The archive.

CVE-2024-24495 · mitre

SQL Injection vulnerability in delete-tracker.php in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via cra…

CVE-2024-24393 · mitre

File Upload vulnerability index.php in Pichome v.1.1.01 allows a remote attacker to execute arbitrary code via crafted POST request.

CVE-2024-25191 · mitre

php-jwt 1.0.0 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a tim…

EPSS 0.9%public exploit CVSS 9.8

CVE-2024-25302 · mitre

Sourcecodester Event Student Attendance System 1.0, allows SQL Injection via the 'student' parameter.

CVE-2024-25307 · mitre

Code-projects Cinema Seat Reservation System 1.0 allows SQL Injection via the 'id' parameter at "/Cinema-Reservation/booking.php?id=1."

CVE-2024-25314 · mitre

Code-projects Hotel Managment System 1.0, allows SQL Injection via the 'sid' parameter in Hotel/admin/show.php?sid=2.

CVE-2024-25315 · mitre

Code-projects Hotel Managment System 1.0, allows SQL Injection via the 'rid' parameter in Hotel/admin/roombook.php?rid=2.

CVE-2024-23759 · mitre

Deserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run arbitrary code via "search" parameter of the Parcelsh…

EPSS 48%CVSS 9.8

CVE-2024-23724 · mitre

Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG p…

EPSS 3%CVSS 9.0

CVE-2024-25675 · mitre

An issue was discovered in MISP before 2.4.184.

EPSS 0.8%CVSS 9.8

CVE-2024-23763 · mitre

SQL Injection vulnerability in Gambio through 4.9.2.0 allows attackers to run arbitrary SQL commands via crafted GET request using modifi…

CVE-2023-46350 · mitre

SQL injection vulnerability in InnovaDeluxe "Manufacturer or supplier alphabetical search" (idxrmanufacturer) module for PrestaShop versi…

CVE-2023-50026 · mitre

SQL injection vulnerability in Presta Monster "Multi Accessories Pro" (hsmultiaccessoriespro) module for PrestaShop versions 5.1.1 and be…

CVE-2024-25722 · mitre

qanything_kernel/connector/database/mysql/mysql_client.py in qanything.ai QAnything before 1.2.0 allows SQL Injection.

CVE-2024-25678 · mitre

In LiteSpeed QUIC (LSQUIC) Library before 4.0.4, DCID validation is mishandled.

EPSS 0.4%CVSS 9.8

Unknown1 vulnerability on this pageMax CVSS 9.8Priority 55KEV 0

CVE-2023-6036 · Unknown Web3

Web3 – Crypto wallet Login & NFT token gating < 3.0.0 - Authentication Bypass

EPSS 2%public exploit CVSS 9.8

bencollins1 vulnerability on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2024-25189 · bencollins jwt_c_library

libjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a tim…

EPSS 1.0%public exploit CVSS 9.8

easycorp1 vulnerability on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2024-24202 · easycorp zentao_max

An arbitrary file upload vulnerability in /upgrade/control.php of ZenTao Community Edition v18.10, ZenTao Biz v8.10, and ZenTao Max v4.10…

hotel_management_system_project1 vulnerability on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2024-25316 · hotel_management_system_project hotel_management_system

Code-projects Hotel Managment System 1.0 allows SQL Injection via the 'eid' parameter in Hotel/admin/usersettingdel.php?eid=2.

openobserve2 vulnerabilities on this pageMax CVSS 10.0Priority 51KEV 0

CVE-2024-24830 · openobserve openobserve

OpenObserve Privilege Escalation Vulnerability in Users API

EPSS 0.7%public exploit CVSS 10.0

CVE-2024-25106 · openobserve openobserve

OpenObserve Unauthorized Access Vulnerability in Users API

EPSS 0.5%CVSS 9.1

gambio1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2024-23761 · gambio gambio

Server Side Template Injection in Gambio 4.9.2.0 allows attackers to run arbitrary code via crafted smarty email template.

pixelfed1 vulnerability on this pageMax CVSS 9.9Priority 50KEV 0

CVE-2024-25108 · pixelfed pixelfed

Insufficient authorization allowing elevated access to resources in pixelfed

EPSS 0.7%public exploit CVSS 9.9

VulDB1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2024-1353 · VulDB

PHPEMS index.api.php index deserialization

Azure1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2024-25110 · Azure azure-uamqp-c

