Critical vulnerability archive — page 446

Codeer Limited1 vulnerability on this pageMax CVSS 10.0Priority 60KEV 0

CVE-2024-25600 · Codeer Limited Bricks Builder

WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability

EPSS 91%public exploit CVSS 10.0

lightning-ai1 vulnerability on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2024-5452 · lightning-ai lightning-ai/pytorch-lightning

RCE via Property/Class Pollution in lightning-ai/pytorch-lightning

EPSS 27%public exploit CVSS 9.8

Zyxel3 vulnerabilities on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2024-29972 · Zyxel NAS326 firmware

UNSUPPORTED WHEN ASSIGNED The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS326 firmware version…

EPSS 90%public exploit CVSS 9.8

CVE-2024-29973 · Zyxel NAS326 firmware

UNSUPPORTED WHEN ASSIGNED The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before…

EPSS 86%public exploit CVSS 9.8

CVE-2024-29974 · Zyxel NAS326 firmware

UNSUPPORTED WHEN ASSIGNED The remote code execution vulnerability in the CGI program “file_upload-cgi” in Zyxel NAS326 firmware ver…

EPSS 23%CVSS 9.8

cubecart1 vulnerability on this pageMax CVSS 9.8Priority 58KEV 0

CVE-2024-34832 · cubecart cubecart

Directory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to execute arbitrary code via a crafted file uploaded…

EPSS 5%public exploit CVSS 9.8

Apache Software Foundation1 vulnerability on this pageMax CVSS 9.1Priority 57KEV 0

CVE-2024-36104 · Apache Software Foundation Apache OFBiz

Apache OFBiz: Path traversal leading to a RCE

EPSS 88%public exploit CVSS 9.1

homebrew1 vulnerability on this pageMax CVSS 9.8Priority 57KEV 0

CVE-2024-36858 · homebrew jan

An arbitrary file upload vulnerability in the /v1/app/writeFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code v…

EPSS 3%public exploit CVSS 9.8

tenda1 vulnerability on this pageMax CVSS 9.8Priority 56KEV 0

CVE-2024-36604 · tenda o3v2_firmware

Tenda O3V2 v1.0.0.12(3880) was discovered to contain a Blind Command Injection via stpEn parameter in the SetStp function.

EPSS 2%public exploit CVSS 9.8

libaom1 vulnerability on this pageMax CVSS 10.0Priority 54KEV 0

CVE-2024-5171 · libaom libaom

heap buffer overflow in libaom

EPSS 1%public exploit CVSS 10.0

Unknown1 vulnerability on this pageMax CVSS 9.1Priority 54KEV 0

CVE-2024-4180 · Unknown The Events Calendar

The Events Calendar < 6.4.0.1 - Reflected XSS

EPSS 2%public exploit CVSS 9.1

jan1 vulnerability on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2024-37273 · jan jan

An arbitrary file upload vulnerability in the /v1/app/appendFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code…

EPSS 1.0%public exploit CVSS 9.8

lylme1 vulnerability on this pageMax CVSS 9.1Priority 52KEV 0

CVE-2024-36675 · lylme lylme_spage

LyLme_spage v1.9.5 is vulnerable to Server-Side Request Forgery (SSRF) via the get_head function.

EPSS 1%public exploit CVSS 9.1

mintplex-labs2 vulnerabilities on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2024-3104 · mintplex-labs mintplex-labs/anything-llm

Remote Code Execution in mintplex-labs/anything-llm

EPSS 1.0%public exploit CVSS 9.8

CVE-2024-3033 · mintplex-labs mintplex-labs/anything-llm

Improper Authorization in mintplex-labs/anything-llm

EPSS 0.6%public exploit CVSS 9.4

wshberlin1 vulnerability on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2024-5153 · wshberlin Startklar Elementor Addons

Startklar Elementor Addons <= 1.7.15 - Unauthenticated Path Traversal to Arbitrary Directory Deletion

EPSS 1%public exploit CVSS 9.8

parisneo2 vulnerabilities on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2024-2362 · parisneo parisneo/lollms-webui

Path Traversal in parisneo/lollms-webui

EPSS 1%public exploit CVSS 9.1

CVE-2024-5482 · parisneo parisneo/lollms-webui

SSRF in add_webpage endpoint in parisneo/lollms-webui

EPSS 0.7%public exploit CVSS 9.8

itsourcecode2 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2024-5635 · itsourcecode Bakery Online Ordering System

itsourcecode Bakery Online Ordering System index.php sql injection

EPSS 0.7%public exploit CVSS 9.8

CVE-2024-5636 · itsourcecode Bakery Online Ordering System

itsourcecode Bakery Online Ordering System index.php sql injection

EPSS 0.7%CVSS 9.8

icegram1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-4295 · icegram Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress

Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via hash

EPSS 10%CVSS 9.8

stock_management_system_project1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-36779 · stock_management_system_project stock_management_system

Sourcecodester Stock Management System v1.0 is vulnerable to SQL Injection via editCategories.php.

