Critical vulnerability archive — page 445

man-group1 vulnerability on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2024-3408 · man-group man-group/dtale

Authentication Bypass and RCE in man-group/dtale

EPSS 78%public exploit CVSS 9.8

parisneo7 vulnerabilities on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2024-3429 · parisneo parisneo/lollms

Path Traversal in parisneo/lollms

EPSS 28%public exploit CVSS 9.8

CVE-2024-4320 · parisneo parisneo/lollms-webui

Remote Code Execution due to LFI in '/install_extension' in parisneo/lollms-webui

EPSS 34%public exploit CVSS 9.8

CVE-2024-1873 · parisneo parisneo/lollms-webui

Path Traversal and Denial of Service in parisneo/lollms-webui

EPSS 13%public exploit CVSS 9.1

CVE-2024-2360 · parisneo parisneo/lollms-webui

Path Traversal leading to Remote Code Execution in parisneo/lollms-webui

EPSS 2%public exploit CVSS 9.8

CVE-2024-2624 · parisneo parisneo/lollms-webui

Path Traversal and Arbitrary File Upload Vulnerability in parisneo/lollms-webui

EPSS 1%public exploit CVSS 9.8

CVE-2024-2359 · parisneo parisneo/lollms-webui

Improper Neutralization of Special Elements used in an OS Command in parisneo/lollms-webui

EPSS 1%public exploit CVSS 9.8

CVE-2024-3322 · parisneo parisneo/lollms-webui

Path Traversal in parisneo/lollms-webui

EPSS 0.7%public exploit CVSS 9.8

gaizhenbiao1 vulnerability on this pageMax CVSS 9.8Priority 57KEV 0

CVE-2024-3234 · gaizhenbiao gaizhenbiao/chuanhuchatgpt

Path Traversal in gaizhenbiao/chuanhuchatgpt

EPSS 4%public exploit CVSS 9.8

mlflow1 vulnerability on this pageMax CVSS 10.0Priority 57KEV 0

CVE-2024-0520 · mlflow mlflow/mlflow

Remote Code Execution due to Full Controlled File Write in mlflow/mlflow

EPSS 2%public exploit CVSS 10.0

Unknown1 vulnerability on this pageMax CVSS 9.8Priority 57KEV 0

CVE-2024-4620 · Unknown ARForms - Premium WordPress Form Builder Plugin

ArForms < 6.6 - Unauthenticated RCE

EPSS 3%public exploit CVSS 9.8

significant-gravitas1 vulnerability on this pageMax CVSS 9.8Priority 54KEV 0

CVE-2024-1881 · significant-gravitas significant-gravitas/autogpt

Improper Neutralization of Special Elements used in an OS Command in significant-gravitas/autogpt

EPSS 1%public exploit CVSS 9.8

itsourcecode2 vulnerabilities on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2024-5745 · itsourcecode Bakery Online Ordering System

itsourcecode Bakery Online Ordering System unrestricted upload

EPSS 0.9%public exploit CVSS 9.8

CVE-2024-5733 · itsourcecode Online Discussion Forum

itsourcecode Online Discussion Forum register_me.php sql injection

EPSS 0.6%CVSS 9.8

mintplex-labs2 vulnerabilities on this pageMax CVSS 9.6Priority 51KEV 0

CVE-2024-3166 · mintplex-labs mintplex-labs/anything-llm

Cross-Site Scripting (XSS) Vulnerability in mintplex-labs/anything-llm

EPSS 1.0%public exploit CVSS 9.6

CVE-2024-3149 · mintplex-labs mintplex-labs/anything-llm

SSRF in mintplex-labs/anything-llm

EPSS 0.5%public exploit CVSS 9.6

libarchive1 vulnerability on this pageMax CVSS 9.1Priority 50KEV 0

CVE-2024-37407 · libarchive libarchive

Libarchive before 3.7.4 allows name out-of-bounds access when a ZIP archive has an empty-name file and mac-ext is enabled.

EPSS 1.0%public exploit CVSS 9.1

Netentsec2 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2024-5772 · Netentsec NS-ASG Application Security Gateway

Netentsec NS-ASG Application Security Gateway deleteiscuser.php sql injection

EPSS 0.7%public exploit CVSS 9.8

CVE-2024-5773 · Netentsec NS-ASG Application Security Gateway

Netentsec NS-ASG Application Security Gateway deletemacbind.php sql injection

EPSS 0.7%CVSS 9.8

SourceCodester2 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2024-5774 · SourceCodester Stock Management System

SourceCodester Stock Management System Login index.php sql injection

EPSS 0.7%public exploit CVSS 9.8

CVE-2024-36673 · sourcecodester pharmacymedical_store_point_of_sale_system

Sourcecodester Pharmacy/Medical Store Point of Sale System 1.0 is vulnerable SQL Injection via login.php.

EPSS 0.5%CVSS 9.8

lunary-ai4 vulnerabilities on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-4146 · lunary-ai lunary-ai/lunary

Incorrect Authorization in lunary-ai/lunary

EPSS 0.5%public exploit CVSS 9.8

CVE-2024-5128 · lunary-ai lunary-ai/lunary

IDOR Vulnerability in lunary-ai/lunary

EPSS 0.5%public exploit CVSS 9.4

CVE-2024-5133 · lunary-ai lunary-ai/lunary

Account Takeover via Exposed Recovery Token in lunary-ai/lunary

EPSS 0.5%public exploit CVSS 9.1

CVE-2024-5328 · lunary-ai lunary-ai/lunary

SSRF Vulnerability in lunary-ai/lunary

EPSS 0.4%public exploit CVSS 9.3

mitre3 vulnerabilities on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2024-30163 · mitre

Invision Community before 4.7.16 allow SQL injection via the applications/nexus/modules/front/store/store.php IPS\nexus\modules\front\sto…

EPSS 9%CVSS 9.8

CVE-2024-22074 · mitre

Dynamsoft Service 1.8.1025 through 1.8.2013, 1.7.0330 through 1.7.2531, 1.6.0428 through 1.6.1112, 1.5.0625 through 1.5.3116, 1.4.0618 th…

EPSS 0.4%CVSS 9.8

CVE-2024-24192 · mitre

robdns commit d76d2e6 was discovered to contain a heap overflow via the component block->filename at /src/zonefile-insertion.c.

