Skip to content
OpenAdvisories

Archive

12 September 2024

Vulnerabilities first published on this day (UTC), newest first.

← August 2024 2024 / September /12 October 2024 →
  1. 111
  2. 276
  3. 374
  4. 4176
  5. 568
  6. 674
  7. 751
  8. 827
  9. 957
  10. 10237
  11. 11115
  12. 12118
  13. 13152
  14. 1413
  15. 1529
  16. 16164
  17. 17107
  18. 18241
  19. 1961
  20. 2038
  21. 219
  22. 2220
  23. 2362
  24. 2474
  25. 25103
  26. 26119
  27. 27162
  28. 2829
  29. 299
  30. 3066
All Critical High Medium Low Exploited only Public exploit

57 results · Clear filters · Feed

  • Medium 4.8
    CVE-2024-6887

    Giveaways and Contests by RafflePress < 1.12.16 - Editor+ Stored XSS

    The Giveaways and Contests by RafflePress WordPress plugin before 1.12.16 does not sanitise and escape some of its Giveaways settings, which could allow high privilege users such as editor and above to perform Stored Cross-Site Scripting attacks even when the…

    Web / CMS
  • Medium 6.1
    CVE-2024-6018

    Music Request Manager <= 1.3 - Reflected XSS

    The Music Request Manager WordPress plugin through 1.3 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers

    Web / CMS
  • Medium 6.1
    CVE-2024-6017

    Music Request Manager <= 1.3 - Stored XSS via CSRF

    The Music Request Manager WordPress plugin through 1.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack

    Web / CMS
  • Medium 6.1
    CVE-2024-6019

    Music Request Manager <= 1.3 - Unauthenticated Stored XSS

    The Music Request Manager WordPress plugin through 1.3 does not sanitise and escape incoming music requests, which could allow unauthenticated users to perform Cross-Site Scripting attacks against administrators

    Web / CMS
  • Medium 4.3
    CVE-2024-3163

    Easy Property Listings < 3.5.4 - Arbitrary Contact Deletion via CSRF

    The Easy Property Listings WordPress plugin before 3.5.4 does not have CSRF check when deleting contacts in bulk, which could allow attackers to make a logged in admin delete them via a CSRF attack

    Web / CMS
  • Medium 4.8
    CVE-2024-5799

    CM Pop-Up Banners for WordPress < 1.7.3 - Contributor+ Stored XSS

    The CM Pop-Up Banners for WordPress plugin before 1.7.3 does not sanitise and escape some of its popup fields, which could allow high privilege users such as Contributors to perform Cross-Site Scripting attacks.

    Web / CMS
  • Medium 5.3
    CVE-2024-8711

    SourceCodester Food Ordering Management System includes exposure of information through directory listing

    A vulnerability, which was classified as problematic, has been found in SourceCodester Food Ordering Management System 1.0. Affected by this issue is some unknown functionality of the file /includes/. The manipulation leads to exposure of information through …

    SourceCodester Food Ordering Management System
  • Medium 6.5
    CVE-2024-38222

    Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

    Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

    Microsoft Microsoft Edge (Chromium-based) Browsers
  • Medium 6.3
    CVE-2024-8710

    code-projects Inventory Management Products Table Page viewProduct.php sql injection

    A vulnerability classified as critical was found in code-projects Inventory Management 1.0. Affected by this vulnerability is an unknown functionality of the file /model/viewProduct.php of the component Products Table Page. The manipulation of the argument id…

    code-projects Inventory Management
  • Medium 6.3
    CVE-2024-8709

    SourceCodester Best House Rental Management System admin_class.php save_user sql injection

    A vulnerability classified as critical has been found in SourceCodester Best House Rental Management System 1.0. Affected is the function delete_user/save_user of the file /admin_class.php. The manipulation of the argument id leads to sql injection. It is pos…

    SourceCodester Best House Rental Management System
  • Medium 4.3
    CVE-2024-8707

    云课网络科技有限公司 Yunke Online School System Appadmin.php downfile path traversal

    A vulnerability was found in 云课网络科技有限公司 Yunke Online School System up to 3.0.6. It has been declared as problematic. This vulnerability affects the function downfile of the file application/admin/controller/Appadmin.php. The manipulation of the argument url l…

  • Medium 5.4
    CVE-2020-24061

    Cross Site Scripting (XSS) Vulnerability in Firewall menu in Control Panel in KASDA KW5515 version 4.3.1.0, allows atta…

  • Medium 6.1
    CVE-2024-34335

    ORDAT FOSS-Online before version 2.24.01 was discovered to contain a reflected cross-site scripting (XSS) vulnerability…

  • Medium 5.3
    CVE-2024-34336

    User enumeration vulnerability in ORDAT FOSS-Online before v2.24.01 allows attackers to determine if an account exists …

  • Medium 5.5
    CVE-2024-45182

    An issue was discovered in WibuKey64.sys in WIBU-SYSTEMS WibuKey before v6.70 and fixed in v.6.70 An improper bounds ch…

  • Medium 4.3
    CVE-2024-25270

    An issue in Mirapolis LMS 4.6.XX allows authenticated users to exploit an Insecure Direct Object Reference (IDOR) vulne…

  • Medium 6.6
    CVE-2024-41629

    An issue in Texas Instruments Fusion Digital Power Designer v.7.10.1 allows a local attacker to obtain sensitive inform…