Skip to content
OpenAdvisories

Archive

23 November 2024

Vulnerabilities first published on this day (UTC), newest first.

← October 2024 2024 / November /23 December 2024 →
  1. 1235
  2. 212
  3. 317
  4. 4148
  5. 5211
  6. 694
  7. 7115
  8. 8122
  9. 9195
  10. 1035
  11. 11114
  12. 12338
  13. 13230
  14. 14149
  15. 15222
  16. 1650
  17. 1711
  18. 18185
  19. 19388
  20. 20123
  21. 21130
  22. 22388
  23. 2345
  24. 2416
  25. 2577
  26. 26162
  27. 2782
  28. 2875
  29. 2976
  30. 3029
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 7.3
    CVE-2024-11632

    code-projects Simple Car Rental System book_car.php sql injection

    A vulnerability was found in code-projects Simple Car Rental System 1.0. It has been classified as critical. Affected is an unknown function of the file /book_car.php. The manipulation of the argument fname/id_no/gender/email/phone/location leads to sql injec…

    code-projects Simple Car Rental System
  • High 7.3
    CVE-2024-11034

    Request a Quote for WooCommerce and Elementor – Get a Quote Button – Product Enquiry Form Popup – Product Quotation <= 1.4 - Unauthenticated Arbitrary Shortcode Execution via fire_contact_form

    The The Request a Quote for WooCommerce and Elementor – Get a Quote Button – Product Enquiry Form Popup – Product Quotation plugin for WordPress is vulnerable to arbitrary shortcode execution via fire_contact_form AJAX action in all versions up to, and includ…

    wpbean Request a Quote for WooCommerce – Get a Quote Button Web / CMS
  • High 8.8
    CVE-2024-9941

    WPGYM <= 67.1.0 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

    The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the MJ_gmgt_add_staff_member() function in all versions up to, and including, 67.1.0. This makes it possible for authen…

    dasinfomedia WPGYM - Wordpress Gym Management System Web / CMS
  • High 7.5
    CVE-2024-10803

    MP3 Sticky Player <= 8.0 - Unauthenticated Arbitrary File Read/Download

    The MP3 Sticky Player plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.0 via the content/downloader.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the …

    FWDesign MP3 Sticky Player Web / CMS
  • High 8.8
    CVE-2024-9660

    School Management <= 91.5.0 - Authenticated (Student+) Arbitrary File Upload

    The School Management System for Wordpress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the mj_smgt_load_documets_new() and mj_smgt_load_documets() functions in all versions up to, and including, 91.5.0. …

    dasinfomedia School Management System for Wordpress Web / CMS
  • High 8.8
    CVE-2024-10873

    LA-Studio Element Kit for Elementor <= 1.4.2 - Authenticated (Contributor+) Local File Inclusion

    The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.2 via the _load_template function. This makes it possible for authenticated attackers, with Contributor-level access a…

    choijun LA-Studio Element Kit for Elementor Web / CMS
  • High 8.8
    CVE-2024-11415

    WP-Orphanage Extended <= 1.2 - Cross-Site Request Forgery to Orphan Account Privilege Escalation

    The WP-Orphanage Extended plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing or incorrect nonce validation on the wporphanageex_menu_settings() function. This makes it possible fo…

    meloniq WP-Orphanage Extended Web / CMS