EPSS 0.4%CVSS 9.1

roundcube1 vulnerability on this pageMax CVSS 9.8Priority 44KEV 0

CVE-2024-37385 · roundcube roundcube_webmail

Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path.

EPSS 1%CVSS 9.8

VulDB1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2024-5732 · VulDB

Clash Proxy Port improper authentication

EPSS 0.9%CVSS 9.8

IBM1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2023-45188 · IBM Engineering Lifecycle Optimization Publishing

IBM Engineering Lifecycle Optimization Publishing file upload

EPSS 0.7%CVSS 9.8

expresstech1 vulnerability on this pageMax CVSS 9.9Priority 38KEV 0

CVE-2024-3592 · expresstech Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker

Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress <= 9.0.1 - Authenticated (Contributor+) SQL Injection

EPSS 0.5%CVSS 9.9

JS Help Desk1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2024-31273 · JS Help Desk JS Help Desk – Best Help Desk & Support Plugin

WordPress JS Help Desk plugin <= 2.8.3 - Broken Access Control vulnerability

EPSS 0.5%CVSS 9.8

8theme1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2024-33561 · 8theme XStore

WordPress XStore theme <= 9.3.8 - Unauthenticated Broken Access Control vulnerability

EPSS 0.4%CVSS 9.8

Bricksforge1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2024-31244 · Bricksforge Bricksforge

WordPress Bricksforge plugin <= 2.0.17 - Unauthenticated Arbitrary WordPress Settings Change vulnerability

EPSS 0.4%CVSS 9.8

Johnson Controls1 vulnerability on this pageMax CVSS 9.1Priority 37KEV 0

CVE-2024-32752 · Johnson Controls iSTAR Configuration Utility (ICU)

Johnson Controls Software House iSTAR Configuration Utility (ICU) Tool

EPSS 0.6%CVSS 9.1

tainacan1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2024-30529 · tainacan Tainacan

WordPress Tainacan plugin <= 0.20.7 - Broken Access Control vulnerability

EPSS 0.4%CVSS 9.8

typps1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2024-30534 · typps Calendarista Basic Edition

WordPress Calendarista Basic Edition plugin <= 3.0.5 - Broken Access Control vulnerability

EPSS 0.4%CVSS 9.8

AA-Team1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2024-33545 · AA-Team WZone

WordPress WZone plugin <= 14.0.10 - Unauthenticated Broken Access Control vulnerability

EPSS 0.4%CVSS 9.8

Awesome Support Team1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2024-30539 · Awesome Support Team Awesome Support

WordPress Awesome Support plugin <= 6.1.7 - Broken Access Control vulnerability

EPSS 0.4%CVSS 9.8

DELUCKS GmbH1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2024-30538 · DELUCKS GmbH DELUCKS SEO

WordPress DELUCKS SEO plugin <= 2.5.4 - Broken Access Control vulnerability

EPSS 0.4%CVSS 9.8

Jewel Theme1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2024-35660 · Jewel Theme Master Addons for Elementor

WordPress Master Addons for Elementor plugin <= 2.0.5.4.1 - Broken Access Control on API vulnerability

EPSS 0.4%CVSS 9.8

lxml1 vulnerability on this pageMax CVSS 9.1Priority 36KEV 0

CVE-2024-37388 · lxml lxml

An XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of lxml before v4.9.1 allows attackers to access sensit…

EPSS 0.5%CVSS 9.1

Merv Barrett1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2024-32799 · Merv Barrett Easy Property Listings

WordPress Easy Property Listings plugin <= 3.5.3 - Broken Access Control vulnerability

EPSS 0.4%CVSS 9.8

Patchstack1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2024-31352 · Patchstack

WordPress Icegram Express plugin <= 5.7.13 - Broken Access Control vulnerability

EPSS 0.4%CVSS 9.8

UPQODE1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2024-30544 · UPQODE Whizzy

WordPress Whizzy plugin <= 1.1.18 - Broken Access Control vulnerability

EPSS 0.4%CVSS 9.8

Woo1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2023-51494 · Woo WooCommerce Product Vendors

WordPress WooCommerce Product Vendors plugin <= 2.2.1 - Broken Access Control vulnerability

EPSS 0.4%CVSS 9.8

UkrSolution1 vulnerability on this pageMax CVSS 9.1Priority 35KEV 0

CVE-2024-33565 · UkrSolution Barcode Scanner with Inventory & Order Manager

WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.5.3 - Unauthenticated Broken Access Control vulnerability

EPSS 0.4%CVSS 9.1

weForms1 vulnerability on this pageMax CVSS 9.1Priority 33KEV 0

CVE-2024-30512 · weForms weForms

WordPress weForms plugin <= 1.6.20 - Broken Access Control vulnerability

EPSS 0.4%CVSS 9.1

MultiVendorX1 vulnerability on this pageMax CVSS 9.1Priority 32KEV 0

CVE-2024-25929 · MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX

WordPress Product Catalog Mode For Woocommerce plugin <= 5.0.5 - Broken Access Control vulnerability

EPSS 0.3%CVSS 9.1

The archive.