Skip to content
OpenAdvisories

Archive

20 October 2024

Vulnerabilities first published on this day (UTC), newest first.

← September 2024 2024 / October /20 November 2024 →
  1. 1110
  2. 292
  3. 363
  4. 489
  5. 582
  6. 685
  7. 7110
  8. 8234
  9. 9125
  10. 10119
  11. 11132
  12. 1222
  13. 1318
  14. 1477
  15. 15188
  16. 16185
  17. 17157
  18. 1879
  19. 1924
  20. 2068
  21. 21433
  22. 2283
  23. 23120
  24. 24111
  25. 25136
  26. 2644
  27. 2735
  28. 28193
  29. 29208
  30. 3096
  31. 3171
All Critical High Medium Low Exploited only Public exploit

27 results · Clear filters · Feed

  • High 7.1
    CVE-2024-49335

    WordPress GoogleDrive folder list plugin <= 2.2.2 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in sh4d0w28 GoogleDrive folder list googledrive-folder-list allows Stored XSS.This issue affects GoogleDrive folder list: from n/a through <= 2.2.2.

    sh4d0w28 GoogleDrive folder list
  • High 7.1
    CVE-2024-49605

    WordPress Community Lite Video Chat plugin <= 2.2 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Stefan Nour AVChat Video Chat avchat-3 allows Stored XSS.This issue affects AVChat Video Chat: from n/a through <= 2.2.

    Stefan Nour AVChat Video Chat
  • High 7.1
    CVE-2024-49629

    WordPress Endless Posts Navigation plugin <= 2.2.7 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Fahad Mahmood Endless Posts Navigation endless-posts-navigation allows Stored XSS.This issue affects Endless Posts Navigation: from n/a through <= 2.2.7.

    Fahad Mahmood Endless Posts Navigation
  • High 8.5
    CVE-2024-47325

    WordPress Multiple Page Generator Plugin – MPG plugin <= 3.4.7 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle MPG multiple-pages-generator-by-porthas allows SQL Injection.This issue affects MPG: from n/a through <= 3.4.7.

    themeisle MPG
  • High 8.5
    CVE-2024-49609

    WordPress Author Discussion plugin <= 0.2.2 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brandon White Author Discussion author-discussion allows Blind SQL Injection.This issue affects Author Discussion: from n/a through <= 0.2.2.

    Brandon White Author Discussion
  • High 8.5
    CVE-2024-49612

    WordPress SW Contact Form plugin <= 1.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sanjeev SW Contact Form sw-contact-form allows Blind SQL Injection.This issue affects SW Contact Form: from n/a through <= 1.0.

    Sanjeev SW Contact Form
  • High 8.5
    CVE-2024-49613

    WordPress Simple Code Insert Shortcode plugin <= 1.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in developersnote Simple Code Insert Shortcode simple-code-insert-shortcode allows SQL Injection.This issue affects Simple Code Insert Shortcode: from n/a throu…

    developersnote Simple Code Insert Shortcode
  • High 8.5
    CVE-2024-49614

    WordPress SermonAudio Widgets plugin <= 1.9.3 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SermonAudio SermonAudio Widgets sermonaudio-widgets allows SQL Injection.This issue affects SermonAudio Widgets: from n/a through <= 1.9.3.

    SermonAudio SermonAudio Widgets
  • High 8.2
    CVE-2024-49615

    WordPress SafetyForms plugin <= 1.0.0 - CSRF to SQL Injection vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Henrique Rodrigues SafetyForms safetymails-forms allows Blind SQL Injection.This issue affects SafetyForms: from n/a through <= 1.0.0.

    Henrique Rodrigues SafetyForms
  • High 8.5
    CVE-2024-49616

    WordPress Rate Own Post plugin <= 1.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in nyasro Rate Own Post rate-own-post allows Blind SQL Injection.This issue affects Rate Own Post: from n/a through <= 1.0.

    nyasro Rate Own Post
  • High 8.2
    CVE-2024-49617

    WordPress Back Link Tracker plugin <= 1.0.0 - CSRF to SQL Injection vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in anciwasim Back Link Tracker back-link-tracker allows Blind SQL Injection.This issue affects Back Link Tracker: from n/a through <= 1.0.0.

    anciwasim Back Link Tracker
  • High 8.5
    CVE-2024-49618

    WordPress MyTweetLinks plugin <= 1.1.1 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jordan Lyall MyTweetLinks mytweetlinks allows Blind SQL Injection.This issue affects MyTweetLinks: from n/a through <= 1.1.1.

