Skip to content
OpenAdvisories

Archive

August 2024

Vulnerabilities first published in this month (UTC), newest first.

← July 2024 2024 / August September 2024 →
  1. 1129
  2. 266
  3. 321
  4. 413
  5. 5103
  6. 6160
  7. 7118
  8. 8112
  9. 966
  10. 1016
  11. 1122
  12. 12119
  13. 13226
  14. 14206
  15. 15122
  16. 1656
  17. 17135
  18. 1866
  19. 1972
  20. 20147
  21. 21177
  22. 22129
  23. 2378
  24. 2428
  25. 2524
  26. 26142
  27. 2767
  28. 2875
  29. 29135
  30. 3070
  31. 3118
All Critical High Medium Low Exploited only Public exploit

2,918 results · Feed

  • High 8.8
    CVE-2024-43804

    OS Command Injection via Port Scan Functionality in Roxy-WI

    Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. An OS Command Injection vulnerability allows any authenticated user on the application to execute arbitrary code on the web application server via port scanning functionali…

    roxy-wi roxy-wi
  • Medium 6.8
    CVE-2024-35133 Public exploit

    IBM Security Verify Access HTTP open redirect

    IBM Security Verify Access 10.0.0 through 10.0.8 OIDC Provider could allow a remote authenticated attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploi…

    IBM Security Verify Access Security Verify Access Docker
  • High 8.1
    CVE-2024-41964

    Insufficient permission checks in the language settings in Kirby CMS

    Kirby is a CMS targeting designers and editors. Kirby allows to restrict the permissions of specific user roles. Users of that role can only perform permitted actions. Permissions for creating and deleting languages have already existed and could be configure…

    getkirby kirby getkirby/cms Packagist
  • High 8.2
    CVE-2024-43965 Public exploit Scanner template

    WordPress SendGrid for WordPress plugin <= 1.4 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smackcoders SendGrid for WordPress allows SQL Injection.This issue affects SendGrid for WordPress: from n/a through 1.4.

    Smackcoders SendGrid for WordPress Web / CMS
  • Medium 6.5
    CVE-2024-43957

    WordPress Animated Number Counters plugin <= 1.9 - Editor+ Limited Local File Inclusion vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Sk. Abul Hasan Animated Number Counters allows PHP Local File Inclusion.This issue affects Animated Number Counters: from n/a through 1.9.

    Sk. Abul Hasan Animated Number Counters
  • Medium 4.6
    CVE-2024-35118

    IBM MaaS360 information disclosure

    IBM MaaS360 for Android 6.31 through 8.60 is using hard coded credentials that can be obtained by a user with physical access to the device.

    IBM MaaS360
  • Critical 10.0
    CVE-2024-43955

    WordPress Droip plugin <= 1.1.1 - Unauthenticated Arbitrary File Download/Deletion vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themeum Droip allows File Manipulation.This issue affects Droip: from n/a through 1.1.1.

    Themeum Droip
  • High 8.4
    CVE-2024-8255

    Path Traversal in Ocean Data Systems Dream Report

    Delta Electronics DTN Soft version 2.0.1 and prior are vulnerable to an attacker achieving remote code execution through a deserialization of untrusted data vulnerability.

    Delta Electronics DTN Soft ICS / OT
  • Medium 6.3
    CVE-2024-43954

    WordPress Droip plugin <= 1.1.1 - Subscriber+ Settings Change/Data Exposure Vulnerability

    Incorrect Authorization vulnerability in Themeum Droip allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Droip: from n/a through 1.1.1.

    Themeum Droip
  • Low 3.7
    CVE-2024-43944

    WordPress Maintenance & Coming Soon Redirect Animation plugin <= 2.3.3 - Bypass Vulnerability vulnerability

    Authentication Bypass by Spoofing vulnerability in ilyasine Maintenance & Coming Soon Redirect Animation maintenance-coming-soon-redirect-animation allows Identity Spoofing.This issue affects Maintenance & Coming Soon Redirect Animation: from n/a through <= 2…

    ilyasine Maintenance & Coming Soon Redirect Animation
  • High 8.5
    CVE-2024-43943

    WordPress Greenshift Woocommerce Addon plugin < 1.9.8 - Subscriber+ SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wpsoul Greenshift Woocommerce Addon allows SQL Injection.This issue affects Greenshift Woocommerce Addon: from n/a before 1.9.8.

    wpsoul Greenshift Woocommerce Addon Web / CMS
  • High 8.5
    CVE-2024-43942

    WordPress Greenshift Query and Meta Addon plugin < 3.9.2 - Subscriber+ SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wpsoul Greenshift Query and Meta Addon allows SQL Injection.This issue affects Greenshift Query and Meta Addon: from n/a before 3.9.2.

    wpsoul Greenshift Query and Meta Addon
  • Critical 9.3
    CVE-2024-43941

    WordPress Propovoice Pro plugin <= 1.7.0.3 - Unauthenticated SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Propovoice Propovoice Pro allows SQL Injection.This issue affects Propovoice Pro: from n/a through 1.7.0.3.

