Medium
CVE-2024-9240
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,329
Reset filters
Critical
CVE-2024-9263
WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin <= 1.0.25 - Insecure Direct Object Reference to Unauthenticated Arbitrary User Password/Email Reset/Account Takeover
Medium
CVE-2024-49304
Pinpoint Booking System <= 2.9.9.5.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2024-7876
Appointment Booking Calendar <= 1.6.7.53 - Authenticated (Admin+) Stored Cross-Site Scripting via Appointment Settings
Medium
CVE-2024-7877
Appointment Booking Calendar <= - Authenticated (Admin+) Stored Cross-Site Scripting via Notification Settings
Medium
CVE-2024-49265
Booking.com Banner Creator <= 1.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-9306
WP Booking Calendar <= 10.6 - Authenticated (Admin+) Stored Cross-Site Scripting
High
CVE-2024-7855
WP Hotel Booking <= 2.1.2 - Authenticated (Subscriber+) Arbitrary File Upload
Medium
CVE-2024-47638
Online Booking & Scheduling Calendar for WordPress by vcita <= 4.4.6 - Reflected Cross-Site Scripting
Medium
CVE-2024-47648
EventPrime <= 4.0.4.5 - Open Redirect
High
CVE-2024-7149
Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.8 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2024-47316
Salon booking system <= 10.9 - Authenticated (Subscriber+) Insecure Direct Object Reference
High
CVE-2024-8290
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.12 - Insecure Direct Object Reference to Account Takeover/Privilege Escalation
Critical
CVE-2024-8943
LatePoint <= 5.0.12 - Authentication Bypass
Medium
CVE-2024-8432
Appointment & Event Booking Calendar Plugin – Webba Booking <= 5.0.48 - Missing Authorization to Authenticated (Subscriber+) CSS Settings Update
Medium
CVE-2024-44037
Multipurpose Ticket Booking Manager <= 4.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2024-44039
WP Travel <= 9.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Critical
CVE-2024-8671
WooEvents <= 4.1.2 - Unauthenticated Arbitrary File Overwrite
Medium
CVE-2024-8860
Tourfic <= 2.14.5 - Missing Authorization in Multiple Functions
Medium
CVE-2024-9882
Salon Booking System <= 10.9.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2024-8797
WP Booking System – Booking Calendar <= 2.0.19.8 - Reflected Cross-Site Scripting
Medium
CVE-2024-8663
WP Simple Booking Calendar <= 2.0.10 - Reflected Cross-Site Scripting
Medium
CVE-2024-8369
EventPrime <= 4.0.4.3 - Missing Authorization to Unauthenticated Private or Password-Protected Events Disclosure
High
CVE-2024-7112
Pinpoint Booking System <= 2.9.9.5.0- Authenticated (Subscriber+) SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.