Skip to content
OpenAdvisories

Archive

16 December 2024

Vulnerabilities first published on this day (UTC), newest first.

← November 2024 2024 / December /16 January 2025 →
  1. 112
  2. 2199
  3. 383
  4. 4138
  5. 5112
  6. 6170
  7. 732
  8. 87
  9. 9288
  10. 10339
  11. 11157
  12. 12150
  13. 13297
  14. 1449
  15. 159
  16. 16208
  17. 1785
  18. 18156
  19. 1994
  20. 2087
  21. 2130
  22. 2216
  23. 2333
  24. 2460
  25. 2528
  26. 2666
  27. 27284
  28. 2850
  29. 2969
  30. 3059
  31. 31105
All Critical High Medium Low Exploited only Public exploit

17 results · Clear filters · Feed

  • Critical 9.8
    CVE-2024-54363 Public exploit

    WordPress Wp NssUser Register plugin <= 1.0.0 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in saiful.total Wp NssUser Register wp-nssuser-register allows Privilege Escalation.This issue affects Wp NssUser Register: from n/a through <= 1.0.0.

    saiful.total Wp NssUser Register
  • Critical 9.1
    CVE-2024-54369 Public exploit

    WordPress Zita Site Builder plugin <= 1.0.2 - Arbitrary Plugin Installation and Activation vulnerability

    Missing Authorization vulnerability in ThemeHunk Zita Site Builder ai-site-builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Zita Site Builder: from n/a through <= 1.0.2.

    ThemeHunk Zita Site Builder
  • High 7.5
    CVE-2024-54374 Public exploit

    WordPress Sogrid plugin <= 1.5.6 - Local File Inclusion vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Sabri Sogrid sogrid allows PHP Local File Inclusion.This issue affects Sogrid: from n/a through <= 1.5.6.

    Sabri Sogrid
  • High 8.8
    CVE-2024-54378 Public exploit

    WordPress Quietly Insights plugin <= 1.2.2 - Arbitrary Option Update to Privilege Escalation vulnerability

    Missing Authorization vulnerability in Quietly Quietly Insights quietly-insights allows Privilege Escalation.This issue affects Quietly Insights: from n/a through <= 1.2.2.

    Quietly Quietly Insights
  • High 8.8
    CVE-2024-54379 Public exploit

    WordPress Minterpress plugin <= 1.0.5 - Arbitrary Option Update to Privilege Escalation vulnerability

    Missing Authorization vulnerability in blokhauswp Minterpress minterpress allows Privilege Escalation.This issue affects Minterpress: from n/a through <= 1.0.5.

    blokhauswp Minterpress
  • High 7.2
    CVE-2024-54385 Public exploit Scanner template

    WordPress Radio Player plugin <= 2.0.83 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in princeahmed Radio Player radio-player allows Server Side Request Forgery.This issue affects Radio Player: from n/a through <= 2.0.83.

    princeahmed Radio Player
  • Critical 9.3
    CVE-2024-55972 Public exploit

    WordPress eTemplates plugin <= 0.2.1 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in chriscarvache eTemplates etemplates allows SQL Injection.This issue affects eTemplates: from n/a through <= 0.2.1.

    chriscarvache eTemplates
  • Critical 9.3
    CVE-2024-55976 Public exploit

    WordPress Critical Site Intel plugin <= 1.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mikeleembruggen Critical Site Intel critical-site-intel-stats allows SQL Injection.This issue affects Critical Site Intel: from n/a through <= 1.0.

    mikeleembruggen Critical Site Intel
  • Critical 9.3
    CVE-2024-55978 Public exploit

    WordPress Code Generator Pro plugin <= 1.2 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WalletStation Code Generator Pro code-generator-pro allows SQL Injection.This issue affects Code Generator Pro: from n/a through <= 1.2.

    WalletStation Code Generator Pro
  • Critical 9.3
    CVE-2024-55980 Public exploit

    WordPress Wr Age Verification plugin <= 2.0.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in robindkumar Wr Age Verification wr-age-verification allows SQL Injection.This issue affects Wr Age Verification: from n/a through <= 2.0.0.

    robindkumar Wr Age Verification
  • Critical 9.3
    CVE-2024-55981 Public exploit

    WordPress Nabz Image Gallery plugin <= v1.00 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nabajit Roy Nabz Image Gallery nabz-image-gallery allows SQL Injection.This issue affects Nabz Image Gallery: from n/a through <= v1.00.

    Nabajit Roy Nabz Image Gallery
  • Critical 9.3
    CVE-2024-55982 Public exploit

    WordPress Share Buttons – Social Media plugin <= 1.0.2 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in richteam Share Buttons – Social Media rich-web-share-button allows Blind SQL Injection.This issue affects Share Buttons – Social Media: from n/a through <= 1…

    richteam Share Buttons – Social Media
  • Critical 9.3
    CVE-2024-55988 Public exploit

    WordPress Navayan CSV Export Plugin <= 1.0.9 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Amol Nirmala Waman Navayan CSV Export navayan-csv-export allows Blind SQL Injection.This issue affects Navayan CSV Export: from n/a through <= 1.0.9.

    Amol Nirmala Waman Navayan CSV Export
  • Critical 9.6
    CVE-2024-12641 Public exploit

    Chunghwa Telecom TenderDocTransfer - Reflected Cross-site Scripting to RCE

    TenderDocTransfer from Chunghwa Telecom has a Reflected Cross-site scripting vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection for the APIs, unauthe…

    Chunghwa Telecom TenderDocTransfer
  • Critical 9.8
    CVE-2024-55557 Public exploit

    ui/pref/ProxyPrefView.java in weasis-core in Weasis 4.5.1 has a hardcoded key for symmetric encryption of proxy credent…

  • High 8.8
    CVE-2024-53376 Public exploit EPSS 11%

    CyberPanel before 2.3.8 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the…

  • Critical 9.8
    CVE-2024-29671 Public exploit EPSS 25%

    Buffer Overflow vulnerability in NEXTU FLATA AX1500 Router v.1.0.2 allows a remote attacker to execute arbitrary code v…