Medium
CVE-2024-5799
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Medium
CVE-2024-6017
Music Request Manager <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2024-6870
Responsive Lightbox & Gallery <= 2.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload
Medium
CVE-2024-7778
Orbit Fox by ThemeIsle <= 2.10.36 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
High
CVE-2024-40453
squirrelly Code Injection vulnerability
Medium
CVE-2024-43411
CKEditor4 low-risk cross-site scripting (XSS) vulnerability linked to potential domain takeover
Medium
CVE-2024-43407
Code Snippet GeSHi plugin in CKEditor 4 has reflected cross-site scripting (XSS) vulnerability
High
CVE-2024-8480
Image Optimizer, Resizer and CDN – Sirv <= 7.2.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Upload
Unrated
CVE-2024-13266
drupal/responsive_menu - SA-CONTRIB-2024-030
Medium
CVE-2024-41937
Apache Airflow Cross-site Scripting Vulnerability
High
CVE-2024-7885
Undertow vulnerable to Race Condition
High
CVE-2024-7384
AcyMailing <= 9.7.2 - Authenticated (Subscriber+) Arbitrary File Upload via acym_extractArchive Function
Medium
CVE-2024-5583
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonials Widget Settings
High
CVE-2023-49198
Apache SeaTunnel SQL Injection vulnerability
Medium
CVE-2024-7836
Themify Builder <= 7.6.1 - Missing Authorization to Authenticated (Contributor+) Post Duplication
Critical
CVE-2024-6386
WPML Multilingual CMS <= 4.6.12 - Authenticated (Contributor+) Remote Code Execution via Twig Server-Side Template Injection
High
CVE-2024-22281
Apache Helix Front (UI) component contained a hard-coded secret
Critical
CVE-2024-28000
LiteSpeed Cache <= 6.3.0.1 - Unauthenticated Privilege Escalation
Medium
CVE-2024-7848
User Private Files <= 2.1.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private File Access
Medium
CVE-2024-43409
Ghost's improper authentication allows access to member information and actions
Critical
CVE-2024-5335
Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 1.6.4 - Unauthenticated PHP Object Injection
Medium
CVE-2024-43397
apollo-portal has potential unauthorized access issue
Medium
CVE-2024-42369
matrix-js-sdk will freeze when a user sets a room with itself as a its predecessor
Medium
CVE-2024-43377
Umbraco CMS Improper Access Control vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.