    Propovoice Propovoice Pro
  • Medium 6.5
    CVE-2024-43940

    WordPress Z Y N I T H plugin <= 7.4.9 - Unauthenticated Plugin Settings Change vulnerability

    Missing Authorization vulnerability in VIICTORY MEDIA LLC Z Y N I T H allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Z Y N I T H: from n/a through 7.4.9.

    VIICTORY MEDIA Z Y N I T H
  • Medium 6.5
    CVE-2024-43939

    WordPress Z Y N I T H plugin <= 7.4.9 - Unauthenticated Arbitrary Option Deletion vulnerability

    Missing Authorization vulnerability in VIICTORY MEDIA LLC Z Y N I T H allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Z Y N I T H: from n/a through 7.4.9.

    VIICTORY MEDIA Z Y N I T H
  • Critical 9.8
    CVE-2024-43931

    WordPress JobSearch WP Job Board WordPress Plugin plugin <= 2.5.3 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in eyecix JobSearch allows Object Injection.This issue affects JobSearch: from n/a through 2.5.3.

    EyeCix Technologies JobSearch Web / CMS
  • Medium 4.8
    CVE-2024-43922

    WordPress NitroPack plugin <= 1.16.7 - Unauthenticated Arbitrary Shortcode Execution vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in NitroPack Inc. NitroPack allows Code Injection.This issue affects NitroPack: from n/a through 1.16.7.

    NitroPack NitroPack
  • Critical 10.0
    CVE-2024-43918 Public exploit

    WordPress WBW Product Table PRO plugin <= 1.9.4 - Unauthenticated Arbitrary SQL Query Execution vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW WBW Product Table PRO allows SQL Injection.This issue affects WBW Product Table PRO: from n/a through 1.9.4.

    WBW WBW Product Table PRO
  • Critical 9.3
    CVE-2024-43917 Public exploit Scanner template EPSS 23%

    WordPress TI WooCommerce Wishlist plugin <= 2.8.2 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TemplateInvaders TI WooCommerce Wishlist allows SQL Injection.This issue affects TI WooCommerce Wishlist: from n/a through 2.8.2.

    templateinvaders TI WooCommerce Wishlist Web / CMS
  • Critical 9.3
    CVE-2024-43144 Scanner template

    WordPress Cost Calculator Builder plugin <= 3.2.15 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Cost Calculator Builder allows SQL Injection.This issue affects Cost Calculator Builder: from n/a through 3.2.15.

    StylemixThemes Cost Calculator Builder
  • Critical 9.3
    CVE-2024-43132

    WordPress Docket (WooCommerce Collections / Wishlist / Watchlist) plugin < 1.7.0 - Unauthenticated SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPWeb Elite Docket (WooCommerce Collections / Wishlist / Watchlist) allows SQL Injection.This issue affects Docket (WooCommerce Collections / Wishlist / Watc…

    WPWeb Elite Docket (WooCommerce Collections / Wishlist / Watchlist) Web / CMS
  • High 7.6
    CVE-2024-39658

    WordPress Salon Booking System plugin <= 10.7 - Authenticated SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Salon Booking System Salon booking system allows SQL Injection.This issue affects Salon booking system: from n/a through 10.7.

    Salon Booking System Salon booking system
  • Medium 4.7
    CVE-2024-8304

    jpress Template Module edit path traversal

    A vulnerability has been found in jpress up to 5.1.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/template/edit of the component Template Module Handler. The manipulation leads to path traversal. Th…

  • Medium 6.3
    CVE-2024-8303

    dingfanzu CMS getBasicInfo.php sql injection

    A vulnerability classified as critical has been found in dingfanzu CMS up to 29d67d9044f6f93378e6eb6ff92272217ff7225c. This affects an unknown part of the file /ajax/getBasicInfo.php. The manipulation of the argument username leads to sql injection. It is pos…

    dingfanzu CMS
  • Critical 9.3
    CVE-2024-39653

    WordPress VikRentCar Car Rental Management System plugin <= 1.4.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in E4J s.R.L. VikRentCar allows SQL Injection.This issue affects VikRentCar: from n/a through 1.4.0.

    E4J s.r.l. VikRentCar
  • High 8.5
    CVE-2024-39638

    WordPress Registrations for the Events Calendar plugin <= 2.12.2 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Roundup WP Registrations for the Events Calendar allows SQL Injection.This issue affects Registrations for the Events Calendar: from n/a through 2.12.2.

