Critical vulnerability archive — page 393

Palo Alto Networks1 vulnerability on this pageMax CVSS 9.8Priority 99KEV 1

CVE-2024-0012 · Palo Alto Networks Cloud NGFW

PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)

KEV · due 9 Dec ransomware use EPSS 100%public exploit SSVC act CVSS 9.8

cobbler1 vulnerability on this pageMax CVSS 9.8Priority 58KEV 0

CVE-2024-47533 · cobbler cobbler

Cobbler allows anyone to connect to cobbler XML-RPC server with a known password and make changes

EPSS 4%public exploit CVSS 9.8

jpress1 vulnerability on this pageMax CVSS 9.8Priority 53KEV 0

CVE-2024-50919 · jpress jpress

Jpress until v5.1.1 has arbitrary file uploads on the windows platform, and the construction of non-standard file formats such as .jsp.

EPSS 1%public exploit CVSS 9.8

gnome_maps1 vulnerability on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2023-43091 · gnome_maps gnome_maps

Gnome-maps: gnome maps is vulnerable to a code injection attack (similar to xss) via its service.json

EPSS 1.0%public exploit CVSS 9.8

xian_daxi_information_technology1 vulnerability on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2024-48694 · xian_daxi_information_technology officeweb_365

File Upload vulnerability in Xi'an Daxi Information technology OfficeWeb365 v.8.6.1.0 and v7.18.23.0 allows a remote attacker to execute…

EPSS 1%public exploit CVSS 9.8

1000 Projects3 vulnerabilities on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2024-11258 · 1000 Projects Beauty Parlour Management System

1000 Projects Beauty Parlour Management System index.php sql injection

EPSS 0.8%public exploit CVSS 9.8

CVE-2024-11256 · 1000 Projects Portfolio Management System MCA

1000 Projects Portfolio Management System MCA login.php sql injection

EPSS 0.7%public exploit CVSS 9.8

CVE-2024-11257 · 1000 Projects Beauty Parlour Management System

1000 Projects Beauty Parlour Management System forgot-password.php sql injection

EPSS 0.7%public exploit CVSS 9.8

avscms2 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2024-51053 · avscms avscms

An arbitrary file upload vulnerability in the component /main/fileupload.php of AVSCMS v8.2.0 allows attackers to execute arbitrary code…

EPSS 0.7%public exploit CVSS 9.8

CVE-2024-51051 · avscms avscms

AVSCMS v8.2.0 was discovered to contain weak default credentials for the Administrator account.

EPSS 0.5%public exploit CVSS 9.8

revmakx1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-8856 · revmakx Backup and Staging by WP Time Capsule

Backup and Staging by WP Time Capsule <= 1.22.21 - Unauthenticated Arbitrary File Upload

EPSS 94%CVSS 9.8

Apache Software Foundation2 vulnerabilities on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2024-52316 · Apache Software Foundation Apache Tomcat

Apache Tomcat: Authentication bypass when using Jakarta Authentication API

EPSS 6%CVSS 9.8

CVE-2024-47208 · Apache Software Foundation Apache OFBiz

Apache OFBiz: URLs allowing remote use of Groovy expressions, leading to RCE

EPSS 2%CVSS 9.8

Mindstien Technologies1 vulnerability on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2024-52433 · Mindstien Technologies My Geo Posts Free

WordPress My Geo Posts Free plugin <= 1.2 - PHP Object Injection vulnerability

EPSS 3%CVSS 9.8

TRCore5 vulnerabilities on this pageMax CVSS 9.8Priority 44KEV 0

AntonHoelstad1 vulnerability on this pageMax CVSS 9.9Priority 42KEV 0

CVE-2024-52429 · AntonHoelstad WP Quick Setup

WordPress WP Quick Setup plugin <= 2.0 - Arbitrary Plugin and Theme Installation to Remote Code Execution vulnerability

EPSS 0.9%CVSS 9.9

bublick1 vulnerability on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2024-52430 · bublick Lis Video Gallery

