Archive

13 December 2024

Vulnerabilities first published on this day (UTC), newest first.

← November 2024 2024 / December /13 January 2025 →

All Critical High Medium Low Exploited only Public exploit

82 results · Clear filters · Feed

High 7.1

CVE-2024-54266

WordPress ImageRecycle pdf & image compression plugin <= 3.1.16 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ImageRecycle ImageRecycle pdf & image compression imagerecycle-pdf-image-compression allows Reflected XSS.This issue affects ImageRecycle pdf & image compres…

ImageRecycle ImageRecycle pdf & image compression

Dec 13, 2024
High 7.1

CVE-2024-54265

WordPress Barcode Scanner and Inventory manager plugin <= 1.6.6 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders allows Refl…

Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager

Dec 13, 2024
High 7.1

CVE-2024-54264

WordPress Shortcodes Blocks Creator Ultimate plugin <= 2.2.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cmorillas1 Shortcodes Blocks Creator Ultimate ultimate-shortcodes-creator allows Reflected XSS.This issue affects Shortcodes Blocks Creator Ultimate: from n/…

cmorillas1 Shortcodes Blocks Creator Ultimate

Dec 13, 2024
High 7.1

CVE-2024-54256

WordPress Easy Blocks pro plugin <= 1.0.21 - Broken Access Control vulnerability

Missing Authorization vulnerability in Seerox Easy Blocks pro easy-blocks-pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Easy Blocks pro: from n/a through <= 1.0.21.

Seerox Easy Blocks pro

Dec 13, 2024
High 8.5

CVE-2024-54258

WordPress Ni CRM Lead plugin <= 1.3.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Anzar Ahmed Ni CRM Lead ni-crm-lead allows SQL Injection.This issue affects Ni CRM Lead: from n/a through <= 1.3.0.

Anzar Ahmed Ni CRM Lead

Dec 13, 2024
High 8.8

CVE-2024-54248

WordPress Eewee Admin Custom plugin <= 1.8.2.4 - CSRF to Privilege Escalation vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in eewee eewee admin custom eewee-admincustom allows Privilege Escalation.This issue affects eewee admin custom: from n/a through <= 1.8.2.4.

eewee eewee admin custom

Dec 13, 2024
High 7.1

CVE-2024-54240

WordPress Blaze Online eParcel for WooCommerce plugin <= 1.3.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in blazeonline Blaze Online eParcel for WooCommerce blaze-online-eparcel-for-woocommerce allows Reflected XSS.This issue affects Blaze Online eParcel for WooCom…

blazeonline Blaze Online eParcel for WooCommerce Web / CMS

Dec 13, 2024
High 7.1

CVE-2024-54238

WordPress Board Document Manager from CHUHPL plugin <= 1.9.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cleveland Heights-University Heights Public Library Webdeveloper Board Document Manager from CHUHPL board-document-manager-from-chuhpl allows Reflected XSS.T…

Cleveland Heights-University Heights Public Library Webdeveloper Board Document Manager from CHUHPL

Dec 13, 2024
High 7.1

CVE-2024-54237

WordPress Ni CRM Lead plugin <= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anzar Ahmed Ni CRM Lead ni-crm-lead allows Reflected XSS.This issue affects Ni CRM Lead: from n/a through <= 1.3.0.

Anzar Ahmed Ni CRM Lead

Dec 13, 2024
High 7.1

CVE-2024-54236

WordPress Ni WooCommerce Bulk Product Editor plugin <= 1.4.5 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anzar Ahmed Ni WooCommerce Bulk Product Editor ni-woocommerce-product-editor allows Reflected XSS.This issue affects Ni WooCommerce Bulk Product Editor: from…

Anzar Ahmed Ni WooCommerce Bulk Product Editor Web / CMS

Dec 13, 2024
High 7.1

CVE-2024-54235

WordPress Shiptimize for WooCommerce plugin <= 3.1.86 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shiptimize Shiptimize for WooCommerce shiptimize-for-woocommerce allows Reflected XSS.This issue affects Shiptimize for WooCommerce: from n/a through <= 3.1.…

Shiptimize Shiptimize for WooCommerce Web / CMS

Dec 13, 2024
High 7.1

CVE-2024-54233

WordPress Advanced Control Manager plugin <= 2.16.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in overclokk Advanced Control Manager for WordPress by ItalyStrap advanced-control-manager allows Reflected XSS.This issue affects Advanced Control Manager for …

overclokk Advanced Control Manager for WordPress by ItalyStrap Web / CMS

Dec 13, 2024
High 7.1

CVE-2024-54231

WordPress Ni WooCommerce Order Export plugin <= 3.1.6 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anzar Ahmed Ni WooCommerce Order Export ni-woocommerce-order-export allows Reflected XSS.This issue affects Ni WooCommerce Order Export: from n/a through <= …

