CVEs published in April 2024
3,718 vulnerabilities, 293 critical, 10 exploited.
- cosmetics and beauty product online store project and beauty product online store, oretnom23 cosmetics and beauty product online store +1 moreA cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers...5.4 Medium
- insurance management system project management system, munyweki insurance management system +1 moreCross Site Scripting (XSS) in Insurance Management System v1.0, allows remote attackers to...6.1 Medium
- putty, tigris tortoisesvn, tortoisegit +3 more +5 moreIn PuTTY 0.68 through 0.80 before 0.81, biased ECDSA nonce generation allows an attacker to...5.9 Medium
- tenda ac15 firmwareA Stack Overflow vulnerability in Tenda AC15 v15.03.05.18 allows attackers to cause a denial of...6.5 Medium
- fireboltt dream firmwareAn issue in Fireboltt Dream Wristphone BSW202_FB_AAC_v2.0_20240110-20240110-1956 allows attackers...7.5 High
- jnt telecom liftcom umsAn issue in JNT Telecom JNT Liftcom UMS V1.J Core Version JM-V15 allows a remote attacker to...6.3 Medium
- mayurik petrol pump managementSQL Injection vulnerability in sourcecodester Petrol pump management software v1.0, allows remote...8.8 High
- mayurik php task management systemSQL Injection vulnerability in Sourcecodester php task management system v1.0, allows remote...9.8 Critical
- mayurik php task management system, task management system project management system +1 moreSQL Injection vulnerability in Sourcecodester php task management system v1.0, allows remote...9.8 Critical
- amazon aws amplify cli, aws amplify cli +1 moreAWS Amplify CLI has incorrect trust policy management9.8 Critical
- silex ds-600 firmwareAn issue discovered in silex technology DS-600 Firmware v.1.4.1 allows a remote attacker to cause...6.8 Medium
- silex ds-600 firmwareAn issue discovered in silex technology DS-600 Firmware v.1.4.1 allows a remote attacker to edit...9.1 Critical
- silex ds-600 firmwareAn issue discovered in silex technology DS-600 Firmware v.1.4.1 allows a remote attacker to...7.5 High
- 360totalsecurity 360 total security, antivirus +1 moreAn issue discovered in 360 Total Security Antivirus through 11.0.0.1061 for Windows allows...8.8 High
- macs cms project cms, macrob7 macs framework content management system project macs framework content management system +1 moreSQL Injection vulnerability in Macrob7 Macs CMS 1.1.4f, allows remote attackers to execute...5.3 Medium
- hikvision ds-d5b86rb\/b firmwareInsecure default configurations in Hikvision Interactive Tablet DS-D5B86RB/B V2.3.0 build220119,...7.8 High
- codologic codoforumStored Cross-Site Scripting (XSS) vulnerability in Codoforum v4.9, allows attackers to execute...5.4 Medium
- codoforumAn arbitrary file upload vulnerability in the Add Category function of Codoforum v4.9 allows...7.2 High
- cs technologies australia evolution controller, cs-technologies evolution +1 moreDefault credentials on web interface of Evolution Controller Versions allows attackers to login and perform administrative functions9.8 Critical
- cs technologies australia evolution controller, cs-technologies evolution +1 moreBroken Access control on MOBILE_GET_USERS_LIST in Evolution Controller allows unauthenticated user enumeration7.5 High
- cs technologies australia evolution controller, cs-technologies evolution +1 moreBroken Access control on DESKTOP_EDIT_USER_GET_ABACARD_FIELDS in Evolution Controller allows unauthenticated attackers to retrieve ABACARD values7.5 High
- cs technologies australia evolution controller, cs-technologies evolution +1 moreBroken Access control on DESKTOP_EDIT_USER_GET_KEYS_FIELDS in Evolution Controller allows unauthenticated attackers to retrieve keys values7.5 High
