Medium
CVE-2024-43959
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
High
CVE-2024-58383
Froxlor: /etc/pure-ftpd/db/mysql.conf is chmod 644 but contains <SQL_UNPRIVILEGED_PASSWORD>
High
CVE-2024-7351
Simple Job Board <= 2.12.3 - Authenticated (Editor+) PHP Object Injection
Medium
CVE-2024-8113
Stored XSS in organizer and event settings of pretix up to 2024.7.0 allows malicious event organizers to inject HTML tags into e-mail previews on settings page. The default Content Security Policy of
Medium
CVE-2024-6631
ImageRecycle pdf & image compression <= 3.1.14 - Missing Authorization in Several AJAX Actions
Medium
CVE-2024-2254
RT Easy Builder – Advanced addons for Elementor <= 2.3 - Authenticated (Contributor+) Stored Cross-site Scripting
Medium
CVE-2023-6987
String Locator <= 2.6.5 - Reflected Cross-Site Scripting
High
CVE-2024-38807
Signature forgery in Spring Boot's Loader
Medium
CVE-2024-6499
WordPress Button Plugin MaxButtons <= 9.7.8 - Full Path Disclosure
High
CVE-2024-7129
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.7.42 - Authenticated (Admin+) Remote Code Execution
Medium
CVE-2024-8120
ImageRecycle pdf & image compression <= 3.1.14 - Cross-Site Request in Several AJAX Actions
High
CVE-2024-7863
Favicon Generator <= 1.5 - Cross-Site Request Forgery to Arbitrary File Upload
Medium
CVE-2024-7133
My Sticky Bar <= 2.7.2 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2023-0926
Custom Permalinks <= 2.6.0 - Authenticated(Editor+) Stored Cross-Site Scripting
Critical
CVE-2024-7568
Favicon Generator <= 1.5 - Cross-Site Request Forgery to Arbitrary File Deletion
High
CVE-2024-7656
Image Hotspot by DevVN <= 1.2.5 - Authenticated (Author+) PHP Object Injection
Critical
CVE-2024-7772
Jupiter X Core <= 4.6.5 - Unauthenticated Arbitrary File Upload
Medium
CVE-2024-6850
Carousel Slider <= 2.2.13 - Authenticated (Editor+) Stored Cross-Site Scripting
Critical
CVE-2024-45201
LlamaIndex includes an exec call for `import {cls_name}`
Medium
CVE-2024-5502
Piotnet Addons For Elementor <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
Low
CVE-2024-43787
Hono CSRF middleware can be bypassed using crafted Content-Type header
High
CVE-2024-7258
WooCommerce Google Feed Manager <= 2.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Deletion
High
CVE-2024-7559
File Manager Pro <= 8.3.7 - Authenticated (Subscriber+) Arbitrary File Upload
Medium
CVE-2024-7766
Adicon Server <= 1.2 - Authenticated (Admin+) SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.