Anzar Ahmed Ni WooCommerce Order Export Web / CMS

Dec 13, 2024
High 8.1

CVE-2023-41130

WordPress Premmerce User Roles plugin <= 1.0.12 - Broken Access Control vulnerability

Missing Authorization vulnerability in Premmerce Premmerce User Roles premmerce-user-roles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premmerce User Roles: from n/a through <= 1.0.12.

Premmerce Premmerce User Roles

Dec 13, 2024
High 7.5

CVE-2023-39920

WordPress Redirection for Contact Form 7 plugin <= 2.9.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Themeisle Redirection for Contact Form 7 wpcf7-redirect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Redirection for Contact Form 7: from n/a through <= 2.9.2.

themeisle Redirection for Contact Form 7

Dec 13, 2024
High 8.3

CVE-2023-38385

WordPress Jupiter X Core plugin <= 3.3.0 - Multiple Auth. Broken Access Control vulnerability

Missing Authorization vulnerability in Artbees JupiterX Core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JupiterX Core: from 3.0.0 through 3.3.0.

artbees JupiterX Core

Dec 13, 2024
High 7.3

CVE-2023-36510

WordPress ReDi Restaurant Reservation plugin <= 23.0211 - Broken Access Control vulnerability

Missing Authorization vulnerability in Reservation Diary ReDi Restaurant Reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ReDi Restaurant Reservation: from n/a through 23.0211.

Reservation Diary ReDi Restaurant Reservation

Dec 13, 2024
High 7.6

CVE-2023-35037

WordPress Surfer plugin <= 1.3.2.357 - Broken Access Control vulnerability

Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through <= 1.3.2.357.

Surfer Surfer

Dec 13, 2024
High 8.8

CVE-2023-33996

WordPress Spam protection, AntiSpam, FireWall by CleanTalk plugin <= 6.10 - Broken Access Control vulnerability

Missing Authorization vulnerability in СleanTalk - Anti-Spam Protection Spam protection, AntiSpam, FireWall by CleanTalk allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spam protection, AntiSpam, FireWall by CleanTal…

СleanTalk - Anti-Spam Protection Spam protection, AntiSpam, FireWall by CleanTalk

Dec 13, 2024
High 7.5

CVE-2023-32585

WordPress Portfolio Gallery – Responsive Image Gallery plugin <= 1.4.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in Total-Soft Portfolio Gallery – Responsive Image Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Portfolio Gallery – Responsive Image Gallery: from n/a through 1.4.6.

Total-Soft Portfolio Gallery – Responsive Image Gallery

Dec 13, 2024
High 7.5

CVE-2023-32520

WordPress WCP Contact Form plugin <= 3.1.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Webcodin WCP Contact Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCP Contact Form: from n/a through 3.1.0.

WebCodin WCP Contact Form

Dec 13, 2024
High 7.3

CVE-2023-32507

WordPress Woo Custom Emails plugin <= 2.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in wp3sixty Woo Custom Emails allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woo Custom Emails: from n/a through 2.2.

wp3sixty Woo Custom Emails

Dec 13, 2024
High 7.5

CVE-2023-30490

WordPress Easing Slider plugin <= 3.0.8 - Plugin Settings Reset Vulnerability

Missing Authorization vulnerability in Matthew Ruddy Easing Slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easing Slider : from n/a through 3.0.8.

Matthew Ruddy Easing Slider

Dec 13, 2024
High 7.5

CVE-2023-25988

WordPress Video Gallery – YouTube Gallery plugin <= 1.7.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in Video Gallery by Total-Soft Video Gallery – YouTube Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Video Gallery – YouTube Gallery: from n/a through 1.7.6.