- cs technologies australia evolution controller, cs-technologies evolution +1 moreBroken Access control on DESKTOP_EDIT_USER_GET_PIN_FIELDS in Evolution Controller allows unauthenticated attackers to retrieve PIN field values7.5 High
- cs technologies australia evolution controller, cs-technologies evolution +1 moreBroken Access control on DESKTOP_EDIT_USER_GET_CARD in Evolution Controller allows unauthenticated attackers to retrieve card data values.7.5 High
- cs technologies australia evolution controller, cs-technologies evolution +1 moreUnsanitised variable on DAL_ADD in Evolution Controller causes application level denial of service and crash7.5 High
- cs technologies australia evolution controller, cs-technologies evolution +1 morePoor session management in Evolution Controller allows administrator functionality for unauthenticated connections8.8 High
- cs technologies australia evolution controller, cs-technologies evolution +1 moreBroken Authentication on USER_CHANGE in Evolution Controller allows unauthenticated account creation and takeover9.8 Critical
- slowlyo owladminslowlyo OwlAdmin Image File Upload upload_image cross site scripting2.4 Low
- xiongmai ahb7004t-gs-v3, ahb7004t-mhv2, ahb7804r-mh-v2 +11 more +13 moreXiongmai AHB7804R-MH-V2 Sofia Service access control9.8 Critical
- redwoodjs sdkTuya SDK MQTT Packet denial of service2.7 Low
- emlog, emlog pro project pro +1 moreEmlog Pro Post Tag tag.php cross site scripting2.4 Low
- emlog, emlog pro project pro +1 moreEmlog Pro Whisper Page twitter.php cross site scripting2.4 Low
- cym1102 nginxwebuicym1102 nginxWebUI reload exec deserialization6.3 Medium
- cym1102 nginxwebuicym1102 nginxWebUI upload os command injection6.3 Medium
- cym1102 nginxwebui, nginxui nginx ui +1 morecym1102 nginxWebUI saveCmd handlePath certificate validation7.3 High
- cym1102 nginxwebuicym1102 nginxWebUI addOver findCountByQuery path traversal6.3 Medium
- cym1102 nginxwebuicym1102 nginxWebUI upload unrestricted upload4.3 Medium
- smartofficepayroll smartofficeSmart Office Main.aspx weak password6.3 Medium
- tbk dvr-4104, dvr-4216, tbkvision tbk-dvr4104 +1 more +3 moreTBK DVR-4104/DVR-4216 os command injection6.3 Medium
- byron gitoxidegix-transport indirect code execution via malicious username6.4 Medium
- tianwell fire intelligent command platformTianwell Fire Intelligent Command Platform API Interface page sql injection6.3 Medium
- debian linux, linux kernel +1 moreamdkfd: use calloc instead of kzalloc to avoid integer overflow5.5 Medium
- campcodes house rental management systemCampcodes House Rental Management System ajax.php sql injection6.3 Medium
- wpzoom social feed widget & blockWPZOOM Social Feed Widget & Block <= 2.1.13 - Missing Authorization to Authenticated (Subscriber+) Instagram Image Deletion4.3 Medium
- wpclever wpc smart quick view for woocommerceWPC Smart Quick View for WooCommerce <= 4.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4 Medium
- getshortcodes shortcodes ultimate, gn themes wp shortcodes plugin — shortcodes ultimate +1 moreShortcodes Ultimate < 7.0.5 - Contributor+ Stored XSS5.4 Medium
- nextendweb smart slider 3Smart Slider 3 <= 3.5.1.22 - Missing Authorization to Limited File Upload6.4 Medium
- givewp, stellarwp givewp – donation plugin and fundraising platform +1 moreGiveWP – Donation Plugin and Fundraising Platform <= 3.6.1 -- Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
tarantoolOSS-FuzzUNKNOWN READNo score- greenwoodsoftware less, debian linux, netapp bootstrap os +2 more +4 moreless through 653 allows OS command execution via a newline character in the name of a file,...8.6 High
- Show moreLoading…