Medium
CVE-2024-8618
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Medium
CVE-2024-8090
JavaScript Logic <= 0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2024-5309
Form Vibes – Database Manager for Forms <= 1.4.12 - Missing Authorization in Multiple Functions
Medium
CVE-2024-7878
WP ULike <= 4.7.3 - Authenticated (Admin+) Stored Cross-Site Scripting
High
CVE-2024-7627
Bit File Manager 6.0 - 6.5.5 - Unauthenticated Remote Code Execution via Race Condition
Medium
CVE-2024-45429
Advanced Custom Fields <= 6.3.5 - Authenticated Stored Cross-Site Scripting
Medium
CVE-2024-7892
adstxt Plugin <= 1.0.0 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2022-3556
Cab fare calculator <= 1.1.6 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2024-6845
Chatbot with ChatGPT <= 2.4.5 - Missing Authorization to Unauthenticated OpenAI API Key Exposure
Medium
CVE-2024-7605
HelloAsso <= 1.1.10 - Missing Authorization to Authenticated (Contributor+) Limited Options Update
Medium
CVE-2024-8245
GamiPress - Reset User <= 1.0.0 - Cross-Site Request Forgery to GamiPress User Data Removal
Medium
CVE-2024-6835
Ivory Search – WordPress Search Plugin <= 5.5.6 - Information Exposure via AJAX Search Form
Medium
ghsa-h4gh-qq45-vh27
pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels
High
CVE-2024-42471
@actions/artifact has an Arbitrary File Write via artifact extraction
High
ghsa-hq76-662x-7mw4
Pimcore includes vulnerable PHPOffice/PhpSpreadsheet
Medium
CVE-2024-45390
@blakeembrey/template vulnerable to code injection when attacker controls template input
High
CVE-2024-45391
Tina search token leak via lock file in TinaCMS
Medium
CVE-2024-45389
DOM clobbering could escalate to Cross-site Scripting (XSS)
Medium
CVE-2024-8318
Attributes for Blocks <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via attributesForBlocks Parameter
Critical
CVE-2024-7950
WP Job Portal <= 2.1.6 - Missing Authorization to Unauthenticated Local File Inclusion, Arbitrary Settings Update, and User Creation
Medium
CVE-2024-8121
The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Missing Authorization to Admin Username Change
Medium
CVE-2024-8325
Gutenberg Page Builder Blocks & Ready-Made Patterns Library <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-8123
The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Insecure Direct Object Reference
High
CVE-2024-8289
MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.0 - Missing Authorization to Arbitrary Vendor Deletion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.