Skip to content
OpenAdvisories

Archive

29 August 2024

Vulnerabilities first published on this day (UTC), newest first.

← July 2024 2024 / August /29 September 2024 →
  1. 1129
  2. 266
  3. 321
  4. 413
  5. 5103
  6. 6160
  7. 7118
  8. 8112
  9. 966
  10. 1016
  11. 1122
  12. 12119
  13. 13226
  14. 14206
  15. 15122
  16. 1656
  17. 17135
  18. 1866
  19. 1972
  20. 20147
  21. 21177
  22. 22129
  23. 2378
  24. 2428
  25. 2524
  26. 26142
  27. 2767
  28. 2875
  29. 29135
  30. 3070
  31. 3118
All Critical High Medium Low Exploited only Public exploit

32 results · Clear filters · Feed

  • Critical 9.8
    CVE-2024-6671 Scanner template EPSS 19%

    WhatsUp Gold GetStatisticalMonitorList SQL Injection Authentication Bypass Vulnerability

    In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.

    Progress Software WhatsUp Gold
  • Critical 9.8
    CVE-2024-6670 Exploited · Ransomware Public exploit Scanner template EPSS 93%

    WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability

    In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.

    Progress Software WhatsUp Gold
    KEV Sep 16, 2024
  • Critical 10.0
    CVE-2024-43955

    WordPress Droip plugin <= 1.1.1 - Unauthenticated Arbitrary File Download/Deletion vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themeum Droip allows File Manipulation.This issue affects Droip: from n/a through 1.1.1.

    Themeum Droip
  • Critical 9.3
    CVE-2024-43941

    WordPress Propovoice Pro plugin <= 1.7.0.3 - Unauthenticated SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Propovoice Propovoice Pro allows SQL Injection.This issue affects Propovoice Pro: from n/a through 1.7.0.3.

    Propovoice Propovoice Pro
  • Critical 9.8
    CVE-2024-43931

    WordPress JobSearch WP Job Board WordPress Plugin plugin <= 2.5.3 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in eyecix JobSearch allows Object Injection.This issue affects JobSearch: from n/a through 2.5.3.

    EyeCix Technologies JobSearch Web / CMS
  • Critical 10.0
    CVE-2024-43918 Public exploit

    WordPress WBW Product Table PRO plugin <= 1.9.4 - Unauthenticated Arbitrary SQL Query Execution vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW WBW Product Table PRO allows SQL Injection.This issue affects WBW Product Table PRO: from n/a through 1.9.4.

    WBW WBW Product Table PRO
  • Critical 9.3
    CVE-2024-43917 Public exploit Scanner template EPSS 23%

    WordPress TI WooCommerce Wishlist plugin <= 2.8.2 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TemplateInvaders TI WooCommerce Wishlist allows SQL Injection.This issue affects TI WooCommerce Wishlist: from n/a through 2.8.2.

    templateinvaders TI WooCommerce Wishlist Web / CMS
  • Critical 9.3
    CVE-2024-43144 Scanner template

    WordPress Cost Calculator Builder plugin <= 3.2.15 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Cost Calculator Builder allows SQL Injection.This issue affects Cost Calculator Builder: from n/a through 3.2.15.

    StylemixThemes Cost Calculator Builder
  • Critical 9.3
    CVE-2024-43132

    WordPress Docket (WooCommerce Collections / Wishlist / Watchlist) plugin < 1.7.0 - Unauthenticated SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPWeb Elite Docket (WooCommerce Collections / Wishlist / Watchlist) allows SQL Injection.This issue affects Docket (WooCommerce Collections / Wishlist / Watc…

    WPWeb Elite Docket (WooCommerce Collections / Wishlist / Watchlist) Web / CMS
  • Critical 9.3
    CVE-2024-39653

    WordPress VikRentCar Car Rental Management System plugin <= 1.4.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in E4J s.R.L. VikRentCar allows SQL Injection.This issue affects VikRentCar: from n/a through 1.4.0.

    E4J s.r.l. VikRentCar
  • Critical 9.3
    CVE-2024-39622

    WordPress ListingPro theme <= 2.9.4 - Unauthenticated SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CridioStudio ListingPro listingpro allows SQL Injection.This issue affects ListingPro: from n/a through <= 2.9.4.

    Cridio Studio ListingPro
  • Critical 9.3
    CVE-2024-38795

    WordPress ListingPro plugin <= 2.9.4 - Unauthenticated SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CridioStudio ListingPro listingpro-plugin allows SQL Injection.This issue affects ListingPro: from n/a through <= 2.9.4.

    Cridio Studio ListingPro
  • Critical 9.3
    CVE-2024-5057 Scanner template

    WordPress Easy Digital Downloads plugin <= 3.2.12 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Easy Digital Downloads allows SQL Injection.This issue affects Easy Digital Downloads: from n/a through 3.2.12.