EPSS 0.6%public exploit CVSS 9.8

Go standard library1 vulnerability on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2024-24790 · Go standard library net/netip

Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip

EPSS 2%CVSS 9.8

gradio-app1 vulnerability on this pageMax CVSS 9.1Priority 43KEV 0

CVE-2024-4253 · gradio-app gradio-app/gradio

Command Injection in gradio-app/gradio

EPSS 2%CVSS 9.1

Sysaid2 vulnerabilities on this pageMax CVSS 9.9Priority 43KEV 0

CVE-2024-36394 · Sysaid SysAid

SysAid - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS 1%CVSS 9.8

CVE-2024-36393 · Sysaid SysAid

SysAid - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS 0.4%CVSS 9.9

dexta1 vulnerability on this pageMax CVSS 9.1Priority 41KEV 0

CVE-2024-34792 · dexta Dextaz Ping

WordPress Dextaz Ping plugin <= 0.65 - Remote Code Execution (RCE) vulnerability

EPSS 1%CVSS 9.1

viz-rs1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2024-36400 · viz-rs nano-id

nano-id is unable to generate the correct character set

EPSS 0.8%CVSS 9.8

ProjectDiscovery1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-5262 · ProjectDiscovery Interactsh

ProjectDiscovery Interactsh - Files or Directories Accessible to External Parties

EPSS 0.6%CVSS 9.8

rails1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-28103 · rails rails

Action Pack is missing security headers on non-HTML responses

EPSS 0.7%CVSS 9.8

Summar Software1 vulnerability on this pageMax CVSS 10.0Priority 40KEV 0

CVE-2024-5675 · Summar Software Mentor – Employee Portal

Unreliable data deserialization vulnerability in Mentor

EPSS 0.6%CVSS 10.0

mitre1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-36736 · mitre

An issue in the oneflow.permute component of OneFlow-Inc.

EPSS 0.6%CVSS 9.8

phoeniixx1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-4552 · phoeniixx Social Login Lite For WooCommerce

Social Login Lite For WooCommerce <= 1.6.0 - Authentication Bypass

EPSS 0.6%CVSS 9.8

Select-Themes1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-34551 · Select-Themes Stockholm

WordPress Stockholm theme <= 9.6 - Unauthenticated Local File Inclusion vulnerability

EPSS 0.5%CVSS 9.8

Wow-Company1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-35629 · Wow-Company Easy Digital Downloads – Recent Purchases

WordPress Easy Digital Downloads – Recent Purchases plugin <= 1.0.2 - Remote File Inclusion vulnerability

EPSS 0.5%CVSS 9.8

Chanjet1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2024-5653 · Chanjet Smooth T+system

Chanjet Smooth T+system keyEdit.aspx sql injection

EPSS 0.5%CVSS 9.8

DeluxeThemes1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2024-35700 · DeluxeThemes Userpro

WordPress UserPro plugin <= 5.1.8 - Unauthenticated Account Takeover vulnerability

EPSS 0.5%CVSS 9.8

Netgsm1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2024-35672 · Netgsm Netgsm

WordPress Netgsm plugin <= 2.9.19 - Broken Access Control vulnerability

EPSS 0.5%CVSS 9.8

8theme1 vulnerability on this pageMax CVSS 9.0Priority 37KEV 0

CVE-2024-33560 · 8theme XStore

WordPress XStore theme <= 9.3.8 - Unauthenticated Local File Inclusion vulnerability

EPSS 0.6%CVSS 9.0

Bitdefender1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2024-4177 · Bitdefender GravityZone Console On-Premise

Host whitelist parser issue in GravityZone Console On-Premise (VA-11554)

EPSS 0.4%CVSS 9.8

EmailGPT1 vulnerability on this pageMax CVSS 9.1Priority 37KEV 0

CVE-2024-5184 · EmailGPT EmailGPT

Prompt Injection in EmailGPT

EPSS 0.5%CVSS 9.1

Lester ‘GaMerZ’ Chan1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2023-40332 · Lester ‘GaMerZ’ Chan WP-PostRatings

WordPress WP-PostRatings plugin <= 1.91 - Rating limit Bypass vulnerability

EPSS 0.4%CVSS 9.8

SoftLab1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2024-35670 · SoftLab Integrate Google Drive

WordPress Integrate Google Drive plugin <= 1.3.93 - Broken Access Control vulnerability

EPSS 0.4%CVSS 9.8

WPMU DEV1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2023-47189 · WPMU DEV Defender Security

WordPress Defender Security plugin <= 4.2.0 - Masked Login Area View Bypass vulnerability

EPSS 0.5%CVSS 9.8

Unlimited Elements1 vulnerability on this pageMax CVSS 9.1Priority 36KEV 0

CVE-2023-33930 · Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates)

WordPress Unlimited Elements For Elementor plugin <= 1.5.66 - Unrestricted Zip Extraction vulnerability

EPSS 0.5%CVSS 9.1

Grafana1 vulnerability on this pageMax CVSS 9.1Priority 34KEV 0

CVE-2024-5526 · Grafana OnCall

Grafana OnCall is an easy-to-use on-call management tool that will help reduce toil in on-call management through simpler workflows and i…

EPSS 0.4%CVSS 9.1

ABB, Busch-Jaeger2 vulnerabilities on this pageMax CVSS 9.6Priority 33KEV 0

CVE-2024-4008 · ABB, Busch-Jaeger 2.4! Display 55, SD/U12.55.11-825

FDSK Leak in KNX Secure Devices

EPSS 0.3%CVSS 9.6

CVE-2024-4009 · ABB, Busch-Jaeger 2.4! Display 55, SD/U12.55.11-825

Replay Attack in KNX Secure Devices

EPSS 0.1%CVSS 9.2

netty1 vulnerability on this pageMax CVSS 9.1Priority 31KEV 0

CVE-2024-36121 · netty netty-incubator-codec-ohttp

netty-incubator-codec-ohttp's BoringSSLAEADContext Repeats Nonces

EPSS 0.3%CVSS 9.1

BeyondTrust1 vulnerability on this pageMax CVSS 9.1Priority 30KEV 0

CVE-2024-4219 · BeyondTrust BeyondInsight

SSRF In BeyondInsight

EPSS 0.2%CVSS 9.1

The archive.