Skip to content
OpenAdvisories

Archive

August 2024

Vulnerabilities first published in this month (UTC), newest first.

← July 2024 2024 / August September 2024 →
  1. 1129
  2. 266
  3. 321
  4. 413
  5. 5103
  6. 6160
  7. 7118
  8. 8112
  9. 966
  10. 1016
  11. 1122
  12. 12119
  13. 13226
  14. 14206
  15. 15122
  16. 1656
  17. 17135
  18. 1866
  19. 1972
  20. 20147
  21. 21177
  22. 22129
  23. 2378
  24. 2428
  25. 2524
  26. 26142
  27. 2767
  28. 2875
  29. 29135
  30. 3070
  31. 3118
All Critical High Medium Low Exploited only Public exploit

303 results · Clear filters · Feed

  • Critical 9.1
    CVE-2024-8016

    The Events Calendar Pro <= 7.0.2 - Authenticated (Administrator+) PHP Object Injection to Remote Code Execution

    The Events Calendar Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.0.2 via deserialization of untrusted input from the 'filters' parameter in widgets. This makes it possible for authenticated attackers, …

    The Events Calendar The Events Calendar Pro Web / CMS
  • Critical 9.1
    CVE-2024-3673 Public exploit Scanner template

    Web Directory Free < 1.7.3 - Unauthenticated LFI

    The Web Directory Free WordPress plugin before 1.7.3 does not validate a parameter before using it in an include(), which could lead to Local File Inclusion issues.

    Web / CMS
  • Critical 9.8
    CVE-2024-45488 Scanner template EPSS 51%

    One Identity Safeguard for Privileged Passwords before 7.5.2 allows unauthorized access because of an issue related to …

  • Critical 9.8
    CVE-2024-45490 Public exploit

    An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.

    qt6-qtwebengine qt5-qtwebengine insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine Wolfi
  • Critical 9.8
    CVE-2024-6671 Scanner template EPSS 19%

    WhatsUp Gold GetStatisticalMonitorList SQL Injection Authentication Bypass Vulnerability

    In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.

    Progress Software WhatsUp Gold
  • Critical 9.8
    CVE-2024-6670 Exploited · Ransomware Public exploit Scanner template EPSS 93%

    WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability

    In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.

    Progress Software WhatsUp Gold
    KEV Sep 16, 2024
  • Critical 10.0
    CVE-2024-43955

    WordPress Droip plugin <= 1.1.1 - Unauthenticated Arbitrary File Download/Deletion vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themeum Droip allows File Manipulation.This issue affects Droip: from n/a through 1.1.1.

    Themeum Droip
  • Critical 9.3
    CVE-2024-43941

    WordPress Propovoice Pro plugin <= 1.7.0.3 - Unauthenticated SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Propovoice Propovoice Pro allows SQL Injection.This issue affects Propovoice Pro: from n/a through 1.7.0.3.

    Propovoice Propovoice Pro
  • Critical 9.8
    CVE-2024-43931

    WordPress JobSearch WP Job Board WordPress Plugin plugin <= 2.5.3 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in eyecix JobSearch allows Object Injection.This issue affects JobSearch: from n/a through 2.5.3.

    EyeCix Technologies JobSearch Web / CMS
  • Critical 10.0
    CVE-2024-43918 Public exploit

    WordPress WBW Product Table PRO plugin <= 1.9.4 - Unauthenticated Arbitrary SQL Query Execution vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW WBW Product Table PRO allows SQL Injection.This issue affects WBW Product Table PRO: from n/a through 1.9.4.

    WBW WBW Product Table PRO
  • Critical 9.3
    CVE-2024-43917 Public exploit Scanner template EPSS 23%

    WordPress TI WooCommerce Wishlist plugin <= 2.8.2 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TemplateInvaders TI WooCommerce Wishlist allows SQL Injection.This issue affects TI WooCommerce Wishlist: from n/a through 2.8.2.

    templateinvaders TI WooCommerce Wishlist Web / CMS
  • Critical 9.3
    CVE-2024-43144 Scanner template

    WordPress Cost Calculator Builder plugin <= 3.2.15 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Cost Calculator Builder allows SQL Injection.This issue affects Cost Calculator Builder: from n/a through 3.2.15.

    StylemixThemes Cost Calculator Builder
  • Critical 9.3
    CVE-2024-43132

    WordPress Docket (WooCommerce Collections / Wishlist / Watchlist) plugin < 1.7.0 - Unauthenticated SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPWeb Elite Docket (WooCommerce Collections / Wishlist / Watchlist) allows SQL Injection.This issue affects Docket (WooCommerce Collections / Wishlist / Watc…

    WPWeb Elite Docket (WooCommerce Collections / Wishlist / Watchlist) Web / CMS
  • Critical 9.3
    CVE-2024-39653

    WordPress VikRentCar Car Rental Management System plugin <= 1.4.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in E4J s.R.L. VikRentCar allows SQL Injection.This issue affects VikRentCar: from n/a through 1.4.0.

    E4J s.r.l. VikRentCar
  • Critical 9.3
    CVE-2024-39622

    WordPress ListingPro theme <= 2.9.4 - Unauthenticated SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CridioStudio ListingPro listingpro allows SQL Injection.This issue affects ListingPro: from n/a through <= 2.9.4.

    Cridio Studio ListingPro
  • Critical 9.3
    CVE-2024-38795

    WordPress ListingPro plugin <= 2.9.4 - Unauthenticated SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CridioStudio ListingPro listingpro-plugin allows SQL Injection.This issue affects ListingPro: from n/a through <= 2.9.4.

