Skip to content
OpenAdvisories

Archive

18 August 2024

Vulnerabilities first published on this day (UTC), newest first.

← July 2024 2024 / August /18 September 2024 →
  1. 1129
  2. 266
  3. 321
  4. 413
  5. 5103
  6. 6160
  7. 7118
  8. 8112
  9. 966
  10. 1016
  11. 1122
  12. 12119
  13. 13226
  14. 14206
  15. 15122
  16. 1656
  17. 17135
  18. 1866
  19. 1972
  20. 20147
  21. 21177
  22. 22129
  23. 2378
  24. 2428
  25. 2524
  26. 26142
  27. 2767
  28. 2875
  29. 29135
  30. 3070
  31. 3118
All Critical High Medium Low Exploited only Public exploit

43 results · Clear filters · Feed

  • Medium 4.7
    CVE-2024-7917

    DouPHP Favicon system.php unrestricted upload

    A vulnerability, which was classified as critical, has been found in DouPHP 1.7 Release 20220822. Affected by this issue is some unknown functionality of the file /admin/system.php of the component Favicon Handler. The manipulation of the argument site_favico…

  • Medium 5.3
    CVE-2024-35686

    WordPress Sensei LMS plugin <= 4.23.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Automattic Sensei LMS, Automattic Sensei Pro (WC Paid Courses).This issue affects Sensei LMS: from n/a through 4.23.1; Sensei Pro (WC Paid Courses): from n/a through 4.23.1.1.23.1.

    Automattic Sensei LMS Sensei Pro (WC Paid Courses)
  • Medium 4.3
    CVE-2024-43239

    WordPress Masteriyo LMS plugin <= 1.11.4 - Insecure Direct Object Reference (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - LMS: from n/a through <= 1.11.4.

    masteriyo Masteriyo - LMS
  • Medium 5.4
    CVE-2024-43266

    WordPress WP Job Portal plugin <= 2.1.8 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in wpjobportal WP Job Portal wp-job-portal.This issue affects WP Job Portal: from n/a through <= 2.1.8.

    WP Job Portal WP Job Portal
  • Medium 4.3
    CVE-2024-43288

    WordPress wpForo Forum plugin <= 2.3.4 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in gVectors Team wpForo Forum.This issue affects wpForo Forum: from n/a through 2.3.4.

    gVectors Team wpForo Forum
  • Medium 5.4
    CVE-2024-43322

    WordPress Zephyr Project Manager plugin <= 3.3.100 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.100.

    Dylan James Zephyr Project Manager
  • Medium 5.3
    CVE-2024-7912

    CodeAstro Online Railway Reservation System assets exposure of information through directory listing

    A vulnerability was found in CodeAstro Online Railway Reservation System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/assets/. The manipulation leads to exposure of information through directory listing.…

    CodeAstro Online Railway Reservation System
  • Medium 5.3
    CVE-2024-43350

    WordPress Propovoice CRM plugin <= 1.7.6.4 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Propovoice Propovoice CRM.This issue affects Propovoice CRM: from n/a through 1.7.6.4.

    Propovoice Propovoice CRM
  • Medium 6.5
    CVE-2024-43262

    WordPress Busiprof theme <= 2.4.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in webriti Busiprof allows Stored XSS.This issue affects Busiprof: from n/a through 2.4.8.

    Webriti Busiprof
  • Medium 6.5
    CVE-2024-43263

    WordPress Visual Composer Starter theme <= 3.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Visual Composer Visual Composer Starter allows Stored XSS.This issue affects Visual Composer Starter: from n/a through 3.3.

    Visual Composer Visual Composer Starter
  • Medium 6.5
    CVE-2024-43267

    WordPress Mega Addons For Elementor plugin <= 1.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Qamar Sheeraz, Nasir Ahmad, GenialSouls Mega Addons For Elementor allows Stored XSS.This issue affects Mega Addons For Elementor: from n/a through 1.9.

    Qamar Sheeraz, Nasir Ahmad, GenialSouls Mega Addons For Elementor
  • Medium 6.5
    CVE-2024-43278

    WordPress Meta Field Block plugin <= 1.2.13 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Phi Phan Meta Field Block allows Stored XSS.This issue affects Meta Field Block: from n/a through 1.2.13.

