Skip to content
OpenAdvisories

Archive

9 December 2024

Vulnerabilities first published on this day (UTC), newest first.

← November 2024 2024 / December /9 January 2025 →
  1. 112
  2. 2199
  3. 383
  4. 4138
  5. 5112
  6. 6170
  7. 732
  8. 87
  9. 9288
  10. 10339
  11. 11157
  12. 12150
  13. 13297
  14. 1449
  15. 159
  16. 16208
  17. 1785
  18. 18156
  19. 1994
  20. 2087
  21. 2130
  22. 2216
  23. 2333
  24. 2460
  25. 2528
  26. 2666
  27. 27284
  28. 2850
  29. 2969
  30. 3059
  31. 31105
All Critical High Medium Low Exploited only Public exploit

212 results · Clear filters · Feed

  • Medium 4.3
    CVE-2023-49858

    WordPress Custom Login plugin <= 4.1.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Austin Custom Login custom-login allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Login: from n/a through <= 4.1.0.

    Austin Custom Login
  • Medium 6.5
    CVE-2023-49848

    WordPress Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy plugin <= 2.1.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Marc dooder Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy woo-aliexpress-dropshipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sharkdropship dropshipping …

    Marc dooder Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy
  • Medium 4.3
    CVE-2023-49849

    WordPress Shortcoder plugin <= 6.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in vaakash Shortcoder shortcoder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shortcoder: from n/a through <= 6.3.

    vaakash Shortcoder
  • Medium 5.3
    CVE-2023-49850

    WordPress WP Simple HTML Sitemap plugin <= 2.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Ashish Ajani WP Simple HTML Sitemap allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Simple HTML Sitemap: from n/a through 2.7.

    Ashish Ajani WP Simple HTML Sitemap
  • Medium 5.3
    CVE-2023-49851

    WordPress Square Thumbnails plugin <= 1.1.1 - Broken Access Control + CSRF vulnerability

    Missing Authorization vulnerability in ILMDESIGNS Square Thumbnails allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Square Thumbnails: from n/a through 1.1.1.

    ILMDESIGNS Square Thumbnails
  • Medium 6.5
    CVE-2023-49857

    WordPress Awesome Support plugin <= 6.1.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in awesomesupport Awesome Support awesome-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Awesome Support: from n/a through <= 6.1.7.

    Awesome Support Awesome Support
  • Medium 5.3
    CVE-2023-50373

    WordPress Alt Manager plugin <= 1.6.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPSAAD Alt Manager alt-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Alt Manager: from n/a through <= 1.6.1.

    wpsaad Alt Manager
  • Medium 5.3
    CVE-2023-50375

    WordPress Translate WordPress – Google Language Translator plugin <= 6.0.19 - Broken Access Control vulnerability

    Missing Authorization vulnerability in edo888 Google Language Translator google-language-translator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Google Language Translator: from n/a through <= 6.0.19.

    edo888 Google Language Translator
  • Medium 4.3
    CVE-2023-50877

    WordPress Product Filter by WBW plugin <= 2.5.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in woobewoo Product Filter by WBW allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Filter by WBW: from n/a through 2.5.0.

    woobewoo Product Filter by WBW
  • Medium 4.3
    CVE-2023-50876

    WordPress Molongui plugin <= 4.7.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Molongui Molongui allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Molongui: from n/a through 4.7.3.

    molongui Molongui
  • Medium 5.3
    CVE-2023-50882

    WordPress ProfilePress plugin <= 4.13.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfilePress: from n/a through <= 4.13.2.

    Proper Fraction ProfilePress
  • Medium 6.5
    CVE-2023-50884

    WordPress LA-Studio Element Kit for Elementor plugin <= 1.1.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LA-Studio Element Kit for Elementor: from n/a through <= 1.1.5.

    LA-Studio LA-Studio Element Kit for Elementor
  • Medium 5.3
    CVE-2023-50887

    WordPress User Feedback plugin <= 1.0.10 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Feedback: from n/a through <= 1.0.10.

    Syed Balkhi User Feedback
  • Medium 5.4
    CVE-2023-50899

    WordPress Product Catalog Enquiry for WooCommerce by MultiVendorX plugin <= 5.0.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Catalog Enquiry for WooCommerce by MultiVendorX: fro…

    MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX Web / CMS
  • Medium 5.3
    CVE-2023-50904

    WordPress Poll Maker plugin <= 4.8.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Ays Pro Poll Maker poll-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Poll Maker: from n/a through <= 4.8.0.

    Ays Pro Poll Maker
  • Medium 5.3
    CVE-2023-50903

    WordPress Metform Elementor Contact Form Builder plugin <= 3.4.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Roxnor Metform metform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Metform: from n/a through <= 3.4.0.

    roxnor Metform
  • Medium 5.3
    CVE-2023-51353

    WordPress Popup by Supsystic plugin <= 1.10.19 - Broken Access Control vulnerability

    Missing Authorization vulnerability in supsystic Popup by Supsystic popup-by-supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup by Supsystic: from n/a through <= 1.10.19.

    supsystic Popup by Supsystic
  • Medium 5.3
    CVE-2023-51357

    WordPress Track Google Analytics 4, Facebook Pixel & Conversions API via Google Tag Manager for WooCommerce plugin <= 6.5.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Conversios Conversios.io enhanced-e-commerce-for-woocommerce-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Conversios.io: from n/a through <= 6.5.0.

    Conversios Conversios.io
  • Medium 6.5
    CVE-2023-51360

    WordPress Essential Blocks plugin <= 4.2.0 - Multiple Subscriber+ Broken Access Control vulnerability

    Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through <= 4.2.0.

