Medium
CVE-2024-5767
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2024-4627
Rank Math SEO <= 1.0.218 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2024-5553
Premium Addons for Elementor <= 4.10.33 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
Medium
CVE-2024-3492
Events Manager – Calendar, Bookings, Tickets, and more! <= 6.4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via event, location, and event_category Shortcodes
Medium
CVE-2024-1766
Download Manager <= 3.2.86 - Authenticated (Subscriber+) Stored Self-Based Cross-Site Scripting
Medium
CVE-2024-3999
EazyDocs – Most Powerful Knowledge base, wiki, Documentation Builder Plugin <= 2.4.1 - Authenticated (Admin+) Stored Cross-Site Scripting
High
CVE-2024-4845
Icegram Express <= 5.7.22 - Authenticated (Subscriber+) SQL Injection Vulnerability via options[list_id]
Medium
CVE-2024-37168
@grpc/grpc-js can allocate memory for incoming messages well above configured limits
High
CVE-2024-37166
ghtml Cross-Site Scripting (XSS) vulnerability
High
CVE-2024-35241
Composer has a command injection via malicious git branch name
High
CVE-2024-35242
Composer has multiple command injections via malicious git/hg branch names
Critical
CVE-2024-37014
Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_component" endpoint and provide a Python script.
Medium
CVE-2024-5584
WordPress Online Booking and Scheduling Plugin – Bookly <= 23.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Color Profile Parameter
Medium
CVE-2024-5531
Ocean Extra <= 2.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flickr Widget
High
CVE-2024-4540
Keycloak exposes sensitive information in Pushed Authorization Requests (PAR)
Critical
CVE-2024-3549
Blog2Social: Social Media Auto Post & Scheduler <= 7.4.1 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2024-4319
Advanced Contact form 7 DB <= 2.0.2 - Missing Authorization to Unauthenticated Information Disclosure
Medium
CVE-2024-3723
Advanced Contact form 7 DB <= 2.0.2 - Sensitive Information Exposure
Medium
CVE-2024-5530
ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Product Horizontal Filter Widget
High
CVE-2024-36528
nukeviet Deserialization of Untrusted Data vulnerability
Medium
CVE-2024-6130
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.25 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2024-2473
WPS Hide Login <= 1.9.15.2 - Login Page Disclosure
Medium
CVE-2024-5189
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.23 - Authenticated (Contributor+) Stored Cross-Site Scripting
Critical
CVE-2024-36082
Music Store - WordPress eCommerce <= 1.1.13 - Authenticated (Admin+) SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.