Skip to content
OpenAdvisories

Archive

2 November 2024

Vulnerabilities first published on this day (UTC), newest first.

← October 2024 2024 / November /2 December 2024 →
  1. 1235
  2. 212
  3. 317
  4. 4148
  5. 5211
  6. 694
  7. 7115
  8. 8122
  9. 9195
  10. 1035
  11. 11114
  12. 12338
  13. 13230
  14. 14149
  15. 15222
  16. 1650
  17. 1711
  18. 18185
  19. 19388
  20. 20123
  21. 21130
  22. 22388
  23. 2345
  24. 2416
  25. 2577
  26. 26162
  27. 2782
  28. 2875
  29. 2976
  30. 3029
All Critical High Medium Low Exploited only Public exploit

12 results · Feed

  • High 7.3
    CVE-2024-10702

    code-projects Simple Car Rental System signup.php sql injection

    A vulnerability classified as critical has been found in code-projects Simple Car Rental System 1.0. Affected is an unknown function of the file /signup.php. The manipulation of the argument fname leads to sql injection. It is possible to launch the attack re…

    code-projects Simple Car Rental System
  • Low 3.5
    CVE-2024-10701

    PHPGurukul Car Rental Portal search.php cross site scripting

    A vulnerability was found in PHPGurukul Car Rental Portal 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /search.php. The manipulation of the argument searchdata leads to cross site scripting. The attack may be i…

    PHPGurukul Car Rental Portal
  • Medium 6.3
    CVE-2024-10700

    code-projects University Event Management System submit.php sql injection

    A vulnerability was found in code-projects University Event Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file submit.php. The manipulation of the argument name/email/title/Year/gender/fromdate/todate/…

    code-projects University Event Management System
  • High 7.3
    CVE-2024-10699

    code-projects Wazifa System logincontrol.php sql injection

    A vulnerability was found in code-projects Wazifa System 1.0. It has been classified as critical. This affects an unknown part of the file /controllers/logincontrol.php. The manipulation of the argument username leads to sql injection. It is possible to initi…

    code-projects Wazifa System
  • High 8.8
    CVE-2024-10698

    Tenda AC6 SetOnlineDevName formSetDeviceName stack-based overflow

    A vulnerability was found in Tenda AC6 15.03.05.19 and classified as critical. Affected by this issue is the function formSetDeviceName of the file /goform/SetOnlineDevName. The manipulation of the argument devName leads to stack-based buffer overflow. The at…

    Tenda AC6
  • Medium 6.3
    CVE-2024-10697 EPSS 26%

    Tenda AC6 API Endpoint WriteFacMac formWriteFacMac command injection

    A vulnerability has been found in Tenda AC6 15.03.05.19 and classified as critical. Affected by this vulnerability is the function formWriteFacMac of the file /goform/WriteFacMac of the component API Endpoint. The manipulation of the argument mac leads to com…

    Tenda AC6
  • Medium 6.1
    CVE-2024-9896

    BBP Core – Expand bbPress powered forums with useful features <= 1.2.5 - Reflected Cross-Site Scripting via add_query_arg Parameter

    The BBP Core – Expand bbPress powered forums with useful features plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.5. This ma…

    spiderdevs Forumax – AI Powered Advanced Community Forum Plugin Web / CMS
  • Medium 6.1
    CVE-2024-8739

    ReCaptcha Integration for WordPress <= 1.2.5 - Reflected Cross-Site Scripting

    The ReCaptcha Integration for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.5. This makes it possible for unauth…

    wedevs ReCaptcha Integration for WordPress Web / CMS
  • Medium 5.4
    CVE-2024-9868

    Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Age Gate

    The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Age Gate Widget 'url' parameter in all versions up to, and including, 5.10.1 …

    bdthemes Element Pack – Widgets, Templates & Addons for Elementor Web / CMS
  • Medium 5.3
    CVE-2024-10540

    Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress <= 1.1.16 - Authenticated (Subscriber+) SQL Injection

    The Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress plugin for WordPress is vulnerable to SQL Injection via the 'service' parameter of the bookingpress_form shortcode in all versions up to, and including, 1.1.16 due to insufficient es…

    Repute InfoSystems Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress Web / CMS
  • Medium 6.4
    CVE-2024-10310

    Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Custom Gallery Widget

    The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom Gallery Widget 'image_title' parameter in all versions up to, and incl…

    bdthemes Element Pack – Widgets, Templates & Addons for Elementor Web / CMS
  • High 8.1
    CVE-2024-51774 Public exploit

    qBittorrent before 5.0.1 proceeds with use of https URLs even after certificate validation errors.

    qbittorrent qbittorrent qbittorrent Debian Ubuntu Alpine