    WPDeveloper Essential Blocks for Gutenberg
  • Medium 5.4
    CVE-2023-51359

    WordPress Essential Blocks plugin <= 4.2.0 - Multiple Contributor+ Broken Access Control vulnerability

    Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through <= 4.2.0.

    WPDeveloper Essential Blocks for Gutenberg
  • Medium 5.3
    CVE-2023-51362

    WordPress myStickyElements plugin <= 2.1.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Premio My Sticky Elements mystickyelements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Sticky Elements: from n/a through <= 2.1.3.

    Premio My Sticky Elements
  • Medium 5.3
    CVE-2023-49845

    WordPress Redirects plugin <= 1.2.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in mattdeclaire Redirects redirects allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Redirects: from n/a through <= 1.2.1.

    mattdeclaire Redirects
  • Medium 4.3
    CVE-2024-12307

    Function-Level Access Control Vulnerability Allows Unauthorized Modification of Student Data in Unifiedtransform

    A function-level access control vulnerability in Unifiedtransform version 2.0 and potentially earlier versions allows teachers to modify student personal data without proper authorization. The vulnerability exists due to missing access control checks in the s…

    Unifiedtransform Unifiedtransform
  • Medium 4.3
    CVE-2024-12306

    Access Control Vulnerabilities Allow Unauthorized Access to User Profiles in Unifiedtransform

    Multiple access control vulnerabilities in Unifiedtransform version 2.0 and potentially earlier versions allow unauthorized access to personal information of students and teachers. The vulnerabilities include both function-level access control issues in list …

    Unifiedtransform Unifiedtransform
  • Medium 4.3
    CVE-2024-12305

    Object-Level Access Control Vulnerability Allows Unauthorized Access to Student Grades in Unifiedtransform

    An object-level access control vulnerability in Unifiedtransform version 2.0 and potentially earlier versions allows unauthorized access to student grades. A malicious student user can view grades of other students by manipulating the student_id parameter in …

    Unifiedtransform Unifiedtransform
  • Medium 6.1
    CVE-2024-9651

    Contact Form Plugin by Fluent Forms < 5.2.1 - Admin+ Stored XSS

    The Fluent Forms WordPress plugin before 5.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for e…

    Web / CMS
  • Medium 6.3
    CVE-2024-12360

    code-projects Online Class and Exam Scheduling System class_update.php sql injection

    A vulnerability was found in code-projects Online Class and Exam Scheduling System 1.0. It has been rated as critical. This issue affects some unknown processing of the file class_update.php. The manipulation of the argument id leads to sql injection. The att…

    code-projects Online Class and Exam Scheduling System
  • Medium 6.3
    CVE-2024-12358

    WeiYe-Jing datax-web add os command injection

    A vulnerability was found in WeiYe-Jing datax-web 2.1.1. It has been classified as critical. This affects an unknown part of the file /api/job/add/. The manipulation of the argument glueSource leads to os command injection. It is possible to initiate the atta…

    WeiYe-Jing datax-web
  • Medium 4.3
    CVE-2024-12357

    SourceCodester Best House Rental Management System index.php file inclusion

    A vulnerability was found in SourceCodester Best House Rental Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument page leads to file inclusion. The …

    SourceCodester Best House Rental Management System
  • Medium 5.9
    CVE-2024-53285

    Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in DDNS Record funct…

    Synology Synology Router Manager (SRM)
  • Medium 5.9
    CVE-2024-53284

    Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in WiFi Connect Sett…

    Synology Synology Router Manager (SRM)
  • Medium 5.9
    CVE-2024-53283

    Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Router Port Forwa…

    Synology Synology Router Manager (SRM)
  • Medium 5.9
    CVE-2024-53282

    Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in WiFi Connect MAC …

    Synology Synology Router Manager (SRM)
  • Medium 5.9
    CVE-2024-53281

    Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Network WOL funct…

    Synology Synology Router Manager (SRM)
  • Medium 5.9
    CVE-2024-53279

    Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in file station func…

    Synology Synology Router Manager (SRM)
  • Medium 5.9
    CVE-2024-53280

    Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in network center po…

    Synology Synology Router Manager (SRM)
  • Medium 5.3
    CVE-2024-12354

    SourceCodester Phone Contact Manager System User Menu MenuDisplayStart buffer overflow

    A vulnerability, which was classified as critical, was found in SourceCodester Phone Contact Manager System 1.0. Affected is the function UserInterface::MenuDisplayStart of the component User Menu. The manipulation leads to buffer overflow. It is possible to …

    SourceCodester Phone Contact Manager System
  • Medium 4.3
    CVE-2024-12352

    TOTOLINK EX1800T cstecgi.cgi sub_40662C stack-based overflow

    A vulnerability classified as problematic was found in TOTOLINK EX1800T 9.1.0cu.2112_B20220316. This vulnerability affects the function sub_40662C of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ssid leads to stack-based buffer overflow. Th…

    Toto Link EX1800T
  • Medium 6.3
    CVE-2024-12351

    JFinalCMS File Content ContentModel.java findPage sql injection

    A vulnerability classified as critical has been found in JFinalCMS 1.0. This affects the function findPage of the file src\main\java\com\cms\entity\ContentModel.java of the component File Content Handler. The manipulation of the argument name leads to sql inj…

  • Medium 6.3
    CVE-2024-12350

    JFinalCMS Template TemplateController.java update command injection

    A vulnerability was found in JFinalCMS 1.0. It has been rated as critical. Affected by this issue is the function update of the file \src\main\java\com\cms\controller\admin\TemplateController.java of the component Template Handler. The manipulation of the arg…