CVEs published in January 2024
2,664 vulnerabilities, 306 critical, 14 exploited.
- code-projects employee management systemSourceCodester Employee Management System Profile Page edit-photo.php unrestricted upload4.7 Medium
- code-projects employee management systemSourceCodester Employee Management System edit_profile.php sql injection6.3 Medium
- se.math.spbu spbu se siteUploading an image with a specific filename causes a server-side DoS6.8 Medium
- sni thrukThruk Incorrect limitation of a pathname to a restricted directory (Path Traversal) (CWE-22)5.4 Medium
- shanxi diankeyun technology noderpShanxi Diankeyun Technology NODERP Cookie common.php improper authentication7.3 High
- shanxi diankeyun technology noderpShanxi Diankeyun Technology NODERP log file access5.3 Medium
- totolink n200re, n200re firmware +1 moreTotolink N200RE cstecgi.cgi loginAuth stack-based overflow7.2 High
- jonathonkemp wordpress usersWordPress Users <= 1.4 - Settings Update via CSRF8.8 High
- benaceur-php restrict usernames emails charactersRestrict Usernames Emails Characters Plugin < 3.1.4 - Admin+ Stored XSS4.8 Medium
- jeremiahorem custom user cssCustom User CSS <= 0.2 - Settings Update via CSRF8.8 High
- ashanjay eventonEventON < 4.4.1 - Reflected Cross-Site Scripting6.1 Medium
- paulgriffinpetty wp plugin listerWP Plugin Lister <= 2.1.0 - Settings Update to Stored XSS via CSRF5.4 Medium
- markusbegerow wp-adv-quizWp-Adv-Quiz < 1.0.3 - Admin+ Stored XSS4.8 Medium
- unknown easy svg allow, benjaminzekavica easy svg support +1 moreEasy SVG Allow <= 1.0 - Author+ Stored XSS via SVG5.4 Medium
- theme-junkie tj shortcodesTJ Shortcodes <= 0.1.3 - Contributor+ Stored XSS via Shortcodes5.4 Medium
- pagelayer, unknown page builder: pagelayer +1 morePageLayer < 1.8.0 - Author+ Stored XSS4.8 Medium
- unalignedcode autotitle, unknown autotitle for wordpress +1 moreAutotitle for WordPress <= 1.0.3 - Settings Update to Stored XSS via CSRF8.8 High
- unknown wp staging wordpress backup plugin, wp-staging wp staging +1 moreWP STAGING WordPress Backup Plugin < 3.2.0 - Unauthorized Sensitive Data Exposure7.5 High
- markusbegerow wp-adv-quizWp-Adv-Quiz <= 1.0.2 - Admin+ Stored XSS in Quiz Overview4.8 Medium
- relevanssi, unknown relevanssi premium +1 moreRelevanssi (Free < 4.22.0, Premium < 2.25.0) - Unauthenticated Private/Draft Post Disclosure5.3 Medium
- unknown woostify sites library, woostify sites library +1 moreWoostify Sites Library < 1.4.8 - Subscriber+ Arbitrary Options Update to DoS7.1 High
- kc computing site notes, sidenotesproject side notes +1 moreSite Notes <= 2.0.0 - Admin Note Deletion via CSRF4.3 Medium
- abhinavsingh wordpress toolbarWordPress Toolbar <= 2.2.6 - Open Redirect6.1 Medium
- giovambattistafazioli wp social bookmark menuWP Social Bookmark Menu <= 1.2 - Settings Update via CSRF8.8 High
- biteship, unknown biteship: plugin ongkos kirim kurir instant, reguler, kargo +1 moreBiteship for WooCommerce < 2.2.25 - Reflected Cross-Site Scripting6.1 Medium
- totolink n200re, n200re firmware +1 moreTotolink N200RE cstecgi.cgi setLanguageCfg stack-based overflow7.2 High
- totolink n200re, n200re firmware +1 moreTotolink N200RE cstecgi.cgi setIpPortFilterRules stack-based overflow7.2 High
- se-elektronic gmbh e-ddc3.3, se-elektronic e-ddc3.3 firmware +1 moreRemote command execution vulnerability in SE-elektronic GmbH E-DDC3.39.8 Critical
- se-elektronic gmbh e-ddc3.3, se-elektronic e-ddc3.3 firmware +1 moreUncontrolled resource consumption vulnerability in SE-elektronic GmbH E-DDC3.36.2 Medium
- totolink n200re, n200re firmware +1 moreTotolink N200RE cstecgi.cgi main stack-based overflow7.2 High
- totolink n200re, n200re firmware +1 moreTotolink N200RE cstecgi.cgi setTracerouteCfg stack-based overflow7.2 High
- totolink n200re, n200re firmware +1 moreTotolink N200RE cstecgi.cgi setParentalRules stack-based overflow7.2 High
- totolink n200re, n200re firmware +1 moreTotolink N200RE cstecgi.cgi setDiagnosisCfg stack-based overflow7.2 High
- totolink n200re, n200re firmware +1 moreTotolink N200RE cstecgi.cgi setOpModeCfg stack-based overflow7.2 High
- apache kylinApache Kylin: Insufficiently protected credentials in config file7.5 High
- jan syski megabip, smodbip +1 moreStored XSS in SmodBIP and MegaBIP8.8 High
- otrsMissing file type check in avatar picture upload3.5 Low
- otrsUnnecessary data is written to log if issues during indexing occurs4.9 Medium
- otrsInsufficient access control5.3 Medium
- cloudflare, cloudflare cloudflare-wordpress +1 moreCloudflare WordPress plugin enables information disclosure of Cloudflare API (for low privileged users)8.1 High
- tenda i9, i9 firmware +1 moreTenda i9 httpd setcfm formSetCfm stack-based overflow7.2 High
- tenda w6, w6 firmware +1 moreTenda W6 httpd wifiSSIDset formwrlSSIDset stack-based overflow7.2 High
- tenda w6, w6 firmware +1 moreTenda W6 httpd setcfm formSetCfm stack-based overflow7.2 High
- tenda i6, i6 firmware +1 moreTenda i6 httpd WifiMacFilterGet formWifiMacFilterGet stack-based overflow7.2 High
- tenda i6, i6 firmware +1 moreTenda i6 httpd wifiSSIDset formwrlSSIDset stack-based overflow7.2 High
- tenda i6, i6 firmware +1 moreTenda i6 httpd setcfm formSetCfm stack-based overflow7.2 High
- tenda i6, i6 firmware +1 moreTenda i6 httpd setAutoPing formSetAutoPing stack-based overflow7.2 High
- kuerp project kuerpSichuan Yougou Technology KuERP Service.php del_sn_db path traversal5.4 Medium
- kuerp project kuerpSichuan Yougou Technology KuERP common.php checklogin improper authentication6.3 Medium
- kuerp project kuerpSichuan Yougou Technology KuERP log neutralization for logs6.3 Medium
- Show moreLoading…