Critical vulnerability archive — page 401

ZoneMinder1 vulnerability on this pageMax CVSS 10.0Priority 60KEV 0

CVE-2024-51482 · ZoneMinder zoneminder

Boolean-based SQL Injection in ZoneMinder v1.37.* <= 1.37.64

EPSS 37%public exploit CVSS 10.0

jeecg1 vulnerability on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2024-48307 · jeecg jeecgboot

JeecgBoot v3.7.1 was discovered to contain a SQL injection vulnerability via the component /onlDragDatasetHead/getTotalData.

EPSS 50%public exploit CVSS 9.8

LevelOne3 vulnerabilities on this pageMax CVSS 9.9Priority 59KEV 0

CVE-2024-33699 · LevelOne WBR-6012

The LevelOne WBR-6012 router's web application has a vulnerability in its firmware version R0.40e6, allowing attackers to change the admi…

EPSS 11%public exploit CVSS 9.9

CVE-2024-23309 · LevelOne WBR-6012

The LevelOne WBR-6012 router with firmware R0.40e6 has an authentication bypass vulnerability in its web application due to reliance on c…

EPSS 0.9%public exploit CVSS 9.0

CVE-2024-31151 · LevelOne WBR-6012

A security flaw involving hard-coded credentials in LevelOne WBR-6012's web services allows attackers to gain unauthorized access during…

EPSS 0.7%CVSS 9.8

Tongda8 vulnerabilities on this pageMax CVSS 9.8Priority 58KEV 0

CVE-2024-10600 · Tongda OA 2017

Tongda OA 2017 submenu.php sql injection

EPSS 7%public exploit CVSS 9.8

CVE-2024-10601 · Tongda OA 2017

Tongda OA 2017 delete.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2024-10602 · Tongda OA 2017

Tongda OA 2017 data_picker_link.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2024-10615 · Tongda OA 2017

Tongda OA 2017 delete_data_attach.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2024-10616 · Tongda OA

Tongda OA webSignSubmit.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2024-10617 · Tongda OA

Tongda OA check_seal.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2024-10618 · Tongda OA 2017

Tongda OA 2017 record_detail.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2024-10619 · Tongda OA 2017

Tongda OA 2017 next_detail.php sql injection

EPSS 0.6%public exploit CVSS 9.8

lunary-ai1 vulnerability on this pageMax CVSS 9.8Priority 54KEV 0

CVE-2024-7456 · lunary-ai lunary-ai/lunary

SQL Injection in lunary-ai/lunary

EPSS 1%public exploit CVSS 9.8

webswing1 vulnerability on this pageMax CVSS 9.8Priority 54KEV 0

CVE-2024-39332 · webswing webswing

Webswing 23.2.2 allows remote attackers to modify client-side JavaScript code to achieve path traversal, likely leading to remote code ex…

EPSS 1%public exploit CVSS 9.8

mitre1 vulnerability on this pageMax CVSS 9.8Priority 53KEV 0

CVE-2024-42835 · mitre

langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.

EPSS 1%public exploit CVSS 9.8

TOTOLINK1 vulnerability on this pageMax CVSS 9.1Priority 52KEV 0

CVE-2024-10654 · TOTOLINK LR350

TOTOLINK LR350 formLoginAuth.htm authorization

EPSS 2%public exploit CVSS 9.1

antonk521 vulnerability on this pageMax CVSS 9.3Priority 51KEV 0

CVE-2024-21537 · antonk52 lilconfig

Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eva…

EPSS 1%public exploit CVSS 9.3

Codezips2 vulnerabilities on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2024-10556 · Codezips Pet Shop Management System

Codezips Pet Shop Management System birdsadd.php sql injection

EPSS 0.7%public exploit CVSS 9.8

CVE-2024-10561 · Codezips Pet Shop Management System

Codezips Pet Shop Management System birdsupdate.php sql injection

EPSS 0.9%public exploit CVSS 9.8

draytek4 vulnerabilities on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2024-51252 · draytek vigor3900_firmware

In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the…

EPSS 0.8%public exploit CVSS 9.8

CVE-2024-51260 · draytek vigor3900_firmware

DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling t…

EPSS 0.6%public exploit CVSS 9.8

CVE-2024-51255 · draytek vigor3900_firmware

DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling t…

EPSS 0.4%public exploit CVSS 9.8

CVE-2024-51259 · draytek vigor3900_firmware

DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling t…

EPSS 0.4%public exploit CVSS 9.8

std421 vulnerability on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2023-52044 · std42 elfinder

Studio-42 eLfinder 2.1.62 is vulnerable to Remote Code Execution (RCE) as there is no restriction for uploading files with the .php8 exte…

EPSS 0.8%public exploit CVSS 9.8

code-projects2 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2024-10607 · code-projects Courier Management System

code-projects Courier Management System track-result.php sql injection

EPSS 0.7%public exploit CVSS 9.8

CVE-2024-10608 · code-projects Courier Management System

code-projects Courier Management System login.php sql injection

EPSS 0.7%public exploit CVSS 9.8

Delta Electronics1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-10456 · Delta Electronics InfraSuite Device Master

Delta Electronics InfraSuite Device Master Deserialization of Untrusted Data

EPSS 18%CVSS 9.8

Eclipse Foundation1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-10525 · Eclipse Foundation mosquitto

Eclipse Mosquito: Heap Buffer Overflow in my_subscribe_callback

EPSS 59%CVSS 9.8

ESAFENET2 vulnerabilities on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-10595 · ESAFENET CDG

ESAFENET CDG PublicDocInfoAjax.java delDifferCourseList sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2024-10597 · ESAFENET CDG

ESAFENET CDG PolicyActionService.java delPolicyAction sql injection

EPSS 0.6%CVSS 9.8

itsourcecode1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-10609 · itsourcecode Tailoring Management System Project

itsourcecode Tailoring Management System Project typeadd.php sql injection

EPSS 0.6%public exploit CVSS 9.8

lb-link1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-51431 · lb-link bl-wr1300h_firmware

LB-LINK BL-WR 1300H v.1.0.4 contains hardcoded credentials stored in /etc/shadow which are easily guessable.

