Skip to content
OpenAdvisories

Archive

2 January 2025

Vulnerabilities first published on this day (UTC), newest first.

← December 2024 2025 / January /2 February 2025 →
  1. 12
  2. 2239
  3. 353
  4. 439
  5. 528
  6. 6106
  7. 7350
  8. 8128
  9. 9267
  10. 1072
  11. 11105
  12. 1213
  13. 13115
  14. 14483
  15. 15204
  16. 16299
  17. 1795
  18. 1835
  19. 1963
  20. 2033
  21. 21283
  22. 22171
  23. 23113
  24. 24199
  25. 2550
  26. 2621
  27. 27243
  28. 28102
  29. 2973
  30. 30156
  31. 31153
All Critical High Medium Low Exploited only Public exploit

194 results · Clear filters · Feed

  • Medium 4.3
    CVE-2023-46080

    WordPress ApplyOnline – Application Form Builder and Manager plugin <= 2.5.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Farhan Noor ApplyOnline – Application Form Builder and Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ApplyOnline – Application Form Builder and Manager: from n/a throu…

    Farhan Noor ApplyOnline – Application Form Builder and Manager
  • Medium 5.4
    CVE-2023-46079

    WordPress Ashe Extra plugin <= 1.2.9 - Broken Access Control + CSRF vulnerability

    Missing Authorization vulnerability in WP Royal Ashe Extra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ashe Extra: from n/a through 1.2.9.

    WP Royal Ashe Extra
  • Medium 5.3
    CVE-2023-46073

    WordPress DX Delete Attached Media plugin <= 2.0.5.1 - Broken Access Control vulnerability + CSRF

    Missing Authorization vulnerability in Mario Peshev DX Delete Attached Media dx-delete-attached-media allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DX Delete Attached Media: from n/a through <= 2.0.5.1.

    Mario Peshev DX Delete Attached Media
  • Medium 5.4
    CVE-2023-45828 Public exploit

    WordPress RumbleTalk Live Group Chat plugin <= 6.2.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in RumbleTalk RumbleTalk Live Group Chat rumbletalk-chat-a-chat-with-themes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RumbleTalk Live Group Chat: from n/a through <= 6.2.5.

    RumbleTalk RumbleTalk Live Group Chat
  • Medium 5.3
    CVE-2023-45766

    WordPress Poll Maker plugin <= 4.7.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Ays Pro Poll Maker poll-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Poll Maker: from n/a through <= 4.7.1.

    Ays Pro Poll Maker
  • Medium 4.3
    CVE-2023-45765

    WordPress WP ERP plugin <= 1.12.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in weDevs WP ERP erp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP ERP: from n/a through <= 1.12.6.

    wedevs WP ERP
  • Medium 5.3
    CVE-2023-45649

    WordPress Appointment Hour Booking plugin <= 1.4.23 - Broken Access Control vulnerability

    Missing Authorization vulnerability in codepeople Appointment Hour Booking appointment-hour-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Appointment Hour Booking: from n/a through <= 1.4.23.

    codepeople Appointment Hour Booking
  • Medium 4.3
    CVE-2023-45760

    WordPress wpDiscuz plugin <= 7.6.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpDiscuz: from n/a through <= 7.6.3.

    advancedcoding wpDiscuz
  • Medium 5.4
    CVE-2023-45636

    WordPress Backup & Migration plugin <= 1.4.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WebToffee WordPress Backup & Migration wp-migration-duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Backup & Migration: from n/a through <= 1.4.1.

    WebToffee WordPress Backup & Migration Web / CMS
  • Medium 4.3
    CVE-2023-45631

    WordPress Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in wpdevart Responsive Image Gallery, Gallery Album allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Image Gallery, Gallery Album: from n/a through 2.0.3.

    wpdevart Responsive Image Gallery, Gallery Album
  • Medium 6.5
    CVE-2023-45275

    WordPress Contact Form builder with drag & drop plugin <= 2.3.28 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Chill Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kali Forms: from n/a through <= 2.3.28.

    WP Chill Kali Forms
  • Medium 4.3
    CVE-2023-45110

    WordPress Bold Timeline Lite plugin <= 1.1.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in boldthemes Bold Timeline Lite bold-timeline-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bold Timeline Lite: from n/a through <= 1.1.9.

    Bold Themes Bold Timeline Lite
  • Medium 4.3
    CVE-2023-45271

    WordPress ProductX – Gutenberg WooCommerce Blocks plugin <= 2.7.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPXPO WowStore product-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WowStore: from n/a through <= 2.7.8.

    wpxpo WowStore
  • Medium 4.3
    CVE-2023-45101

    WordPress Customer Reviews for WooCommerce plugin <= 5.36.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CusRev Customer Reviews for WooCommerce customer-reviews-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Customer Reviews for WooCommerce: from n/a through <= 5.36.0.

    CusRev Customer Reviews for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2023-45061

    WordPress WP Job Openings plugin <= 3.4.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in awsm.in WP Job Openings wp-job-openings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Openings: from n/a through <= 3.4.1.

    awsmin WP Job Openings
  • Medium 5.4
    CVE-2023-45045

    WordPress WP Custom Widget area plugin <= 1.2.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in krozero WP Custom Widget area wp-custom-widget-area allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Custom Widget area: from n/a through <= 1.2.5.

    krozero WP Custom Widget area
  • Medium 4.3
    CVE-2023-45002

    WordPress WP User Frontend plugin <= 3.6.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in weDevs WP User Frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through 3.6.8.

    wedevs WP User Frontend
  • Medium 4.3
    CVE-2023-44988

    WordPress WP Custom Admin Interface plugin <= 7.32 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Martin Gibson WP Custom Admin Interface allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Custom Admin Interface: from n/a through 7.32.

