Skip to content
OpenAdvisories

Archive

21 December 2024

Vulnerabilities first published on this day (UTC), newest first.

← November 2024 2024 / December /21 January 2025 →
  1. 112
  2. 2199
  3. 383
  4. 4138
  5. 5112
  6. 6170
  7. 732
  8. 87
  9. 9288
  10. 10339
  11. 11157
  12. 12150
  13. 13297
  14. 1449
  15. 159
  16. 16208
  17. 1785
  18. 18156
  19. 1994
  20. 2087
  21. 2130
  22. 2216
  23. 2333
  24. 2460
  25. 2528
  26. 2666
  27. 27284
  28. 2850
  29. 2969
  30. 3059
  31. 31105
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 7.3
    CVE-2024-12884

    Codezips E-Commerce Website login.php sql injection

    A vulnerability was found in Codezips E-Commerce Website 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument email leads to sql injection. The attack may be launched…

    CodeZips E-Commerce Website
  • High 7.2
    CVE-2024-12721

    Custom Product Tabs For WooCommerce <= 1.2.4 - Authenticated (Shop Manager+) PHP Object Injection

    The Custom Product Tabs For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.4 via deserialization of untrusted input from the 'wb_custom_tabs' parameter. This makes it possible for authenticated…

    Web Builder 143 Custom Product tabs for WooCommerce Web / CMS
  • High 8.8
    CVE-2024-12771

    eCommerce Product Catalog Plugin for WordPress <= 3.3.43 - Cross-Site Request Forgery to Password Reset

    The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.43. This is due to missing or incorrect nonce validation on the 'customer_panel_password_reset' funct…

    impleCode eCommerce Product Catalog Plugin for WordPress Web / CMS
  • High 8.8
    CVE-2024-12066

    SMSA Shipping(official) <= 2.3 - Authenticated (Subscriber+) Arbitrary File Deletion

    The SMSA Shipping(official) plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the smsa_delete_label() function in all versions up to, and including, 2.3. This makes it possible for authenticated attacker…

    SMSA Express SMSA Shipping (official) Web / CMS
  • High 7.3
    CVE-2024-11977

    kk Star Ratings – Rate Post & Collect User Feedbacks <= 5.4.10 - Unauthenticated Arbitrary Shortcode Execution

    The The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.4.10. This is due to the software allowing users to execute an action that does not proper…

    Proper Fraction kk Star Ratings – Rate Post & Collect User Feedbacks Web / CMS