    Jordan Lyall MyTweetLinks
  • High 8.5
    CVE-2024-49619

    WordPress Social Link Groups plugin <= 1.1.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in acespritech Social Link Groups social-link-groups allows Blind SQL Injection.This issue affects Social Link Groups: from n/a through <= 1.1.0.

    acespritech Social Link Groups
  • High 8.5
    CVE-2024-49620

    WordPress FERMA.ru.net plugin <= 1.3.3 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mrcheck116 FERMA.ru.net ferma-ru-net-checkout allows Blind SQL Injection.This issue affects FERMA.ru.net: from n/a through <= 1.3.3.

    mrcheck116 FERMA.ru.net
  • High 7.1
    CVE-2024-44061

    WordPress EU/UK VAT Manager for WooCommerce plugin <= 2.12.14 - CSRF to Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory EU/UK VAT Manager for WooCommerce eu-vat-for-woocommerce.This issue affects EU/UK VAT Manager for WooCommerce: from n/a through <= 2.12.14.

    WPFactory EU/UK VAT Manager for WooCommerce Web / CMS
  • High 8.2
    CVE-2024-49621

    WordPress APA Register Newsletter Form plugin <= 1.0.0 - CSRF to SQL Injection vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in aatmaadhikari APA Register Newsletter Form apa-register-newsletter-form allows SQL Injection.This issue affects APA Register Newsletter Form: from n/a through <= 1.0.0.

    aatmaadhikari APA Register Newsletter Form
  • High 8.2
    CVE-2024-49622

    WordPress Apa Banner Slider plugin <= 1.0.0 - CSRF to SQL Injection vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in aatmaadhikari Apa Banner Slider apa-banner-slider allows SQL Injection.This issue affects Apa Banner Slider: from n/a through <= 1.0.0.

    aatmaadhikari Apa Banner Slider
  • High 8.5
    CVE-2024-49623

    WordPress Duplicate Title Validate plugin <= 1.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in hasan movahed Duplicate Title Validate duplicate-title-validate allows Blind SQL Injection.This issue affects Duplicate Title Validate: from n/a through <= 1…

    hasan movahed Duplicate Title Validate
  • High 8.8
    CVE-2024-49608

    WordPress GERRYWORKS Post by Mail plugin <= 1.0 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in gerryworks GERRYWORKS Post by Mail gerryworks-post-by-mail allows Privilege Escalation.This issue affects GERRYWORKS Post by Mail: from n/a through <= 1.0.

    gerryworks GERRYWORKS Post by Mail
  • High 8.8
    CVE-2024-10194

    WAVLINK WN530H4/WN530HG4/WN572HG3 Front-End Authentication Page login.cgi Goto_chidx stack-based overflow

    A vulnerability was found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028. It has been classified as critical. Affected is the function Goto_chidx of the file login.cgi of the component Front-End Authentication Page. The manipulation of the argument …

    WAVLINK WN530H4 WN572HG3 WN530HG4
  • High 7.1
    CVE-2024-49323

    WordPress All in One Slider plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shahriar Alam All in One Slider all-in-one-slider allows Reflected XSS.This issue affects All in One Slider: from n/a through <= 1.1.

    Shahriar Alam All in One Slider
  • High 7.1
    CVE-2024-49334

    WordPress jLayer Parallax Slider plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unizoe Web Solutions jLayer Parallax Slider jlayer-parallax-slider-wp allows Reflected XSS.This issue affects jLayer Parallax Slider: from n/a through <= 1.0.

    Unizoe Web Solutions jLayer Parallax Slider
  • High 7.1
    CVE-2024-49606

    WordPress Google Map Locations plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DotsquaresLtd Google Map Locations google-map-locations allows Reflected XSS.This issue affects Google Map Locations: from n/a through <= 1.0.

    DotsquaresLtd Google Map Locations
  • High 7.3
    CVE-2024-10173

    didi DDMQ Console Module improper authentication

    A vulnerability has been found in didi DDMQ 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Console Module. The manipulation with the input /;login leads to improper authentication. The attack can be…

    didi DDMQ
  • High 7.3
    CVE-2024-10167

    Codezips Sales Management System deletecustind.php sql injection

    A vulnerability classified as critical has been found in Codezips Sales Management System 1.0. This affects an unknown part of the file deletecustind.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remote…

    CodeZips Sales Management System
  • High 7.3
    CVE-2024-10166

    Codezips Sales Management System checkuser.php sql injection

    A vulnerability was found in Codezips Sales Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file checkuser.php. The manipulation of the argument name leads to sql injection. The attack may be l…

    CodeZips Sales Management System
  • High 7.3
    CVE-2024-10165

    Codezips Sales Management System deletecustcom.php sql injection

    A vulnerability was found in Codezips Sales Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file deletecustcom.php. The manipulation of the argument id leads to sql injection. The atta…

    CodeZips Sales Management System