    Martin Gibson WP Custom Admin Interface
  • Medium 5.3
    CVE-2023-44258

    WordPress Schema App Structured Data plugin <= 1.23.1 - Broken Access Control + CSRF vulnerability

    Missing Authorization vulnerability in vberkel Schema App Structured Data schema-app-structured-data-for-schemaorg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Schema App Structured Data: from n/a through <= 1.23.…

    vberkel Schema App Structured Data
  • Medium 5.3
    CVE-2024-13106 EPSS 26%

    D-Link DIR-816 A2 IP QoS form2IPQoSTcAdd access control

    A vulnerability was found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210 and classified as critical. Affected by this issue is some unknown functionality of the file /goform/form2IPQoSTcAdd of the component IP QoS Handler. The manipulation leads to improper acce…

    D-Link DIR-816 A2 Network devices
  • Medium 5.3
    CVE-2024-13105

    D-Link DIR-816 A2 DHCPD Setting form2Dhcpd.cgi access control

    A vulnerability has been found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /goform/form2Dhcpd.cgi of the component DHCPD Setting Handler. The manipulation leads…

    D-Link DIR-816 A2 Network devices
  • Medium 5.3
    CVE-2024-13104

    D-Link DIR-816 A2 WiFi Settings form2AdvanceSetup.cgi access control

    A vulnerability, which was classified as critical, was found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210. Affected is an unknown function of the file /goform/form2AdvanceSetup.cgi of the component WiFi Settings Handler. The manipulation leads to improper acce…

    D-Link DIR-816 A2 Network devices
  • Medium 5.3
    CVE-2024-13103

    D-Link DIR-816 A2 Virtual Service form2AddVrtsrv.cgi access control

    A vulnerability, which was classified as critical, has been found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210. This issue affects some unknown processing of the file /goform/form2AddVrtsrv.cgi of the component Virtual Service Handler. The manipulation leads t…

    D-Link DIR-816 A2 Network devices
  • Medium 5.3
    CVE-2024-13102

    D-Link DIR-816 A2 DDNS Service access control

    A vulnerability classified as critical was found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210. This vulnerability affects unknown code of the file /goform/DDNS of the component DDNS Service. The manipulation leads to improper access controls. The attack can be…

    D-Link DIR-816 A2 Network devices
  • Medium 6.5
    CVE-2024-56019

    WordPress Inline Footnotes Plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gavinr Inline Footnotes inline-footnotes allows Stored XSS.This issue affects Inline Footnotes: from n/a through <= 2.3.0.

    gavinr Inline Footnotes
  • Medium 6.3
    CVE-2024-13093

    code-projects Job Recruitment Seeker Profile _call_main_search_ajax.php sql injection

    A vulnerability, which was classified as critical, has been found in code-projects Job Recruitment 1.0. This issue affects some unknown processing of the file /_parse/_call_main_search_ajax.php of the component Seeker Profile Handler. The manipulation of the …

    code-projects Job Recruitment
  • Medium 6.3
    CVE-2024-13092

    code-projects Job Recruitment Job Post search_ajax.php sql injection

    A vulnerability classified as critical was found in code-projects Job Recruitment 1.0. This vulnerability affects unknown code of the file /_parse/_call_job/search_ajax.php of the component Job Post Handler. The manipulation of the argument n leads to sql inj…

    code-projects Job Recruitment
  • Medium 4.7
    CVE-2024-12595

    AHAthat Plugin <= 1.6 - Reflected XSS via REQUEST_URI

    The AHAthat Plugin WordPress plugin through 1.6 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers

    Web / CMS
  • Medium 5.9
    CVE-2024-11357

    Goodlayers Core < 2.0.10 - Contributor+ Stored XSS

    The goodlayers-core WordPress plugin before 2.0.10 does not sanitise and escape some of its settings, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

    Web / CMS
  • Medium 4.8
    CVE-2024-11184

    WP Enabled SVG <= 0.7 - Author+ Stored XSS via SVG

    The wp-enable-svg WordPress plugin through 0.7 does not sanitize SVG files when uploaded, allowing for authors and above to upload SVGs containing malicious scripts

    mwdelaney/wp-enable-svg Web / CMS Packagist
  • Medium 4.7
    CVE-2024-48197 Public exploit

    Cross Site Scripting vulnerability in Audiocodes MP-202b v.4.4.3 allows a remote attacker to escalate privileges via th…

  • Medium 5.4
    CVE-2024-56830

    The Net::EasyTCP package 0.15 through 0.26 for Perl uses Perl's builtin rand() if no strong randomization module is pre…

    libnet-easytcp-perl libnet-easytcp-perl Debian Ubuntu
  • Medium 5.4
    CVE-2002-20002

    The Net::EasyTCP package before 0.15 for Perl always uses Perl's builtin rand(), which is not a strong random number ge…

  • Medium 4.3
    CVE-2025-22214 Scanner template

    Landray EIS 2001 through 2006 allows Message/fi_message_receiver.aspx?replyid= SQL injection.