaoServices.php. The manipulation leads to deserializati…

    ZhongBangKeJi CRMEB
  • Medium 5.9
    CVE-2024-37550

    WordPress Template Kit – Export plugin <= 1.0.22 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Envato Template Kit – Export allows Stored XSS.This issue affects Template Kit – Export: from n/a through 1.0.22.

    envato Template Kit – Export
  • Medium 5.9
    CVE-2024-37551

    WordPress Simple Social Share plugin <= 3.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Perials Simple Social Share allows Stored XSS.This issue affects Simple Social Share: from n/a through 3.0.

    Perials Simple Social Share
  • Medium 5.9
    CVE-2024-37552

    WordPress Social Media Share Buttons & Social Sharing Icons plugin <= 2.9.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Inisev Social Media & Share Icons allows Stored XSS.This issue affects Social Media & Share Icons: from n/a through 2.9.1.

    Inisev Social Media & Share Icons
  • Medium 5.9
    CVE-2024-37556

    WordPress WordPress Notification Bar plugin <= 1.3.10 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SeedProd WordPress Notification Bar allows Stored XSS.This issue affects WordPress Notification Bar: from n/a through 1.3.10.

    SeedProd WordPress Notification Bar Web / CMS
  • Medium 5.9
    CVE-2024-37557

    WordPress WP Cookie Law Info plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Soham Web Solution WP Cookie Law Info allows Stored XSS.This issue affects WP Cookie Law Info: from n/a through 1.1.

    Soham Web Solution WP Cookie Law Info
  • Medium 5.9
    CVE-2024-37558

    WordPress WPFavicon plugin <= 2.1.1 - Cross-Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Nazmul Hossain Nihal WPFavicon allows Stored XSS.This issue affects WPFavicon: from n/a through 2.1.1.

    Nazmul Hossain Nihal WPFavicon
  • Medium 4.7
    CVE-2024-6940

    DedeCMS article_template_rand.php code injection

    A vulnerability was found in DedeCMS 5.7.114. It has been classified as critical. This affects an unknown part of the file article_template_rand.php. The manipulation leads to code injection. It is possible to initiate the attack remotely. The exploit has bee…

  • Medium 6.3
    CVE-2024-6933

    LimeSurvey Survey General Settings updatesurveylocalesettings_generalsettings actionUpdateSurveyLocaleSettingsGeneralSettings sql injection

    A flaw has been found in LimeSurvey 6.5.14-240624. Affected by this issue is the function actionUpdateSurveyLocaleSettingsGeneralSettings of the file /index.php?r=admin/database/index/updatesurveylocalesettings_generalsettings of the component Survey General …

  • Medium 6.4
    CVE-2024-6848

    Post and Page Builder by BoldGrid – Visual Drag and Drop Editor <= 1.26.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via File Upload

    The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file uploads in all versions up to, and including, 1.26.6 due to insufficient input sanitization and output escaping affe…

    Bold Grid Post and Page Builder by BoldGrid – Visual Drag and Drop Editor Web / CMS
  • Medium 5.9
    CVE-2024-37561

    WordPress Plugin Notes Plus plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jamie Bergen Plugin Notes Plus allows Stored XSS.This issue affects Plugin Notes Plus: from n/a through 1.2.6.

    Jamie Bergen Plugin Notes Plus Web / CMS
  • Medium 5.9
    CVE-2024-37562

    WordPress Simple Post Notes plugin <= 1.7.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BracketSpace Simple Post Notes allows Stored XSS.This issue affects Simple Post Notes: from n/a through 1.7.7.

    BracketSpace Simple Post Notes
  • Medium 6.5
    CVE-2024-37563

    WordPress TOCHAT.BE plugin <= 1.3.0 - Unauthenticated Stored Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in TOCHAT.BE allows Stored XSS.This issue affects TOCHAT.BE: from n/a through 1.3.0.

    TOCHAT.BE TOCHAT.BE