Skip to content
OpenAdvisories

Archive

18 December 2024

Vulnerabilities first published on this day (UTC), newest first.

← November 2024 2024 / December /18 January 2025 →
  1. 112
  2. 2199
  3. 383
  4. 4138
  5. 5112
  6. 6170
  7. 732
  8. 87
  9. 9288
  10. 10339
  11. 11157
  12. 12150
  13. 13297
  14. 1449
  15. 159
  16. 16208
  17. 1785
  18. 18156
  19. 1994
  20. 2087
  21. 2130
  22. 2216
  23. 2333
  24. 2460
  25. 2528
  26. 2666
  27. 27284
  28. 2850
  29. 2969
  30. 3059
  31. 31105
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Critical 9.3
    CVE-2024-56145 Exploited Public exploit Scanner template EPSS 97%

    RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms

    Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has `register_argc_argv` enabled. For these users an unspecified…

    craftcms cms craftcms/cms Packagist
    KEV Jun 2, 2025
  • Critical 9.8
    CVE-2024-54383 Public exploit

    WordPress WooCommerce - PDF Vouchers plugin < 4.9.9 - Broken Authentication vulnerability

    Incorrect Privilege Assignment vulnerability in wpweb WooCommerce PDF Vouchers woocommerce-pdf-vouchers allows Privilege Escalation.This issue affects WooCommerce PDF Vouchers: from n/a through < 4.9.9.

    WPWeb WooCommerce PDF Vouchers Web / CMS
  • Critical 9.8
    CVE-2024-56058 Public exploit

    WordPress VRPConnector plugin <= 2.0.1 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in denniskravetstns VRPConnector vrpconnector allows Object Injection.This issue affects VRPConnector: from n/a through <= 2.0.1.

    denniskravetstns VRPConnector
  • Critical 9.8
    CVE-2024-56059 Public exploit

    WordPress Partners plugin <= 0.2.0 - PHP Object Injection vulnerability

    Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in farinspace Partners partners allows Object Injection.This issue affects Partners: from n/a through <= 0.2.0.

    farinspace Partners
  • Critical 9.8
    CVE-2024-21546 Public exploit

    UniSharp Laravel Filemanager Code Injection vulnerability

    Versions of the package unisharp/laravel-filemanager before 2.9.1 are vulnerable to Remote Code Execution (RCE) through using a valid mimetype and inserting the . character after the php file extension. This allows the attacker to execute malicious code.

    unisharp/laravel-filemanager Packagist
  • High 7.5
    CVE-2024-12025 Public exploit Scanner template

    Collapsing Categories <= 3.0.8 - Unauthenticated SQL Injection

    The Collapsing Categories plugin for WordPress is vulnerable to SQL Injection via the 'taxonomy' parameter of the /wp-json/collapsing-categories/v1/get REST API in all versions up to, and including, 3.0.8 due to insufficient escaping on the user supplied para…

    robfelty Collapsing Categories Web / CMS
  • High 8.8
    CVE-2024-56116 Public exploit

    A Cross-Site Request Forgery vulnerability in Amiro.CMS before 7.8.4 allows remote attackers to create an administrator…

  • Medium 6.1
    CVE-2024-56115 Public exploit

    A vulnerability in Amiro.CMS before 7.8.4 exists due to the failure to take measures to neutralize special elements. It…