Skip to content
OpenAdvisories

Archive

29 August 2024

Vulnerabilities first published on this day (UTC), newest first.

← July 2024 2024 / August /29 September 2024 →
  1. 1129
  2. 266
  3. 321
  4. 413
  5. 5103
  6. 6160
  7. 7118
  8. 8112
  9. 966
  10. 1016
  11. 1122
  12. 12119
  13. 13226
  14. 14206
  15. 15122
  16. 1656
  17. 17135
  18. 1866
  19. 1972
  20. 20147
  21. 21177
  22. 22129
  23. 2378
  24. 2428
  25. 2524
  26. 26142
  27. 2767
  28. 2875
  29. 29135
  30. 3070
  31. 3118
All Critical High Medium Low Exploited only Public exploit

27 results · Clear filters · Feed

  • High 8.8
    CVE-2024-6672

    WhatsUp Gold getMonitorJoin SQL Injection Privilege Escalation Vulnerability

    In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an authenticated low-privileged attacker to achieve privilege escalation by modifying a privileged user's password.

    Progress Software WhatsUp Gold
  • High 7.1
    CVE-2024-43921

    WordPress Generate Images – Magic Post Thumbnail plugin <= 5.2.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Magic Post Thumbnail allows Reflected XSS.This issue affects Magic Post Thumbnail: from n/a through 5.2.9.

    Magic Post Thumbnail Magic Post Thumbnail
  • High 7.1
    CVE-2024-43926

    WordPress Beaver Builder plugin <= 2.8.3.2 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Beaver Builder Team Beaver Builder allows Reflected XSS.This issue affects Beaver Builder: from n/a through 2.8.3.2.

    The Beaver Builder Team Beaver Builder
  • High 7.1
    CVE-2024-43948

    WordPress WP Armour Extended plugin <= 1.26 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dinesh Karki WP Armour Extended.This issue affects WP Armour Extended: from n/a through 1.26.

    Dinesh Karki WP Armour Extended
  • High 7.1
    CVE-2024-43950

    WordPress Brickscore plugin <= 1.4.2.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Nextbricks Brickscore allows Stored XSS.This issue affects Brickscore: from n/a through 1.4.2.5.

    Nextbricks Brickscore
  • High 7.1
    CVE-2024-43958

    WordPress Into The Dark theme <= 1.0.5 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gianni Porto IntoTheDark allows Reflected XSS.This issue affects IntoTheDark: from n/a through 1.0.5.

    Gianni Porto IntoTheDark
  • High 7.1
    CVE-2024-43963

    WordPress Visual CSS Style Editor plugin <= 7.6.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WaspThemes YellowPencil Visual CSS Style Editor allows Reflected XSS.This issue affects YellowPencil Visual CSS Style Editor: from n/a through 7.6.1.

    WaspThemes YellowPencil Visual CSS Style Editor
  • High 8.8
    CVE-2024-43804

    OS Command Injection via Port Scan Functionality in Roxy-WI

    Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. An OS Command Injection vulnerability allows any authenticated user on the application to execute arbitrary code on the web application server via port scanning functionali…

    roxy-wi roxy-wi
  • High 8.1
    CVE-2024-41964

    Insufficient permission checks in the language settings in Kirby CMS

    Kirby is a CMS targeting designers and editors. Kirby allows to restrict the permissions of specific user roles. Users of that role can only perform permitted actions. Permissions for creating and deleting languages have already existed and could be configure…

    getkirby kirby getkirby/cms Packagist
  • High 8.2
    CVE-2024-43965 Public exploit Scanner template

    WordPress SendGrid for WordPress plugin <= 1.4 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smackcoders SendGrid for WordPress allows SQL Injection.This issue affects SendGrid for WordPress: from n/a through 1.4.

    Smackcoders SendGrid for WordPress Web / CMS
  • High 8.4
    CVE-2024-8255

    Path Traversal in Ocean Data Systems Dream Report

    Delta Electronics DTN Soft version 2.0.1 and prior are vulnerable to an attacker achieving remote code execution through a deserialization of untrusted data vulnerability.