Video Gallery by Total-Soft Video Gallery – YouTube Gallery

Dec 13, 2024
High 8.8

CVE-2024-22461

Dell RecoverPoint for Virtual Machines 6.0.x contains an OS Command injection vulnerability. A low privileged remote at…

Dell RecoverPoint for Virtual Machines

Dec 13, 2024
High 8.3

CVE-2024-52066

Potential stack corruption in Routing Service when using a malicious XML configuration document

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Routing Service) allows Overflow Variables and Tags.This issue affects Connext Professional: from 7.4.0 before 7.5.0, from 7.0.0 before 7.3.0.5, …

RTI Connext Professional

Dec 13, 2024
High 8.3

CVE-2024-52063

Potential stack buffer write overflow in Connext applications while parsing malicious XML types document

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core Libraries, Routing Service) allows Overflow Variables and Tags.This issue affects Connext Professional: from 7.0.0 before 7.3.0.5, from 6.1.…

RTI Connext Professional

Dec 13, 2024
High 8.3

CVE-2024-52061

Potential stack buffer overflow when parsing an XML type

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core Libraries, Queuing Service, Recording Service, Routing Service) allows Overflow Variables and Tags.This issue affects Connext Professional: …

RTI Connext Professional

Dec 13, 2024
High 8.3

CVE-2024-52060

Potential stack overflow when using XML configuration file referencing environment variables

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Routing Service, Recording Service, Queuing Service, Observability Collector Service, Cloud Discovery Service) allows Buffer Overflow via Environ…

RTI Connext Professional

Dec 13, 2024
High 8.6

CVE-2024-52058

Potential arbitrary command execution in System Designer while parsing malicious HTTP/REST requests

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in RTI Connext Professional (System Designer) allows OS Command Injection.This issue affects Connext Professional: from 7.0.0 before 7.3.0.2, from 6.1.0 b…

RTI Connext Professional

Dec 13, 2024
High 8.1

CVE-2024-10783 Scanner template

MainWP Child <= 5.3.3 - Missing Authorization to Unauthenticated Privilege Escalation

The MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites plugin for WordPress is vulnerable to privilege escalation due to a missing authorization checks on the register_site function in all versions up to, and including, 5.2 when…

mainwp MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites Web / CMS

Dec 13, 2024
High 8.6

CVE-2024-11839

Insecure Deserialization via Runbooks Imports

Deserialization of Untrusted Data vulnerability in PlexTrac (Runbooks modules) which allows Object Injection and arbitrary file writes.This issue affects PlexTrac: from 1.61.3 before 2.8.1.

PlexTrac PlexTrac

Dec 13, 2024
High 8.6

CVE-2024-11838

Local File Inclusion

External Control of File Name or Path vulnerability in PlexTrac allows Local Code Inclusion through use of an undocumented API endpoint.This issue affects PlexTrac: from 1.61.3 before 2.8.1.

PlexTrac PlexTrac

Dec 13, 2024
High 8.6

CVE-2024-11837

N1QL Injection

Improper Neutralization of Special Elements used in an N1QL Command ('N1QL Injection') vulnerability in PlexTrac allows N1QL Injection.This issue affects PlexTrac: from 1.61.3 before 2.8.1.

PlexTrac PlexTrac

Dec 13, 2024
High 8.6

CVE-2024-11836

Server-side Request Forgery

Server-Side Request Forgery (SSRF) vulnerability in PlexTrac allowing requests to internal system resources.This issue affects PlexTrac: from 1.61.3 before 2.8.1.

PlexTrac PlexTrac

Dec 13, 2024
High 7.0

CVE-2024-11835

Denial of Service

Uncontrolled Resource Consumption vulnerability in PlexTrac allows WebSocket DoS.This issue affects PlexTrac: from 1.61.3 before 2.8.1.

PlexTrac PlexTrac

Dec 13, 2024
High 8.9

CVE-2024-11834

Arbitrary File Write via PTRAC Import

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PlexTrac allows arbitrary file writes.This issue affects PlexTrac: from 1.61.3 before 2.8.1.

PlexTrac PlexTrac

Dec 13, 2024
High 8.9

CVE-2024-11833

Arbitrary Directory Write via Runbooks Artifact Upload

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PlexTrac allows arbitrary file writes.This issue affects PlexTrac: from 1.61.3 before 2.8.1.

PlexTrac PlexTrac

Dec 13, 2024
High 7.1

CVE-2024-21543

djoser Authentication Bypass

Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. This is because the system falls back to querying the database directly, granting access to users with valid credentials, and eventuall…

djoser djoser djoser Debian Ubuntu PyPI

Dec 13, 2024
High 8.6

CVE-2024-21544

Browsershot Local File Inclusion

Versions of the package spatie/browsershot before 5.0.1 are vulnerable to Improper Input Validation due to improper URL validation in the setUrl method. An attacker can exploit this vulnerability by using leading whitespace (%20) before the file:// protocol, …

spatie/browsershot Packagist

Dec 13, 2024