Azure IoT Platform Device SDK Remote Code Execution Vulnerability

EPSS 7%CVSS 9.8

wpdevelop1 vulnerability on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2024-1207 · wpdevelop Booking Calendar

Booking Calendar <= 9.9 - Unauthenticated SQL Injection

EPSS 3%CVSS 9.8

postgresql1 vulnerability on this pageMax CVSS 9.8Priority 43KEV 0

CVE-2024-24213 · postgresql postgresql

Supabase PostgreSQL v15.1 was discovered to contain a SQL injection vulnerability via the component /pg_meta/default/query.

EPSS 1%CVSS 9.8

yealink1 vulnerability on this pageMax CVSS 9.8Priority 43KEV 0

CVE-2024-24091 · yealink meeting_server

Yealink Meeting Server before v26.0.0.66 was discovered to contain an OS command injection vulnerability via the file upload interface.

EPSS 1%CVSS 9.8

Emerson3 vulnerabilities on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2023-46687 · Emerson Rosemount GC370XA

Emerson Rosemount GC370XA, GC700XA, GC1500XA Command Injection

EPSS 0.9%CVSS 9.8

CVE-2023-49716 · Emerson Rosemount GC370XA

Emerson Rosemount GC370XA, GC700XA, GC1500XA Command Injection

CVE-2023-43609 · Emerson Rosemount GC370XA

Emerson Rosemount GC370XA, GC700XA, GC1500XA Improper Authorization

EPSS 0.5%CVSS 9.1

Kalli Dan.1 vulnerability on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2023-46615 · Kalli Dan. KD Coming Soon

WordPress KD Coming Soon Plugin <= 1.7 is vulnerable to PHP Object Injection

EPSS 1.0%CVSS 9.8

glitchedpolygons1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2024-25190 · glitchedpolygons l8w8jwt

l8w8jwt 2.2.1 uses memcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a tim…

EPSS 0.9%CVSS 9.8

misp1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2024-25674 · misp misp

An issue was discovered in MISP before 2.4.184.

EPSS 0.8%CVSS 9.8

rhonabwy_project1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2024-25714 · rhonabwy_project rhonabwy

In Rhonabwy through 1.1.13, HMAC signature verification uses a strcmp function that is vulnerable to side-channel attacks, because it sto…

EPSS 0.8%CVSS 9.8

SonicWall1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2024-22394 · SonicWall SonicOS

An improper authentication vulnerability has been identified in SonicWall SonicOS SSL-VPN feature, which in specific conditions could all…

EPSS 0.7%CVSS 9.8

WP Swings1 vulnerability on this pageMax CVSS 10.0Priority 41KEV 0

CVE-2024-25100 · WP Swings Coupon Referral Program

WordPress Coupon Referral Program plugin < 1.8.4 - Unauthenticated PHP Object Injection vulnerability

EPSS 0.8%CVSS 10.0

boostmyshop1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-24308 · boostmyshop boostmyshop

SQL Injection vulnerability in Boostmyshop (boostmyshopagent) module for Prestashop versions 1.1.9 and before, allows remote attackers to…

EPSS 0.7%CVSS 9.8

G5Theme1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-24797 · G5Theme ERE Recently Viewed – Essential Real Estate Add-On

WordPress ERE Recently Viewed Plugin <= 1.3 is vulnerable to PHP Object Injection

samly1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-25718 · samly elixr

In the Samly package before 1.4.0 for Elixir, Samly.State.Store.get_assertion/3 can return an expired session, which interferes with acce…

EPSS 0.7%CVSS 9.8

cpanel1 vulnerability on this pageMax CVSS 9.1Priority 39KEV 0

CVE-2022-48623 · cpanel cpanel

The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that allows attackers to obtain sensitive info…

EPSS 0.8%CVSS 9.1

Qolsys, Inc.1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-0242 · Qolsys, Inc. IQ Panel 4

Unauthorized access to settings in Qolsys IQ Panel 4 and IQ4 Hub