    Phi Phan Meta Field Block
  • Medium 6.5
    CVE-2024-43284

    WordPress WP Travel Gutenberg Blocks plugin <= 3.5.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Travel WP Travel Gutenberg Blocks allows Stored XSS.This issue affects WP Travel Gutenberg Blocks: from n/a through 3.5.1.

    WP Travel WP Travel Gutenberg Blocks
  • Medium 5.9
    CVE-2024-43291

    WordPress Void Contact Form 7 Widget For Elementor Page Builder plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in voidCoders Void Contact Form 7 Widget For Elementor Page Builder allows Stored XSS.This issue affects Void Contact Form 7 Widget For Elementor Page Bu…

    VOID CODERS Void Contact Form 7 Widget For Elementor Page Builder
  • Medium 5.9
    CVE-2024-43292

    WordPress Envo's Elementor Templates & Widgets for WooCommerce plugin <= 1.4.16 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in EnvoThemes Envo's Elementor Templates & Widgets for WooCommerce allows Stored XSS.This issue affects Envo's Elementor Templates & Widgets for WooComme…

    EnvoThemes Envo's Elementor Templates & Widgets for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2024-43294

    WordPress Bold Timeline Lite plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BoldThemes Bold Timeline Lite allows Stored XSS.This issue affects Bold Timeline Lite: from n/a through 1.2.0.

    Bold Themes Bold Timeline Lite
  • Medium 6.3
    CVE-2024-7911

    SourceCodester Simple Online Bidding System index.php file inclusion

    A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been classified as critical. This affects an unknown part of the file /simple-online-bidding-system/bidding/index.php. The manipulation of the argument page leads to file inc…

    SourceCodester Simple Online Bidding System
  • Medium 6.5
    CVE-2024-6221

    Improper Access Control in corydolphin/flask-cors

    A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default. This behavior can expose private network resources to unauthorized external access, leading to significant secu…

    corydolphin corydolphin/flask-cors kubeflow-jupyter-web-app kubeflow-volumes-web-app Debian Ubuntu Wolfi PyPI
  • Medium 4.7
    CVE-2024-7910

    CodeAstro Online Railway Reservation System Profile Photo Update emp-profile-avatar.php unrestricted upload

    A vulnerability was found in CodeAstro Online Railway Reservation System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/emp-profile-avatar.php of the component Profile Photo Update Handler. The manipula…

    CodeAstro Online Railway Reservation System
  • Medium 6.3
    CVE-2024-7907

    TOTOLINK X6000R cstecgi.cgi setSyslogCfg command injection

    A vulnerability, which was classified as critical, has been found in TOTOLINK X6000R 9.4.0cu.852_20230719. This issue affects the function setSyslogCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument rtLogServer leads to command injection. …

    Toto Link X6000R
  • Medium 6.5
    CVE-2024-43305

    WordPress Custom Layouts – Post + Product grids made easy plugin <= 1.4.11 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Code Amp Custom Layouts – Post + Product grids made easy allows Stored XSS.This issue affects Custom Layouts – Post + Product grids made easy: from n/…

    Code Amp Custom Layouts – Post + Product grids made easy
  • Medium 6.5
    CVE-2024-43307

    WordPress Structured Content (JSON-LD) #wpsc plugin <= 1.6.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gordon Böhme, Antonio Leutsch Structured Content allows Stored XSS.This issue affects Structured Content: from n/a through 1.6.2.

    Gordon Böhme, Antonio Leutsch Structured Content
  • Medium 6.5
    CVE-2024-43308

    WordPress Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor plugin <= 3.3.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gutentor Gutentor - Gutenberg Blocks - Page Builder for Gutenberg Editor allows Stored XSS.This issue affects Gutentor - Gutenberg Blocks - Page Build…

    gutentor Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor
  • Medium 6.5
    CVE-2024-43309

    WordPress WP Telegram Widget and Join Link plugin <= 2.1.27 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Socio WP Telegram Widget and Join Link allows Stored XSS.This issue affects WP Telegram Widget and Join Link: from n/a through 2.1.27.

    WP Socio WP Telegram Widget and Join Link
  • Medium 6.5
    CVE-2024-43318

    WordPress E2Pdf – Export To Pdf Tool for WordPress plugin <= 1.25.05 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf e2pdf e2pdf.This issue affects e2pdf: from n/a through <= 1.25.05.