    Delta Electronics DTN Soft ICS / OT
  • High 8.5
    CVE-2024-43943

    WordPress Greenshift Woocommerce Addon plugin < 1.9.8 - Subscriber+ SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wpsoul Greenshift Woocommerce Addon allows SQL Injection.This issue affects Greenshift Woocommerce Addon: from n/a before 1.9.8.

    wpsoul Greenshift Woocommerce Addon Web / CMS
  • High 8.5
    CVE-2024-43942

    WordPress Greenshift Query and Meta Addon plugin < 3.9.2 - Subscriber+ SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wpsoul Greenshift Query and Meta Addon allows SQL Injection.This issue affects Greenshift Query and Meta Addon: from n/a before 3.9.2.

    wpsoul Greenshift Query and Meta Addon
  • High 7.6
    CVE-2024-39658

    WordPress Salon Booking System plugin <= 10.7 - Authenticated SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Salon Booking System Salon booking system allows SQL Injection.This issue affects Salon booking system: from n/a through 10.7.

    Salon Booking System Salon booking system
  • High 8.5
    CVE-2024-39638

    WordPress Registrations for the Events Calendar plugin <= 2.12.2 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Roundup WP Registrations for the Events Calendar allows SQL Injection.This issue affects Registrations for the Events Calendar: from n/a through 2.12.2.

    Roundup WP Registrations for the Events Calendar
  • High 8.5
    CVE-2024-39620

    WordPress ListingPro plugin <= 2.9.4 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CridioStudio ListingPro listingpro-plugin allows SQL Injection.This issue affects ListingPro: from n/a through <= 2.9.4.

    Cridio Studio ListingPro
  • High 8.5
    CVE-2024-38793 Public exploit

    WordPress Best Restaurant Menu by Pricelisto plugin <= 1.4.1 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PriceListo Best Restaurant Menu by PriceListo allows SQL Injection.This issue affects Best Restaurant Menu by PriceListo: from n/a through 1.4.1.

    PriceListo Best Restaurant Menu by PriceListo
  • High 7.6
    CVE-2024-38693

    WordPress WP User Frontend plugin <= 4.0.7 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP User Frontend allows SQL Injection.This issue affects WP User Frontend: from n/a through 4.0.7.

    wedevs WP User Frontend
  • High 7.3
    CVE-2024-8301

    dingfanzu CMS checkin.php sql injection

    A vulnerability was found in dingfanzu CMS up to 29d67d9044f6f93378e6eb6ff92272217ff7225c. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /ajax/checkin.php. The manipulation of the argument username le…

    dingfanzu CMS
  • High 7.3
    CVE-2024-5622

    Untrusted search path vulnerability in the AprolConfigureCCServices of B&R APROL

    An untrusted search path vulnerability in the AprolConfigureCCServices of B&R APROL <= R 4.2.-07P3 and <= R 4.4-00P3 may allow an authenticated local attacker to execute arbitrary code with elevated privileges.

    B&R Industrial Automation B&R APROL
  • High 7.0
    CVE-2024-43700

    xfpt versions prior to 1.01 fails to handle appropriately some parameters inside the input data, resulting in a stack-b…

    Philip Hazel xfpt xfpt xfpt Debian Ubuntu
  • High 8.8
    CVE-2024-7607

    Front End Users <= 3.2.28 - Authenticated (Contributor+) Time-Based SQL Injection

    The Front End Users plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 3.2.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the exi…

    Rustaurius Front End Users Web / CMS
  • High 8.1
    CVE-2024-7856 EPSS 19%

    MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.7.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion

    The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the removeTempFiles() function and insufficient path validation on the 'file'…

    sonaar MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar Web / CMS
  • High 7.2
    CVE-2022-2440

    Theme Editor <= 2.8 - Authenticated (Admin+) PHAR Deserialization

    The Theme Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the 'images_array' parameter in versions up to, and including 2.8. This makes it possible for authenticated attackers with administrative privileges to call files us…

    mndpsingh287 Theme Editor Web / CMS
  • High 7.4
    CVE-2024-44777

    A reflected cross-site scripting (XSS) vulnerability in the tag parameter in the index page of vTiger CRM 7.4.0 allows …

  • High 7.4
    CVE-2024-44779

    A reflected cross-site scripting (XSS) vulnerability in the viewname parameter in the index page of vTiger CRM 7.4.0 al…

  • High 7.4
    CVE-2024-44778

    A reflected cross-site scripting (XSS) vulnerability in the parent parameter in the index page of vTiger CRM 7.4.0 allo…