Medium
CVE-2024-39659
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
High
CVE-2024-7389
Forminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposure
Medium
CVE-2024-39657
Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.6.18 - Cross-Site Request Forgery
Medium
CVE-2024-39660
Photo Engine <= 6.3.1 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2024-6346
Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks <= 2.2.85 - Authenticated (Contributor+) Stored Cross-Site Scripting via redirectURL Parameter of Date Countdown Widget
Medium
ghsa-55p7-v223-x366
IdentityServer Open Redirect vulnerability
Medium
CVE-2024-41948
biscuit-java vulnerable to public key confusion in third party block
Medium
CVE-2024-23444
Elasticsearch stores private key on disk unencrypted
Medium
CVE-2024-7302
Blog2Social: Social Media Auto Post & Scheduler <= 7.5.4 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload
Medium
CVE-2024-5331
Breakdance <= 1.7.2 - Missing Authorization
Medium
CVE-2024-5330
Breakdance <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
ghsa-gc5h-6jx9-q2qh
eZ Platform Admin UI vulnerable to DOM-based Cross-site Scripting in file upload widget
Critical
CVE-2024-41947
XWiki Platform vulnerable to Cross-Site Scripting (XSS) through conflict resolution
Medium
CVE-2024-2455
Element Pack - Addon for Elementor Page Builder WordPress Plugin <= 7.9.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Wrapper Link URL
Unrated
CVE-2024-13262
drupal/view_password - SA-CONTRIB-2024-026
Medium
CVE-2024-2090
Remote Content Shortcode <= 1.5 - Authenticated (Contributor+) Server-Side Request Forgery
Medium
CVE-2024-39694
IdentityServer Open Redirect vulnerability
Medium
CVE-2024-39318
Ibexa Admin UI vulnerable to DOM-based Cross-site Scripting in file upload widget
Critical
CVE-2024-37901
XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet
High
CVE-2024-37900
XWiki Platform vulnerable to Cross-site Scripting through attachment filename in uploader
Medium
CVE-2024-37898
XWiki Platform vulnerable to document deletion and overwrite from edit
High
CVE-2024-6698
FundEngine – Donation and Crowdfunding Platform <= 1.7.0 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2024-7300
Bolt CMS Cross-site Scripting vulnerability
Critical
CVE-2024-6255
A vulnerability in the JSON file handling of gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to delete any JSON file on the server, including critical configuration files such as `config.j
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.