WordPress Lis Video Gallery plugin <= 0.2.1 - PHP Object Injection vulnerability

EPSS 1%CVSS 9.8

supsystic1 vulnerability on this pageMax CVSS 9.1Priority 41KEV 0

CVE-2024-52434 · supsystic Popup by Supsystic

WordPress Popup by Supsystic plugin <= 1.10.29 - Remote Code Execution (RCE) vulnerability

EPSS 1%CVSS 9.1

Vollstart1 vulnerability on this pageMax CVSS 9.9Priority 41KEV 0

CVE-2024-52427 · Vollstart Event Tickets with Ticket Scanner

WordPress Event Tickets with Ticket Scanner plugin <= 2.3.11 - Remote Code Execution (RCE) vulnerability

EPSS 0.7%CVSS 9.9

dmcwebzone1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-52413 · dmcwebzone Airin Blog

WordPress Airin Blog theme <= 1.6.1 - PHP Object Injection vulnerability

EPSS 0.7%CVSS 9.8

weaver3 vulnerabilities on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-48070 · weaver e-cology

An issue in Weaver E-cology v.

EPSS 0.7%CVSS 9.8

CVE-2024-48069 · weaver e-cology

A vulnerability was found in Weaver E-cology allows attackers use race conditions to bypass security mechanisms to upload malicious files…

EPSS 0.4%CVSS 9.8

CVE-2024-48072 · weaver e-cology

Weaver Ecology v9.* was discovered to contain a SQL injection vulnerability via the component /mobilemode/Action.jsp?invoker=com.weaver.f…

EPSS 0.4%CVSS 9.8

Anthony Carbon1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2024-52414 · Anthony Carbon WDES Responsive Mobile Menu

WordPress WDES Responsive Mobile Menu plugin <= 5.3.18 - PHP Object Injection vulnerability

EPSS 0.5%CVSS 9.8

BasePress1 vulnerability on this pageMax CVSS 9.9Priority 38KEV 0

CVE-2024-52407 · BasePress BasePress Migration Tools

WordPress BasePress Migration Tools plugin <= 1.0.0 - Arbitrary File Upload vulnerability

EPSS 0.5%CVSS 9.9

bigfiveagency1 vulnerability on this pageMax CVSS 9.9Priority 38KEV 0

CVE-2024-52404 · bigfiveagency CF7 Reply Manager

WordPress CF7 Reply Manager plugin <= 1.2.3 - Arbitrary File Upload vulnerability

EPSS 0.5%CVSS 9.9

bikramjoshii1 vulnerability on this pageMax CVSS 9.9Priority 38KEV 0

CVE-2024-52405 · bikramjoshii B-Banner Slider

WordPress B-Banner Slider plugin <= 1.1 - Arbitrary File Upload vulnerability

EPSS 0.5%CVSS 9.9

Clarisse K.1 vulnerability on this pageMax CVSS 9.9Priority 38KEV 0

CVE-2024-52399 · Clarisse K. Writer Helper

WordPress Writer Helper plugin <= 3.1.6 - Arbitrary File Upload vulnerability

EPSS 0.5%CVSS 9.9

erp1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2024-44756 · erp management_software

NUS-M9 ERP Management Software v3.0.0 was discovered to contain a SQL injection vulnerability via the usercode parameter at /UserWH/check…

EPSS 0.5%CVSS 9.8

Eugen Bobrowski1 vulnerability on this pageMax CVSS 10.0Priority 38KEV 0

CVE-2024-52416 · Eugen Bobrowski Debug Tool

WordPress Debug Tool plugin <= 2.2 - Remote Code Execution vulnerability

EPSS 0.5%CVSS 10.0

flowcraft1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2024-52411 · flowcraft Advanced Personalization

WordPress Advanced Personalization plugin <= 1.1.2 - PHP Object Injection vulnerability

