CVEs published in December 2023
2,760 vulnerabilities, 382 critical, 9 exploited.
- code-projects online examination systemOnline Examination System v1.0 - Multiple Authenticated SQL Injections (SQLi)8.8 High
- david vongries ultimate dashboard – custom wordpress dashboard, davidvongries ultimate dashboard +1 moreWordPress Ultimate Dashboard Plugin <= 3.7.11 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- accredible certificates & open badges, certificates \& open badges +1 moreWordPress Accredible Certificates & Open Badges Plugin <= 1.4.8 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- freshlight lab menu image, icons made easy, freshlightlab menu image\, icons made easy +1 moreWordPress Menu Image, Icons made easy Plugin <= 3.10 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- jacksonwhelan iframe shortcodeWordPress iframe Shortcode Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- devolutions remote desktop managerInadequate validation of permissions when employing remote tools and macros via the context...4.4 Medium
- brian batt insert or embed articulate content into wordpress, elearningfreak insert or embed articulate content +1 moreWordPress Insert or Embed Articulate Content into WordPress Plugin <= 4.3000000021 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- wipeout media css & javascript toolbox, wipeoutmedia css \& javascript toolbox +1 moreWordPress CSS & JavaScript Toolbox Plugin <= 11.7 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- currency.wiki currency converter widget – exchange rates, currencywiki currency converter widget - exchange rates +1 moreWordPress Currency Converter Widget Plugin <= 3.0.2 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- automadautomad Setting post.php cross site scripting4.8 Medium
- ab-wp simple counterWordPress Simple Counter Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- sajjad hossain sagor wp edit usernameWordPress WP Edit Username Plugin <= 1.0.5 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- a wp life event monster – event management, tickets booking, upcoming event, awplife event monster +1 moreWordPress Event Management Tickets Booking Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- hal gatewood dashicons + custom post types, halgatewood dashicons \+ custom post types +1 moreWordPress Dashicons + Custom Post Types Plugin <= 1.0.2 is vulnerable to Broken Access Control5.4 Medium
- winwar wp email capture, winwar media wordpress email marketing plugin – wp email capture +1 moreWordPress WordPress Email Marketing Plugin – WP Email Capture Plugin <= 3.10 is vulnerable to Sensitive Data Exposure5.3 Medium
- smackcoders export all posts, products, orders, refunds & users, export all posts\, products\, orders\, refunds \& users +1 moreWordPress WP Ultimate Exporter Plugin <= 2.4.1 is vulnerable to Sensitive Data Exposure5.9 Medium
- hm plugin wordpress job board and recruitment plugin – jobwp, hmplugin jobwp +1 moreWordPress WordPress Job Board and Recruitment Plugin – JobWP Plugin <= 2.1 is vulnerable to Sensitive Data Exposure7.5 High
- istanbul soft informatics and consultancy limited company softomi advanced c2c marketplace software, softomi advanced c2c marketplace software +1 moreSQLi in Softomi E-commerce Software9.8 Critical
- bigcommerce, bigcommerce for wordpress +1 moreWordPress BigCommerce Plugin <= 5.0.6 is vulnerable to Sensitive Data Exposure5.3 Medium
- istanbul soft informatics and consultancy limited company softomi gelişmiş c2c pazaryeri yazılımı, softomi advanced c2c marketplace software +1 moreReflected XSS in Softomi E-commerce Software6.1 Medium
- appmysite, appmysite – create an app with the best mobile app builder +1 moreWordPress AppMySite Plugin <= 3.11.0 is vulnerable to Sensitive Data Exposure5.3 Medium
- codedropz drag and drop multiple file upload for woocommerceWordPress Drag and Drop Multiple File Upload for WooCommerce Plugin <= 1.0.8 is vulnerable to Multiple Vulnerabilities6.5 Medium
- xtemos woodmart, woodmart - multipurpose woocommerce theme +1 moreWordPress Woodmart Core Plugin <= 1.0.36 is vulnerable to PHP Object Injection9.8 Critical
- dmry sayfa sayacWordPress Sayfa Sayaç Plugin <= 2.6 is vulnerable to PHP Object Injection10.0 Critical
- pencidesign soledad, soledad – multipurpose, newspaper, blog & woocommerce wordpress theme +1 moreWordPress Soledad Theme <= 8.4.1 is vulnerable to PHP Object Injection8.1 High
- apache iotdbApache IoTDB: Unsafe deserialize map in Sync Tool9.8 Critical
- eset security, endpoint antivirus, endpoint security +19 more +21 moreImproper following of a certificate's chain of trust in ESET security products7.5 High
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode...6.3 Medium
- uyumsoft lioxerpStored XSS in Uyumsoft ERP6.1 Medium
- uyumsoft lioxerpReflected XSS in Uyumsoft ERP6.1 Medium
- apache airflowApache Airflow: Improper access control to DAG resources4.3 Medium
- apache airflowApache Airflow: Improper access control vulnerability on the "varimport" endpoint6.5 Medium
- apache airflowApache Airflow: DAG Params alllow to embed unchecked Javascript5.4 Medium
- apache airflowApache Airflow: Missing CSRF protection on DAG/trigger6.5 Medium
- lightxun iptv gatewayLightxun IPTV Gateway web_upload_template.html unrestricted upload4.3 Medium
- kylinos hedron-domain-hookKylinSoft hedron-domain-hook DBus init_kcm access control7.8 High
- tongda oa 2017, tongda2000 office anywhere +1 moreTongda OA 2017 delete.php sql injection6.3 Medium
- tongda oa 2017, tongda2000 office anywhere +1 moreTongda OA 2017 delete_all.php sql injection6.3 Medium
- hcl software bigfix mobile / modern client management, hcltech bigfix modern client management +1 moreAn HTML injection vulnerability can affect HCL BigFix Mobile / Modern Client Management6.6 Medium
- tongda oa 2017, tongda2000 office anywhere +1 moreTongda OA 2017 delete_search.php sql injection6.3 Medium
- hcl software launch, hcltechsw hcl launch +1 moreHCL Launch is susceptible to an HTML injection vulnerability4.3 Medium
- tongda oa 2017, tongda2000 office anywhere +1 moreTongda OA 2017 view.php sql injection6.3 Medium
- google chrome, debian linux, fedoraproject fedora +1 more +3 moreHeap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker...8.8 High
- s-cmsS-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_formauth parameter...9.8 Critical
- s-cmsS-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_textauth parameter...9.8 Critical
- s-cmsS-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_productauth...9.8 Critical
- s-cmsS-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_bbsauth parameter at...9.8 Critical
- s-cmsS-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_newsauth parameter...9.8 Critical
- blinksocksblinksocks has weak encryption algorithms7.5 High
- nos clientAn issue was discovered in nos client version 0.6.6, allows remote attackers to escalate...9.8 Critical
- Show moreLoading…