Skip to content
OpenAdvisories

Archive

13 December 2024

Vulnerabilities first published on this day (UTC), newest first.

← November 2024 2024 / December /13 January 2025 →
  1. 112
  2. 2199
  3. 383
  4. 4138
  5. 5112
  6. 6170
  7. 732
  8. 87
  9. 9288
  10. 10339
  11. 11157
  12. 12150
  13. 13297
  14. 1449
  15. 159
  16. 16208
  17. 1785
  18. 18156
  19. 1994
  20. 2087
  21. 2130
  22. 2216
  23. 2333
  24. 2460
  25. 2528
  26. 2666
  27. 27284
  28. 2850
  29. 2969
  30. 3059
  31. 31105
All Critical High Medium Low Exploited only Public exploit

19 results · Clear filters · Feed

  • Critical 9.8
    CVE-2024-54296

    WordPress CoSchool LMS plugin <= 1.4.3 - Account Takeover vulnerability

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Codexpert, Inc CoSchool LMS coschool allows Authentication Bypass.This issue affects CoSchool LMS: from n/a through <= 1.4.3.

    Codexpert CoSchool LMS
  • Critical 9.8
    CVE-2024-54297

    WordPress vBSSO-lite plugin <= 1.4.3 - Account Takeover vulnerability

    Authentication Bypass Using an Alternate Path or Channel vulnerability in extremeidea vBSSO-lite vbsso-lite allows Authentication Bypass.This issue affects vBSSO-lite: from n/a through <= 1.4.3.

    extremeidea vBSSO-lite
  • Critical 9.8
    CVE-2024-54295

    WordPress ListApp Mobile Manager plugin <= 1.7.7 - Account Takeover vulnerability

    Authentication Bypass Using an Alternate Path or Channel vulnerability in FluxBuilder ListApp Mobile Manager listapp-mobile-manager allows Authentication Bypass.This issue affects ListApp Mobile Manager: from n/a through <= 1.7.7.

    FluxBuilder ListApp Mobile Manager
  • Critical 9.8
    CVE-2024-54294

    WordPress Firebase OTP Authentication plugin <= 1.0.1 - Account Takeover vulnerability

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Appgenix Infotech Firebase OTP Authentication authentication-via-otp-using-firebase allows Authentication Bypass.This issue affects Firebase OTP Authentication: from n/a through <= 1.0.…

    Appgenix Infotech Firebase OTP Authentication
  • Critical 9.8
    CVE-2024-54293

    WordPress CE21 Suite plugin <= 2.2.0 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in CE21 CE21 Suite ce21-suite allows Privilege Escalation.This issue affects CE21 Suite: from n/a through <= 2.2.0.

    CE21 CE21 Suite
  • Critical 9.3
    CVE-2024-54292 Public exploit

    WordPress Appsplate plugin <= 2.1.3 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in appsplate Appsplate appsplate allows SQL Injection.This issue affects Appsplate: from n/a through <= 2.1.3.

    appsplate Appsplate
  • Critical 9.8
    CVE-2024-54273

    WordPress Mail Picker plugin <= 1.0.14 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in PickPlugins Mail Picker mail-picker allows Object Injection.This issue affects Mail Picker: from n/a through <= 1.0.14.

    PickPlugins Mail Picker
  • Critical 9.9
    CVE-2024-54262 Public exploit

    WordPress Import Export For WooCommerce plugin <= 1.6.2 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in sidngr Import Export For WooCommerce import-export-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects Import Export For WooCommerce: from n/a through <= 1.6.2.

    sidngr Import Export For WooCommerce Web / CMS
  • Critical 10.0
    CVE-2024-54261

    WordPress TAX SERVICE Electronic HDM plugin <= 1.2.2 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in HK Digital Agency LLC TAX SERVICE Electronic HDM virtual-hdm-for-taxservice-am allows SQL Injection.This issue affects TAX SERVICE Electronic HDM: from n/a t…

    HK Digital Agency TAX SERVICE Electronic HDM
  • Critical 9.8
    CVE-2024-54239 Public exploit

    WordPress Eyewear prescription form plugin <= 4.0.18 - Arbitrary Option Update to Privilege Escalation vulnerability

    Missing Authorization vulnerability in dugudlabs Eyewear prescription form eyewear-prescription-form allows Privilege Escalation.This issue affects Eyewear prescription form: from n/a through <= 4.0.18.

    dugudlabs Eyewear prescription form
  • Critical 9.3
    CVE-2024-54234

    WordPress Limit Login Attempts plugin <= 5.5 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wp-buy Limit Login Attempts wp-limit-failed-login-attempts allows SQL Injection.This issue affects Limit Login Attempts: from n/a through <= 5.5.

    wp-buy Limit Login Attempts
  • Critical 9.1
    CVE-2022-46838

    WordPress JS Help Desk plugin <= 2.7.1 - Unauthenticated Settings Change Vulnerability

    Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.…

    JS Help Desk JS Help Desk – Best Help Desk & Support Plugin
  • Critical 9.6
    CVE-2024-11986

    Stored XSS in CrushFTP

    Improper input handling in the 'Host Header' allows an unauthenticated attacker to store a payload in web application logs. When an Administrator views the logs using the application's standard functionality, it enables the execution of the payload, resulting…

    CrushFTP CrushFTP
  • Critical 10.0
    CVE-2024-21577

    ComfyUI-Ace-Nodes is vulnerable to Code Injection. The ACE_ExpressionEval node contains an eval() in its entrypoint fun…

    hay86 ComfyUI-Ace-Nodes
  • Critical 10.0
    CVE-2024-21576

    ComfyUI-Bmad-Nodes is vulnerable to Code Injection. The issue stems from a validation bypass in the BuildColorRangeHSVA…

    bmad4ever ComfyUI-Bmad-Nodes
  • Critical 9.1
    CVE-2024-52057

    Potential arbitrary SQL query execution in Queuing Service while parsing malicious remote commands or configuration files

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RTI Connext Professional (Queuing Service) allows SQL Injection.This issue affects Connext Professional: from 7.0.0 before 7.3.0, from 6.1.0 before 6.1.2.17,…

    RTI Connext Professional
  • Critical 9.8
    CVE-2024-9290 Public exploit

    Super Backup & Clone - Migrate for WordPress <= 2.3.3 - Unauthenticated Arbitrary File Upload

    The Super Backup & Clone - Migrate for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and a missing capability check on the ibk_restore_migrate_check() function in all versions up to, and including, …

    azzaroco Super Backup & Clone - Migrate for WordPress Web / CMS
  • Critical 9.8
    CVE-2024-12603 Public exploit

    A logic vulnerability in the the mobile application (com.transsion.applock) can lead to bypassing the application passw…

    TECNO com.transsion.applock
  • Critical 9.8
    CVE-2024-55956 Exploited · Ransomware Public exploit Scanner template EPSS 94%

    In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can imp…

    KEV Dec 17, 2024