EPSS 0.6%public exploit CVSS 9.8

phpgurukul3 vulnerabilities on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-51064 · phpgurukul teachers_record_management_system

Phpgurukul Teachers Record Management System v2.1 is vulnerable to SQL Injection via the tid parameter to admin/queries.php.

EPSS 0.6%public exploit CVSS 9.8

CVE-2024-51065 · phpgurukul beauty_parlour_management_system

Phpgurukul Beauty Parlour Management System v1.1 is vulnerable to SQL Injection in admin/index.php via the the username parameter.

EPSS 0.5%public exploit CVSS 9.8

CVE-2024-51063 · phpgurukul teachers_record_management_system

Phpgurukul Teachers Record Management System v2.1 is vulnerable to SQL Injection in add-teacher.php via the mobile number or email parame…

EPSS 0.5%public exploit CVSS 9.1

senols1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-10392 · senols AI Puffer – Your AI engine for WordPress (formerly AI Power)

AI Power: Complete AI Pack <= 1.8.89 - Unauthenticated Arbitrary File Upload

EPSS 15%CVSS 9.8

pebbleroad1 vulnerability on this pageMax CVSS 9.9Priority 48KEV 0

CVE-2024-42515 · pebbleroad glossarizer

Glossarizer through 1.5.2 improperly tries to convert text into HTML.

EPSS 0.5%public exploit CVSS 9.9

qualitor1 vulnerability on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2024-48359 · qualitor qualitor

Qualitor v8.24 was discovered to contain a remote code execution (RCE) vulnerability via the gridValoresPopHidden parameter.

EPSS 2%CVSS 9.8

YesWiki1 vulnerability on this pageMax CVSS 9.9Priority 46KEV 0

CVE-2024-51478 · YesWiki yeswiki

Use of a Broken or Risky Cryptographic Algorithm in YesWiki

EPSS 0.4%public exploit CVSS 9.9

ibos1 vulnerability on this pageMax CVSS 9.1Priority 45KEV 0

CVE-2024-28265 · ibos ibos

IBOS v4.5.5 has an arbitrary file deletion vulnerability via \system\modules\dashboard\controllers\LoginController.php.

EPSS 0.5%public exploit CVSS 9.1

online_admission_system_project1 vulnerability on this pageMax CVSS 9.1Priority 45KEV 0

CVE-2024-51060 · online_admission_system_project online_admission_system

Projectworlds Online Admission System v1 is vulnerable to SQL Injection in index.php via the 'a_id' parameter.

EPSS 0.5%public exploit CVSS 9.1

cure531 vulnerability on this pageMax CVSS 9.8Priority 43KEV 0

CVE-2024-48910 · cure53 DOMPurify

DOMPurify vulnerable to tampering by prototype polution

EPSS 1%CVSS 9.8

webandprint1 vulnerability on this pageMax CVSS 10.0Priority 43KEV 0

CVE-2024-50510 · webandprint AR For Woocommerce

WordPress AR For Woocommerce plugin <= 6.3 - Arbitrary File Upload vulnerability

EPSS 1%CVSS 10.0

HP, Inc.1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-9419 · HP, Inc. HP Smart Universal Printing Driver

Certain HP Print Products–Potential Remote Code Execution and/or Elevation of Privilege with the HP Smart Universal Printing Driver

EPSS 0.7%CVSS 9.8

w3speedster1 vulnerability on this pageMax CVSS 9.1Priority 40KEV 0

CVE-2024-8512 · w3speedster W3SPEEDSTER

W3SPEEDSTER <= 7.26 - Authenticated (Administrator+) Remote Code Execution

EPSS 1.0%CVSS 9.1

donimedia1 vulnerability on this pageMax CVSS 9.9Priority 39KEV 0

CVE-2024-50511 · donimedia WP donimedia carousel

WordPress WP donimedia carousel plugin <= 1.0.1 - Arbitrary File Upload vulnerability

EPSS 0.5%CVSS 9.9

Podlove1 vulnerability on this pageMax CVSS 9.6Priority 34KEV 0

CVE-2024-43984 · Podlove Podlove Podcast Publisher

WordPress Podlove Podcast Publisher plugin <= 4.1.13 - CSRF to Remote Code Execution (RCE) vulnerability

EPSS 0.3%CVSS 9.6

wpsoul1 vulnerability on this pageMax CVSS 9.8Priority 34KEV 0

CVE-2024-50419 · wpsoul Greenshift

WordPress Greenshift plugin <=9.7 - Broken Access Control vulnerability

EPSS 0.3%CVSS 9.8

lukashuser1 vulnerability on this pageMax CVSS 9.6Priority 32KEV 0

CVE-2024-49674 · lukashuser EKC Tournament Manager

WordPress EKC Tournament Manager plugin <= 2.2.1 - CSRF to Arbitrary File Upload vulnerability

EPSS 0.2%CVSS 9.6

The archive.