Archive
January 2025
Vulnerabilities first published in this month (UTC), newest first.
146 results · Clear filters · Feed
-
Critical 9.8
A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APP_KEY to achieve remote co…
-
High 8.8CVE-2024-55555 Public exploit
Invoice Ninja before 5.10.43 allows remote code execution from a pre-authenticated route when an attacker knows the APP…
-
High 7.5CVE-2024-53522 Public exploit
Bangkok Medical Software HOSxP XE v4.64.11.3 was discovered to contain a hardcoded IDEA Key-IV pair in the HOSxPXE4.exe…
-
High 8.8CVE-2024-53345 Public exploit
An authenticated arbitrary file upload vulnerability in Car Rental Management System v1.0 to v1.3 allows attackers to e…
-
High 7.2CVE-2024-48245 Public exploit
Vehicle Management System 1.0 is vulnerable to SQL Injection. A guest user can exploit vulnerable POST parameters in va…
-
Medium 5.4CVE-2024-44450 Public exploit
Multiple functions are vulnerable to Authorization Bypass in AIMS eCrew. The issue was fixed in version JUN23 #190.
-
Critical 9.1
I, Librarian before and including 5.11.1 is vulnerable to Server-Side Request Forgery (SSRF) due to improper input vali…
-
High 7.0CVE-2024-46981 Public exploit
Redis' Lua library commands may lead to remote code execution
Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem is fixed in 7.4.2, 7.2.7, and 6.2.17…
-
Low 3.9CVE-2024-12970 Public exploit
OS Command Injection in TUBITAK BILGEM's Pardus OS My Computer
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TUBITAK BILGEM Pardus OS My Computer allows OS Command Injection. This issue affects Pardus OS My Computer: before 0.7.2.
-
High 8.8CVE-2024-20154 Public exploit
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code executi…
-
High 7.5CVE-2024-48457 Public exploit
An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi…
-
Low 2.7
An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi…
-
High 7.5
An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi…
-
Medium 5.4CVE-2024-46209 Public exploit
REDAXO CMS Cross-site Scripting vulnerability
A stored cross-site scripting (XSS) vulnerability in the component /media/test.html of REDAXO CMS v5.17.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the password parameter.
-
Critical 9.1CVE-2024-54879 Public exploit
SeaCMS V13.1 is vulnerable to Incorrect Access Control. A logic flaw can be exploited by an attacker to allow any user …
-
High 7.5
An access control issue in the component /juis_boxinfo.xml of AVM FRITZ!Box 7530 AX v7.59 allows attackers to obtain se…
-
Critical 9.1CVE-2024-54880 Public exploit
SeaCMS V13.1 is vulnerable to Incorrect Access Control. A logic flaw can be exploited by an attacker to allow any user …
-
High 8.4CVE-2021-27285 Public exploit
An issue was discovered in Inspur ClusterEngine v4.0 that allows attackers to gain escalated Local privileges and execu…
-
Critical 9.9CVE-2024-12583 Public exploit
Dynamics 365 Integration <= 1.3.23 - Authenticated (Contributor+) Remote Code Execution and Arbitrary File Read via Twig Server-Side Template Injection
The Dynamics 365 Integration plugin for WordPress is vulnerable to Remote Code Execution and Arbitrary File Read in all versions up to, and including, 1.3.23 via Twig Server-Side Template Injection. This is due to missing input validation and sanitization on …
-
High 8.5CVE-2024-9950 Public exploit
Abuse of Unauthenticated Compliance Recheck in SecureConnector
A vulnerability in Forescout SecureConnector v11.3.07.0109 on Windows allows unauthenticated user to modify compliance scripts due to insecure temporary directory.
-
Medium 6.6CVE-2024-56264 Public exploit
WordPress ACF City Selector plugin <= 1.14.0 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in Beee ACF City Selector acf-city-selector allows Upload a Web Shell to a Web Server.This issue affects ACF City Selector: from n/a through <= 1.14.0.
-
Critical 9.1CVE-2024-56249 Public exploit
WordPress WPMasterToolKit plugin <= 1.13.1 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in Ludwig You WPMasterToolKit wpmastertoolkit allows Upload a Web Shell to a Web Server.This issue affects WPMasterToolKit: from n/a through <= 1.13.1.
-
High 8.8CVE-2023-47179 Public exploit
WordPress WooODT Lite plugin <= 2.4.6 - Arbitrary Site Option Update vulnerability
Missing Authorization vulnerability in mdalabar WooODT Lite byconsole-woo-order-delivery-time allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooODT Lite: from n/a through <= 2.4.6.
-
Medium 5.4CVE-2023-45828 Public exploit
WordPress RumbleTalk Live Group Chat plugin <= 6.2.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in RumbleTalk RumbleTalk Live Group Chat rumbletalk-chat-a-chat-with-themes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RumbleTalk Live Group Chat: from n/a through <= 6.2.5.
-
High 7.2CVE-2024-12912 Public exploit
An improper input insertion vulnerability in AiCloud on certain router models may lead to arbitrary command execution. …
-
Medium 4.7CVE-2024-48197 Public exploit
Cross Site Scripting vulnerability in Audiocodes MP-202b v.4.4.3 allows a remote attacker to escalate privileges via th…