EPSS 0.5%CVSS 9.8

NIX Solutions Ltd1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2024-52432 · NIX Solutions Ltd NIX Anti-Spam Light

WordPress NIX Anti-Spam Light plugin <= 0.0.4 - PHP Object Injection vulnerability

EPSS 0.5%CVSS 9.8

Peter1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2024-52428 · Peter Ads Booster by Ads Pro

WordPress Ads Booster by Ads Pro plugin <= 1.12 - Local File Inclusion vulnerability

EPSS 0.5%CVSS 9.8

Phoenixheart2 vulnerabilities on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2024-52409 · Phoenixheart AJAX Random Posts

WordPress AJAX Random Posts plugin <= 0.3.3 - PHP Object Injection vulnerability

EPSS 0.5%CVSS 9.8

CVE-2024-52410 · Phoenixheart Referrer Detector

WordPress Referrer Detector plugin <= 4.2.1.0 - PHP Object Injection vulnerability

EPSS 0.5%CVSS 9.8

pushassist1 vulnerability on this pageMax CVSS 9.9Priority 38KEV 0

CVE-2024-52408 · pushassist Push Notifications for WordPress by PushAssist

WordPress Push Notifications for WordPress by PushAssist plugin <= 3.0.8 - Arbitrary File Upload vulnerability

EPSS 0.5%CVSS 9.9

Saad Iqbal1 vulnerability on this pageMax CVSS 9.9Priority 38KEV 0

CVE-2024-52403 · Saad Iqbal User Management

WordPress User Management plugin <= 1.1 - Arbitrary File Upload vulnerability

EPSS 0.5%CVSS 9.9

Stephen Cui1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2024-52412 · Stephen Cui Xin

WordPress Xin theme <= 1.0.8.1 - PHP Object Injection vulnerability

EPSS 0.5%CVSS 9.8

Subhasis Laha1 vulnerability on this pageMax CVSS 9.9Priority 38KEV 0

CVE-2024-52400 · Subhasis Laha Gallerio

WordPress Gallerio plugin <= 1.01 - Arbitrary File Upload vulnerability

EPSS 0.5%CVSS 9.9

wibergsweb1 vulnerability on this pageMax CVSS 9.9Priority 38KEV 0

CVE-2024-52406 · wibergsweb CSV to html

WordPress CSV to html plugin <= 3.26 - Arbitrary File Upload vulnerability

EPSS 0.5%CVSS 9.9

OpenBSD1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2024-10934 · OpenBSD OpenBSD

OpenBSD NFS double-free vulnerability

EPSS 0.4%CVSS 9.8

Pressaholic1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2024-52431 · Pressaholic WordPress Video Robot - The Ultimate Video Importer

WordPress WP Video Robot plugin <= 1.20.0 - SQL Injection vulnerability

EPSS 0.5%CVSS 9.8

Davor Zeljkovic1 vulnerability on this pageMax CVSS 9.1Priority 36KEV 0

CVE-2024-52397 · Davor Zeljkovic Convert Docx2post

WordPress Convert Docx2post plugin <= 1.4 - Arbitrary File Upload vulnerability

EPSS 0.5%CVSS 9.1

Halyra1 vulnerability on this pageMax CVSS 9.1Priority 36KEV 0

CVE-2024-52398 · Halyra CDI

WordPress CDI plugin <= 5.5.3 - Arbitrary File Upload vulnerability

EPSS 0.5%CVSS 9.1

Cesanta1 vulnerability on this pageMax CVSS 9.8Priority 34KEV 0

CVE-2024-42383 · Cesanta Mongoose Web Server

Use of Out-of-range Pointer Offset in Mongoose Web Server library

EPSS 0.3%CVSS 9.8

zephyrproject-rtos1 vulnerability on this pageMax CVSS 9.4Priority 29KEV 0

CVE-2024-11263 · zephyrproject-rtos Zephyr

arch: riscv: userspace: potential security risk when CONFIG_RISCV_GP=y

EPSS 0.2%CVSS 9.4

The archive.