    E2Pdf e2pdf Web / CMS
  • Medium 6.5
    CVE-2024-43320

    WordPress WPBakery Page Builder Addons plugin <= 3.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Livemesh Livemesh Addons for WPBakery Page Builder addons-for-visual-composer allows Stored XSS.This issue affects Livemesh Addons for WPBakery Page B…

    Livemesh Livemesh Addons for WPBakery Page Builder
  • Medium 6.5
    CVE-2024-43321

    WordPress Team Showcase plugin <= 1.22.23 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PickPlugins Team Showcase allows Stored XSS.This issue affects Team Showcase: from n/a through 1.22.23.

    PickPlugins Team Showcase
  • Medium 5.9
    CVE-2024-43324

    WordPress Clever Addons for Elementor plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CleverSoft Clever Addons for Elementor allows Stored XSS.This issue affects Clever Addons for Elementor: from n/a through 2.2.0.

    CleverSoft Clever Addons for Elementor
  • Medium 6.5
    CVE-2024-43329

    WordPress Allegiant theme <= 1.2.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Chill Allegiant allegiant allows Stored XSS.This issue affects Allegiant: from n/a through 1.2.7.

    WP Chill Allegiant
  • Medium 6.5
    CVE-2024-43335

    WordPress Responsive Blocks – WordPress Gutenberg Blocks plugin <= 1.8.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CyberChimps Responsive Blocks – WordPress Gutenberg Blocks allows Stored XSS.This issue affects Responsive Blocks – WordPress Gutenberg Blocks: from n…

    cyberchimps Responsive Blocks – WordPress Gutenberg Blocks Web / CMS
  • Medium 5.9
    CVE-2024-39666

    WordPress WooCommerce plugin <= 9.1.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Automattic WooCommerce.This issue affects WooCommerce: from n/a through 9.1.2.

    Automattic WooCommerce Web / CMS
  • Medium 6.3
    CVE-2024-7906

    DedeBIZ Attachment Settings select_images_post.php get_mime_type unrestricted upload

    A vulnerability classified as critical was found in DedeBIZ 6.3.0. This vulnerability affects the function get_mime_type of the file /admin/dialog/select_images_post.php of the component Attachment Settings. The manipulation of the argument upload leads to un…

  • Medium 6.5
    CVE-2024-43342

    WordPress Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin <= 1.6.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BdThemes Ultimate Store Kit Elementor Addons allows Stored XSS.This issue affects Ultimate Store Kit Elementor Addons: from n/a through 1.6.4.

    bdthemes Ultimate Store Kit Elementor Addons
  • Medium 6.5
    CVE-2024-43344

    WordPress Icegram Engage – Ultimate WP Popup Builder, Lead Generation, Optins, and CTA plugin <= 3.1.25 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Icegram allows Stored XSS.This issue affects Icegram: from n/a through 3.1.25.

    Icegram Icegram
  • Medium 6.5
    CVE-2024-43346

    WordPress Modal Window – create popup modal window plugin <= 6.0.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wow-Company Modal Window allows Stored XSS.This issue affects Modal Window: from n/a through 6.0.3.

    Wow-Company Modal Window
  • Medium 5.9
    CVE-2024-43347

    WordPress Button contact VR plugin <= 4.7.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in VirusTran Button contact VR allows Stored XSS.This issue affects Button contact VR: from n/a through 4.7.3.

    VirusTran Button contact VR
  • Medium 6.5
    CVE-2024-43349

    WordPress All Bootstrap Blocks plugin <= 1.3.19 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in all_bootstrap_blocks All Bootstrap Blocks all-bootstrap-blocks.This issue affects All Bootstrap Blocks: from n/a through <= 1.3.19.

    all_bootstrap_blocks All Bootstrap Blocks
  • Medium 6.5
    CVE-2024-43351

    WordPress Bravada theme <= 1.1.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Bravada bravada allows Stored XSS.This issue affects Bravada: from n/a through 1.1.2.

    CryoutCreations Bravada
  • Medium 6.5
    CVE-2024-43352

    WordPress GivingPress Lite theme <= 1.8.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Organic Themes GivingPress Lite allows Stored XSS.This issue affects GivingPress Lite: from n/a through 1.8.6.

    Organic Themes GivingPress Lite
  • Medium 6.5
    CVE-2024-43353

    WordPress myCred plugin <= 2.7.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal myCred mycred.This issue affects myCred: from n/a through <= 2.7.2.

    Saad Iqbal myCred