    Cridio Studio ListingPro
  • Critical 9.3
    CVE-2024-5057 Scanner template

    WordPress Easy Digital Downloads plugin <= 3.2.12 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Easy Digital Downloads allows SQL Injection.This issue affects Easy Digital Downloads: from n/a through 3.2.12.

    Easy Digital Downloads Easy Digital Downloads
  • Critical 9.8
    CVE-2024-29723

    Multiple vulnerabilities in SportsNET

    SQL injection vulnerabilities in SportsNET affecting version 4.0.1. These vulnerabilities could allow an attacker to retrieve, update and delete all information in the database by sending a specially crafted SQL query: https://XXXXXXX.saludydesafio.com/conexi…

    SportsNET SportsNET
  • Critical 9.8
    CVE-2024-29724

    Multiple vulnerabilities in SportsNET

    SQL injection vulnerabilities in SportsNET affecting version 4.0.1. These vulnerabilities could allow an attacker to retrieve, update and delete all information in the database by sending a specially crafted SQL query: https://XXXXXXX.saludydesafio.com/ax/reg…

    SportsNET SportsNET
  • Critical 9.8
    CVE-2024-29725

    Multiple vulnerabilities in SportsNET

    SQL injection vulnerabilities in SportsNET affecting version 4.0.1. These vulnerabilities could allow an attacker to retrieve, update and delete all information in the database by sending a specially crafted SQL query: https://XXXXXXX.saludydesafio.com/app/ax…

    SportsNET SportsNET
  • Critical 9.8
    CVE-2024-29726

    Multiple vulnerabilities in SportsNET

    SQL injection vulnerabilities in SportsNET affecting version 4.0.1. These vulnerabilities could allow an attacker to retrieve, update and delete all information in the database by sending a specially crafted SQL query: https://XXXXXXX.saludydesafio.com/app/ax…

    SportsNET SportsNET
  • Critical 9.8
    CVE-2024-29727

    Multiple vulnerabilities in SportsNET

    SQL injection vulnerabilities in SportsNET affecting version 4.0.1. These vulnerabilities could allow an attacker to retrieve, update and delete all information in the database by sending a specially crafted SQL query: https://XXXXXXX.saludydesafio.com/app/ax…

    SportsNET SportsNET
  • Critical 9.8
    CVE-2024-29728

    Multiple vulnerabilities in SportsNET

    SQL injection vulnerabilities in SportsNET affecting version 4.0.1. These vulnerabilities could allow an attacker to retrieve, update and delete all information in the database by sending a specially crafted SQL query: https://XXXXXXX.saludydesafio.com/app/ax…

    SportsNET SportsNET
  • Critical 9.8
    CVE-2024-29729

    Multiple vulnerabilities in SportsNET

    SQL injection vulnerabilities in SportsNET affecting version 4.0.1. These vulnerabilities could allow an attacker to retrieve, update and delete all information in the database by sending a specially crafted SQL query: https://XXXXXXX.saludydesafio.com/app/ax…

    SportsNET SportsNET
  • Critical 9.8
    CVE-2024-29730

    Multiple vulnerabilities in SportsNET

    SQL injection vulnerabilities in SportsNET affecting version 4.0.1. These vulnerabilities could allow an attacker to retrieve, update and delete all information in the database by sending a specially crafted SQL query:  https://XXXXXXX.saludydesafio.com/app/a…

    SportsNET SportsNET
  • Critical 9.8
    CVE-2024-29731

    Multiple vulnerabilities in SportsNET

    SQL injection vulnerabilities in SportsNET affecting version 4.0.1. These vulnerabilities could allow an attacker to retrieve, update and delete all information in the database by sending a specially crafted SQL query:  https://XXXXXXX.saludydesafio.com/app/a…

    SportsNET SportsNET
  • Critical 9.8
    CVE-2024-45435

    Chartist 1.x through 1.3.0 allows Prototype Pollution via the extend function.

  • Critical 9.1
    CVE-2024-45436 Public exploit

    Ollama can extract members of a ZIP archive outside of the parent directory

    extractFromZipFile in model.go in Ollama before 0.1.47 can extract members of a ZIP archive outside of the parent directory.

    github.com/ollama/ollama Go
  • Critical 9.8
    CVE-2024-41372

    Organizr v1.90 was discovered to contain a SQL injection vulnerability via chat/settyping.php.

  • Critical 9.8
    CVE-2024-41366

    RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\userScripts.php

  • Critical 9.8
    CVE-2024-41369

    RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\inc.setWifi.php

  • Critical 9.8
    CVE-2024-41368

    RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\inc.setWlanIpM…

  • Critical 9.8
    CVE-2024-41361

    RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\manageFilesFol…

  • Critical 9.8
    CVE-2024-41367

    RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\api\playlist\a…

  • Critical 9.8
    CVE-2024-41364

    RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\trackEdit.php

  • Critical 9.8
    CVE-2024-41370

    Organizr v1.90 was discovered to contain a SQL injection vulnerability via chat/setlike.php.

  • Critical 9.8
    CVE-2024-8030

    Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 2.0.3 - Unauthenticated PHP Object Injection

    The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin is vulnerable to PHP Object Injection via deserialization of untrusted input via the _ultimate_store_kit…

    bdthemes Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor Web / CMS
  • Critical 9.8
    CVE-2024-34198

    TOTOLINK AC1200 Wireless Router A3002RU V2.1.1-B20230720.1011 is vulnerable to Buffer Overflow. The formWlEncrypt CGI h…

  • Critical 9.9
    CVE-2024-44761

    An issue in EQ Enterprise Management System before v2.0.0 allows attackers to execute a directory traversal via crafted…

  • Critical 9.1
    CVE-2024-44760

    Incorrect access control in the component /servlet/SnoopServlet of Shenzhou News Union Enterprise Management System v5.…