CVEs published in December 2023
2,760 vulnerabilities, 382 critical, 9 exploited.
- huggingface huggingface/transformers, transformers +1 moreDeserialization of Untrusted Data in huggingface/transformers9.6 Critical
- foxskav easy betWordPress Easy Bet Plugin <= 1.0.2 is vulnerable to SQL Injection5.5 Medium
- adastra crypto cryptocurrency payment & donation box – accept payments in any cryptocurrency on your wp site for free, adastracrypto cryptocurrency payment \& donation box +1 moreWordPress Cryptocurrency Donation Box – Bitcoin & Crypto Donations Plugin <= 2.2.7 is vulnerable to SQL Injection5.5 Medium
- code-projects student information systemStudent Information System v1.0 - Multiple Authenticated SQL Injections (SQLi)8.8 High
- code-projects student information systemStudent Information System v1.0 - Multiple Authenticated SQL Injections (SQLi)8.8 High
- woocommerce automatewooWordPress AutomateWoo Plugin <= 5.7.1 is vulnerable to SQL Injection7.6 High
- code-projects student information systemStudent Information System v1.0 - Multiple Authenticated SQL Injections (SQLi)8.8 High
- crawlspider seo change monitor – track website changes, seo change monitor +1 moreWordPress SEO Change Monitor Plugin <= 1.2 is vulnerable to SQL Injection8.5 High
- woocommerce automatewooWordPress WooCommerce Follow-Up Emails Plugin <= 4.9.50 is vulnerable to SQL Injection8.5 High
- pencidesign soledad, soledad – multipurpose, newspaper, blog & woocommerce wordpress theme +1 moreWordPress Soledad Theme <= 8.4.1 is vulnerable to SQL Injection8.5 High
- dmry sayfa sayacWordPress Sayfa Sayaç Plugin <= 2.6 is vulnerable to SQL Injection9.3 Critical
- bcorp shortcodes project shortcodes, tim brattberg bcorp shortcodes +1 moreWordPress BCorp Shortcodes Plugin <= 0.23 is vulnerable to PHP Object Injection10.0 Critical
- google chromeInsufficient policy enforcement in ADB in Google Chrome on ChromeOS prior to 114.0.5735.90...6.8 Medium
- phpbits genesis simple loveWordPress Genesis Simple Love Plugin <= 2.0 is vulnerable to PHP Object Injection10.0 Critical
- automattic woocommerce subscriptions, woocommerce woo subscriptions +1 moreWordPress WooCommerce Subscriptions Plugin <= 5.1.2 is vulnerable to Insecure Direct Object References (IDOR)7.5 High
- automattic woopayments, woopayments – fully integrated solution built and supported by woo +1 moreWordPress WooCommerce Payments Plugin <= 5.9.0 is vulnerable to SQL Injection7.6 High
- automattic woopayments, woopayments – fully integrated solution built and supported by woo +1 moreWordPress WooCommerce Payments Plugin <= 5.9.0 is vulnerable to Insecure Direct Object References (IDOR)7.5 High
- realmag777 husky – products filter for woocommerce professional, pluginus husky - products filter professional for woocommerce +1 moreWordPress HUSKY – Products Filter for WooCommerce (formerly WOOF) Plugin <= 1.3.4.2 is vulnerable to SQL Injection9.3 Critical
- daniel söderström / sidney van de stouwe subscribe to category, subscribe to category project to category +1 moreWordPress Subscribe to Category Plugin <= 2.7.4 is vulnerable to SQL Injection9.3 Critical
- link whisper free, linkwhisper link whisper free +1 moreWordPress Link Whisper Free Plugin <= 0.6.5 is vulnerable to SQL Injection8.5 High
- gravity forms forms, gravityforms gravity forms +1 moreWordPress Gravity Forms Plugin <= 2.7.3 is vulnerable to PHP Object Injection8.3 High
- automattic woocommerce square, woocommerce square +1 moreWordPress WooCommerce Square Plugin <= 3.8.1 is vulnerable to Insecure Direct Object References (IDOR)8.1 High
- ibm informix jdbcIBM Informix JDBC code execution6.3 Medium
