CVEs published in February 2024
2,905 vulnerabilities, 342 critical, 12 exploited.
- huaxiaerp jsherpjshERP v3.3 is vulnerable to Arbitrary File Upload. The jshERP-boot/systemConfig/upload interface...9.8 Critical
- dlink go-rt-ac750 firmwareD-LINK Go-RT-AC750 GORTAC750_A1_FW_v101b03 has a hardcoded password for the Alphanetworks account...9.8 Critical
- dlink go-rt-ac750 firmwareD-Link Go-RT-AC750 GORTAC750_A1_FW_v101b03 contains a stack-based buffer overflow via the...9.8 Critical
- intelbras action rf 1200 firmwareIntelbras Roteador ACtion RF 1200 1.2.2 esposes the Password in Cookie resulting in Login Bypass.8.1 High
- dronetag drone scannerAn issue discovered in Dronetag Drone Scanner 1.5.2 allows attackers to impersonate other drones...8.2 High
- sorenfriis opendroneid osmAn issue discovered in OpenDroneID OSM 3.5.1 allows attackers to impersonate other drones via...8.2 High
- ispyconnect agent dvrUnrestricted File Upload vulnerability in iSpyConnect.com Agent DVR 5.1.6.0 allows attackers to...8.8 High
- ispyconnect agent dvr, ispy +1 moreAn issue discovered in iSpyConnect.com Agent DVR 5.1.6.0 allows attackers to run arbitrary files...8.8 High
- magicsoftware magic xpi integration platformThe XML parser in Magic xpi Integration Platform 4.13.4 allows XXE attacks, e.g., via onItemImport.6.5 Medium
- binhdrm26 super rebootThe Android application BINHDRM26 com.bdrm.superreboot 1.0.3, exposes several critical actions...7.8 High
- binhdrm26 super rebootAn issue in the PowerOffWidgetReceiver function of Super Reboot (Root) Recovery v1.0.3 allows...7.8 High
- imoulife imou goAn issue in the com.oneed.dvr.service.DownloadFirmwareService component of IMOU GO v1.0.11 allows...8.8 High
- ncr terminal handlerAn issue in NCR Terminal Handler v.1.5.1 allows a remote attacker to execute arbitrary code via a...6.5 Medium
- hardy-barth cph2 echarge, cph2 echarge firmware +1 moreHardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier is vulnerable to Execution with...8.8 High
- hardy-barth cph2 echarge firmwareAn OS command injection vulnerability in Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier...9.8 Critical
- pyloadpyLoad open redirect vulnerability due to improper validation of the is_safe_url function4.7 Medium
- gradio app gradio, gradio-app gradio-app/gradio +1 moreLFI in Gradio7.5 High
- spring security, vmware spring security +1 moreSpring Security's spring-security.xsd file is world writable4.1 Medium
- file manager pro, filemanagerpro file manager, ninja team file manager pro +2 moreFile Manager Pro <= 8.3.4 - Authenticated (Subscriber+) Arbitrary File Upload8.8 High
- generatepress, generatepress premium +1 moreGeneratePress Premium <= 2.3.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Custom Meta6.4 Medium
- sandisk ibi, western digital my cloud os 5, my cloud home & duo +12 more +14 moreUncontrolled resource consumption vulnerability in Western Digital My Cloud, My Cloud Home and SanDisk ibi products4.9 Medium
- sandisk ibi, western digital my cloud os 5, my cloud home & duo +13 more +15 moreServer-side Request Forgery vulnerability in Western Digital My Cloud, My Cloud Home and SanDisk ibi products5.5 Medium
- stellarwp the events calendarThe Events Calendar <= 6.2.8.2 - Unauthenticated Sensitive Information Exposure5.3 Medium
- reputeinfosystems armember, arforms, armember – membership plugin, content restriction, member levels, user profile & user signup +2 moreARMember <= 4.0.24 - Improper Access Control to Sensitive Information Exposure via REST API5.3 Medium
- themeisle orbit fox, orbit fox: duplicate page, menu icons, svg support, cookie notice, custom fonts & more +1 moreOrbit Fox by ThemeIsle <= 2.10.27 - Authenticated(Contributor+) Stored Cross-site Scripting via Pricing Table Elementor Widget6.4 Medium
- userproplugin userproUserPro <= 5.1.6 - Disabled Membership Registration Bypass5.3 Medium
- advancedcustomfields advanced custom fields, delicious brains advanced custom fields pro, wpengine advanced custom fields (acf®) +2 moreAdvanced Custom Fields <= 6.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field6.4 Medium
- sigmaplugin advanced database cleaner, symptote advanced database cleaner – optimize & clean database to speed up site performance +1 moreAdvanced Database Cleaner <= 3.1.3 - Authenticated(Administrator+) PHP Object Injection via process_bulk_action6.6 Medium
