Medium
CVE-2024-9670
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Medium
CVE-2024-9656
Mynx Page Builder <= 0.27.8 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Medium
CVE-2024-9187
Read more By Adam <= 1.1.8 - Missing Authorization to Authenticated (Subscriber+) Read More Button Deletion
Critical
CVE-2024-21534
JSONPath Plus Remote Code Execution (RCE) Vulnerability
High
CVE-2024-48987
Snipe-IT remote code execution
High
CVE-2024-9821
Bot for Telegram on WooCommerce <= 1.2.7 - Authenticated (Subscriber+) Telegram Bot Token Disclosure to Authentication Bypass
Medium
CVE-2024-9860
Bridge Core <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Demo Import
Medium
CVE-2024-9696
Rescue Shortcodes <= 2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2024-8902
Elementor Addon Elements <= 1.13.8 - Authenticated (Contributor+) Sensitive Information Exposure via table_saved_sections
Medium
CVE-2024-9592
Easy PayPal Gift Certificate <= 1.2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via wpppgc_plugin_options
Medium
CVE-2024-9704
Social Sharing (by Danny) <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Critical
CVE-2024-9047
WordPress File Upload <= 4.24.11 - Unauthenticated Path Traversal to Arbitrary File Read and Deletion in wfu_file_downloader.php
Medium
CVE-2024-7489
Forms for Mailchimp by Optin Cat <= 2.5.7 - Authenticated (Editor+) Stored Cross-Site Scripting via Form Color Parameters
Medium
CVE-2024-9824
ImagePress - Image Gallery <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Post Title Update
Medium
CVE-2024-9778
ImagePress – Image Gallery <= 1.2.2 - Cross-Site Request Forgery to Plugin Settings Update
High
CVE-2024-47871
Gradio uses insecure communication between the FRP client and server
High
CVE-2024-47870
Gradio has a race condition in update_root_in_config may redirect user traffic
Medium
CVE-2024-47872
Gradio has an XSS on every Gradio server via upload of HTML files, JS files, or SVG files
Medium
CVE-2024-47868
Gradio has several components with post-process steps allow arbitrary file leaks
High
CVE-2024-47867
Gradio lacks integrity checking on the downloaded FRP client
Medium
CVE-2024-47869
Gradio performs a non-constant-time comparison when comparing hashes
Medium
CVE-2024-47167
Gradio vulnerable to SSRF in the path parameter of /queue/join
Low
CVE-2024-47168
In Gradio, the `enable_monitoring` flag set to `False` does not disable monitoring
Medium
CVE-2024-47165
Gradio's CORS origin validation accepts the null origin
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.