- marketing fire editorial calendarWordPress Editorial Calendar Plugin <= 3.7.12 is vulnerable to Insecure Direct Object References (IDOR)5.4 Medium
- adobe experience managerAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)5.4 Medium
- adobe experience managerAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)5.4 Medium
- adobe experience managerAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)5.4 Medium
- adobe experience managerAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)5.4 Medium
- adobe experience managerAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)5.4 Medium
- adobe experience managerAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)5.4 Medium
- progress sitefinityPotential Use of the Sitefinity System for Distribution of Phishing Emails4.7 Medium
- automattic woocommerce gocardless, woocommerce gocardless +1 moreWordPress WooCommerce GoCardless Gateway Plugin <= 2.5.6 is vulnerable to Insecure Direct Object References (IDOR)8.2 High
- jordy meow photo engine (media organizer & lightroom), meowapps photo engine +1 moreWordPress Photo Engine Plugin <= 6.2.5 is vulnerable to Insecure Direct Object References (IDOR)5.4 Medium
- mainwp dashboard – wordpress manager for multiple websites maintenance, dashboard +1 moreWordPress MainWP Plugin <= 4.4.3.3 is vulnerable to SQL Injection7.6 High
- ux-themes flatsome | multi-purpose responsive woocommerce theme, uxthemes flatsome +1 moreWordPress Flatsome Theme <= 3.17.5 is vulnerable to PHP Object Injection8.3 High
- sunshinephotocart sunshine photo cart: free client galleries for photographers, sunshine photo cart +1 moreWordPress Sunshine Photo Cart Plugin < 3.0.0 is vulnerable to Insecure Direct Object References (IDOR)5.3 Medium
- themify ultraWordPress Themify Ultra Theme <= 7.3.5 is vulnerable to PHP Object Injection7.4 High
- advancedcoding comments – wpdiscuz, gvectors wpdiscuz +1 moreWordPress wpDiscuz Plugin <= 7.6.3 is vulnerable to Insecure Direct Object References (IDOR)2.7 Low
- avirtum ipages flipbook for wordpress, ipages flipbook project flipbook +1 moreWordPress iPages Flipbook Plugin <= 1.4.8 is vulnerable to SQL Injection7.6 High
- averta master slider pro, master slider pro +1 moreWordPress Master Slider Pro Plugin <= 3.6.5 is vulnerable to PHP Object Injection7.1 High
- kakadu software pty ltd sdk, kakadusoftware kakadu sdk +1 moreJPX Fragment List (flst) box vulnerability in Kakadu 7.9 allows an attacker to exfiltrate local and remote files reachable by a server if the server allows the attacker to upload a specially-crafted t…7.5 High
unsafe-libyamlcrates.iounsafe-libyaml unaligned write of u64 on 32-bit and 16-bit platformsNo score- amazing little poll little poll, mr-corner amazing little poll +1 moreStored XSS vulnerability in Amazing Little Poll6.5 Medium
- amazing little poll little poll, mr-corner amazing little poll +1 moreAuthentication bypass vulnerability in Amazing Little Poll9.4 Critical
- m-files serverUncontrolled Resource Consumption in M-Files Server6.5 Medium
- m-files serverBrute force vulnerability in M-Files user authentication7.5 High
- apache pulsar, apache software foundation pulsar websocket proxy +1 moreApache Pulsar WebSocket Proxy: Improper Authentication for WebSocket Proxy Endpoint Allows DoS7.5 High
- u-blox toby-l2, toby-l200 firmware, toby-l201 firmware +3 more +5 moreCommand Execution through Serial Interface of u-blox TOBY-L27.6 High
- lfprojects mlflow, mlflow mlflow/mlflow +1 morePath Traversal: '\..\filename'10.0 Critical
- lfprojects mlflow, mlflow mlflow/mlflow +1 moreUnrestricted Upload of File with Dangerous Type8.8 High
- Show moreLoading…