- aman086 views for wpforms – display & edit wpforms entries on your site frontend, formviewswp views for wpforms +1 moreViews for WPForms <= 3.2.2 - Cross-Site Request Forgery via save_view4.3 Medium
- josevega display custom fields in the frontend – post and user profile fields, vegacorp display custom fields in the frontend - post and user profile fields +1 moreDisplay custom fields in the frontend – Post and User Profile Fields <= 1.2.1 - Authenticated (Contributor+) Code Injection8.8 High
- jetmonsters getwid – gutenberg blocks, motopress getwid +1 moreGetwid – Gutenberg Blocks <= 2.0.4 - Captcha Bypass5.3 Medium
- kobzarev index now, properfraction crawlwp seo – instant search engine indexing & seo performance monitor +1 moreIndex Now <= 2.6.3 - Cross-Site Request Forgery via reset_form7.1 High
- cifi starbox – the author box for humans, squirrly starbox +1 moreStarbox – the Author Box for Humans <= 3.4.7 - Insecure Direct Object Reference4.3 Medium
- wpdeveloper essential addons for elementor, wpdevteam essential addons for elementor – popular elementor templates & widgets +1 moreEssential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.4 - Authenticated (Contributor+) Stored Cross-Site Scritping6.4 Medium
- maxfoundry maxbuttons, maxbuttons – create buttons +1 moreWordPress Button Plugin MaxButtons <= 9.7.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode6.4 Medium
- strategy11 formidable forms, strategy11team formidable forms – contact form plugin, survey, quiz, payment, calculator form & custom form builder +1 moreFormidable Forms <= 6.7.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- wpvivid migration\, backup\, staging, wpvividplugins wpvivid — backup, migration & staging +1 moreWPvivid <= 0.9.94 - Missing Authorization4.3 Medium
- cool plugins cryptocurrency widgets – price ticker & coins list, coolplugins cryptocurrency widgets +1 moreThe Cryptocurrency Widgets – Price Ticker & Coins List plugin for WordPress is vulnerable to SQL...9.8 Critical
- wpmanageninja pdf generator for fluent forms, fluent pdf generator +1 morePDF Generator For Fluent Forms <= 1.1.7 - Cross-Site Scripting4.9 Medium
- learndash, stellarwp learndash lms +1 moreLearnDash LMS <= 4.10.2 - Sensitive Information Exposure via API5.3 Medium
- contentviewspro content views, pt-guy content views – post grid & filter, recent posts, category posts … (shortcode, gutenberg blocks, and widgets for elementor) +1 moreContent Views <= 3.6.2 - Authenticated(Administrator+) Stored Cross-Site Scripting via settings4.4 Medium
- ameliabooking booking for appointments and events calendar – amelia, tms-outsource amelia +1 moreBooking for Appointments and Events Calendar – Amelia <= 1.0.93 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode6.4 Medium
- aman086 views for wpforms – display & edit wpforms entries on your site frontend, formviewswp views for wpforms +1 moreViews for WPForms <= 3.2.2 - Missing Authorization via create_view4.3 Medium
- richplugins plugin for google reviews, rich showcase for google reviews +1 morePlugin for Google Reviews <= 3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode6.4 Medium
- cifi seo plugin by squirrly seo, seo squirrly plugin by squirrly seo +1 moreSEO Plugin by Squirrly SEO <= 12.3.15 - Authenticated(Administrator+) Stored Cross-Site Scripting via plugin settings4.4 Medium
- unitecms unlimited addons for wpbakery page builderUnlimited Addons for WPBakery Page Builder <= 1.0.42 - Authenticated (Editor+) Arbitrary File Upload7.2 High
- themeisle rss aggregator by feedzy – feed to post, autoblogging, news & youtube video feeds aggregator, rss aggregator by feedzy +1 moreRSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.4.1 - Missing Authorization4.3 Medium
- wprssaggregator wp rss aggregator, rebelcode rss aggregator – rss import, news feeds, feed to post, and autoblogging +1 moreWP RSS Aggregator <= 4.23.4 - Authenticated (Admin+) Stored Cross-Site Scripting via RSS Feed Source4.4 Medium
- wpengine better search replaceBetter Search Replace <= 1.4.4 - Unauthenticated PHP Object Injection8.8 High
- wpdeveloper essential addons for elementor, wpdevteam essential addons for elementor – popular elementor templates & widgets +1 moreEssential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- Show moreLoading…