    Easy Digital Downloads Easy Digital Downloads
  • Critical 9.8
    CVE-2024-29723

    Multiple vulnerabilities in SportsNET

    SQL injection vulnerabilities in SportsNET affecting version 4.0.1. These vulnerabilities could allow an attacker to retrieve, update and delete all information in the database by sending a specially crafted SQL query: https://XXXXXXX.saludydesafio.com/conexi…

    SportsNET SportsNET
  • Critical 9.8
    CVE-2024-29724

    Multiple vulnerabilities in SportsNET

    SQL injection vulnerabilities in SportsNET affecting version 4.0.1. These vulnerabilities could allow an attacker to retrieve, update and delete all information in the database by sending a specially crafted SQL query: https://XXXXXXX.saludydesafio.com/ax/reg…

    SportsNET SportsNET
  • Critical 9.8
    CVE-2024-29725

    Multiple vulnerabilities in SportsNET

    SQL injection vulnerabilities in SportsNET affecting version 4.0.1. These vulnerabilities could allow an attacker to retrieve, update and delete all information in the database by sending a specially crafted SQL query: https://XXXXXXX.saludydesafio.com/app/ax…

    SportsNET SportsNET
  • Critical 9.8
    CVE-2024-29726

    Multiple vulnerabilities in SportsNET

    SQL injection vulnerabilities in SportsNET affecting version 4.0.1. These vulnerabilities could allow an attacker to retrieve, update and delete all information in the database by sending a specially crafted SQL query: https://XXXXXXX.saludydesafio.com/app/ax…

    SportsNET SportsNET
  • Critical 9.8
    CVE-2024-29727

    Multiple vulnerabilities in SportsNET

    SQL injection vulnerabilities in SportsNET affecting version 4.0.1. These vulnerabilities could allow an attacker to retrieve, update and delete all information in the database by sending a specially crafted SQL query: https://XXXXXXX.saludydesafio.com/app/ax…

    SportsNET SportsNET
  • Critical 9.8
    CVE-2024-29728

    Multiple vulnerabilities in SportsNET

    SQL injection vulnerabilities in SportsNET affecting version 4.0.1. These vulnerabilities could allow an attacker to retrieve, update and delete all information in the database by sending a specially crafted SQL query: https://XXXXXXX.saludydesafio.com/app/ax…

    SportsNET SportsNET
  • Critical 9.8
    CVE-2024-29729

    Multiple vulnerabilities in SportsNET

    SQL injection vulnerabilities in SportsNET affecting version 4.0.1. These vulnerabilities could allow an attacker to retrieve, update and delete all information in the database by sending a specially crafted SQL query: https://XXXXXXX.saludydesafio.com/app/ax…

    SportsNET SportsNET
  • Critical 9.8
    CVE-2024-29730

    Multiple vulnerabilities in SportsNET

    SQL injection vulnerabilities in SportsNET affecting version 4.0.1. These vulnerabilities could allow an attacker to retrieve, update and delete all information in the database by sending a specially crafted SQL query:  https://XXXXXXX.saludydesafio.com/app/a…

    SportsNET SportsNET
  • Critical 9.8
    CVE-2024-29731

    Multiple vulnerabilities in SportsNET

    SQL injection vulnerabilities in SportsNET affecting version 4.0.1. These vulnerabilities could allow an attacker to retrieve, update and delete all information in the database by sending a specially crafted SQL query:  https://XXXXXXX.saludydesafio.com/app/a…

    SportsNET SportsNET
  • Critical 9.8
    CVE-2024-45435

    Chartist 1.x through 1.3.0 allows Prototype Pollution via the extend function.

  • Critical 9.1
    CVE-2024-45436 Public exploit

    Ollama can extract members of a ZIP archive outside of the parent directory

    extractFromZipFile in model.go in Ollama before 0.1.47 can extract members of a ZIP archive outside of the parent directory.

    github.com/ollama/ollama Go
  • Critical 9.8
    CVE-2024-41372

    Organizr v1.90 was discovered to contain a SQL injection vulnerability via chat/settyping.php.

  • Critical 9.8
    CVE-2024-41366

    RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\userScripts.php

  • Critical 9.8
    CVE-2024-41369

    RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\inc.setWifi.php

  • Critical 9.8
    CVE-2024-41368

    RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\inc.setWlanIpM…

  • Critical 9.8
    CVE-2024-41361

    RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\manageFilesFol…

  • Critical 9.8
    CVE-2024-41367

    RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\api\playlist\a…

  • Critical 9.8
    CVE-2024-41364

    RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\trackEdit.php

  • Critical 9.8
    CVE-2024-41370

    Organizr v1.90 was discovered to contain a SQL injection vulnerability via chat/setlike.php.