    Roundup WP Registrations for the Events Calendar
  • Critical 9.3
    CVE-2024-39622

    WordPress ListingPro theme <= 2.9.4 - Unauthenticated SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CridioStudio ListingPro listingpro allows SQL Injection.This issue affects ListingPro: from n/a through <= 2.9.4.

    Cridio Studio ListingPro
  • High 8.5
    CVE-2024-39620

    WordPress ListingPro plugin <= 2.9.4 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CridioStudio ListingPro listingpro-plugin allows SQL Injection.This issue affects ListingPro: from n/a through <= 2.9.4.

    Cridio Studio ListingPro
  • Critical 9.3
    CVE-2024-38795

    WordPress ListingPro plugin <= 2.9.4 - Unauthenticated SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CridioStudio ListingPro listingpro-plugin allows SQL Injection.This issue affects ListingPro: from n/a through <= 2.9.4.

    Cridio Studio ListingPro
  • High 8.5
    CVE-2024-38793 Public exploit

    WordPress Best Restaurant Menu by Pricelisto plugin <= 1.4.1 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PriceListo Best Restaurant Menu by PriceListo allows SQL Injection.This issue affects Best Restaurant Menu by PriceListo: from n/a through 1.4.1.

    PriceListo Best Restaurant Menu by PriceListo
  • High 7.6
    CVE-2024-38693

    WordPress WP User Frontend plugin <= 4.0.7 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP User Frontend allows SQL Injection.This issue affects WP User Frontend: from n/a through 4.0.7.

    wedevs WP User Frontend
  • Critical 9.3
    CVE-2024-5057 Scanner template

    WordPress Easy Digital Downloads plugin <= 3.2.12 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Easy Digital Downloads allows SQL Injection.This issue affects Easy Digital Downloads: from n/a through 3.2.12.

    Easy Digital Downloads Easy Digital Downloads
  • Medium 6.3
    CVE-2024-8302

    dingfanzu CMS chpwd.php sql injection

    A vulnerability was found in dingfanzu CMS up to 29d67d9044f6f93378e6eb6ff92272217ff7225c. It has been rated as critical. Affected by this issue is some unknown functionality of the file /ajax/chpwd.php. The manipulation of the argument username leads to sql …

    dingfanzu CMS
  • Medium 6.4
    CVE-2024-1056

    Funnel Kit Funnel Builder PRO <= 3.4.5 Authenticated(Contributor+) Stored Cross-Site Scripting via allow_iframe_tag_in_post

    The FunnelKit Funnel Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'allow_iframe_tag_in_post' function which uses the 'wp_kses_allowed_html' filter to globally allow script and iframe tags in posts in all versions up to…

    FunnelKit FunnelKit Funnel Builder Pro Web / CMS
  • High 7.3
    CVE-2024-8301

    dingfanzu CMS checkin.php sql injection

    A vulnerability was found in dingfanzu CMS up to 29d67d9044f6f93378e6eb6ff92272217ff7225c. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /ajax/checkin.php. The manipulation of the argument username le…

    dingfanzu CMS
  • Medium 5.3
    CVE-2024-8297

    kitsada8621 Digital Library Management System jwt_refresh_token_middleware.go JwtRefreshAuth neutralization for logs

    A vulnerability was found in kitsada8621 Digital Library Management System 1.0. It has been classified as problematic. Affected is the function JwtRefreshAuth of the file middleware/jwt_refresh_token_middleware.go. The manipulation of the argument Authorizati…

    kitsada8621 Digital Library Management System
  • Medium 6.4
    CVE-2024-1384

    Premium Portfolio Features for Phlox theme <= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Premium Portfolio Features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'aux_recent_portfolios_grid' shortcode in all versions up to, and including, 2.3.4 due to insufficient input sanitization and out…

    Averta Premium Portfolio Features for Phlox theme Web / CMS
  • Medium 5.3
    CVE-2024-3679

    Premium SEO Pack – WP SEO Plugin <= 1.6.002 - Unauthenticated Information Exposure

    The Premium SEO Pack – WP SEO Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.002. This makes it possible for unauthenticated attackers to view limited information from password protected p…

    calinvingan Premium SEO Pack – WP SEO Plugin Web / CMS
  • Medium 6.3
    CVE-2024-8296

    FeehiCMS index.php insert unrestricted upload

    A vulnerability was found in FeehiCMS up to 2.1.1 and classified as critical. This issue affects the function insert of the file /admin/index.php?r=user%2Fcreate. The manipulation of the argument User[avatar] leads to unrestricted upload. The attack may be in…

    feehi/cms Packagist
  • Medium 5.3
    CVE-2024-2541

    Popup Builder <= 4.3.6 - Sensitive Information Exposure via Imported Subscribers CSV File

    The Popup Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.6 via the Subscribers Import feature. This makes it possible for unauthenticated attackers to extract sensitive data after an admi…

    Popup-Builder Popup Builder – Create highly converting, mobile friendly marketing popups. Web / CMS