CVEs published in May 2024
5,284 vulnerabilities, 411 critical, 14 exploited.
- emarketdesign youtube video gallery, emarket-design video gallery – youtube gallery & responsive video playlist +1 moreYouTube Video Gallery by YouTube Showcase – Video Gallery Plugin for WordPress <= 3.3.6 - Missing Authorization to Arbitrary Post/Page Creation5.3 Medium
- elementor website builder, elemntor elementor website builder – more than just a page builder +1 moreElementor Website Builder – More than Just a Page Builder <= 3.21.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting6.4 Medium
- gpriday page builder by siteorigin, siteorigin page builder +1 morePage Builder by SiteOrigin <= 2.29.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'siteorigin_widget' Shortcode6.4 Medium
- hasthemes ht mega, devitemsllc ht mega addons for elementor – elementor widgets & template builder +1 moreHT Mega – Absolute Addons For Elementor <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- zkteco facedepot 7b, smartec st fr041me, smartec st fr043 +1 more +3 moreMultiple arbitrary file writes in ZkTeco-based OEM devices10.0 Critical
- zkteco facedepot 7b, smartec st fr041me, smartec st fr043 +1 more +3 moreMultiple arbitrary file reads in ZkTeco-based OEM devices7.5 High
- tecno com.transsion.videocallenhancerImproper permission control in com.transsion.videocallenhancer7.5 High
- zkteco facedepot 7b, smartec st fr041me, smartec st fr043 +1 more +3 moreMultiple command injection in ZkTeco-based OEM devices10.0 Critical
- zkteco facedepot 7b, smartec st fr041me, smartec st fr043 +1 more +3 moreBypassing ZkTeco-based OEM devices/ZKTeco biometric authentication system via SQLi in QR code4.6 Medium
- moveaddons move addons for elementorMove Addons for Elementor <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets6.4 Medium
- getshortcodes shortcodes ultimate, gn themes wp shortcodes plugin — shortcodes ultimate +1 moreWP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_members Shortcode6.4 Medium
- dotcamp wp table builder, wptb wp table builder – drag & drop table builder +1 moreWP Table Builder – WordPress Table Plugin <= 1.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- hasthemes shoplentor, devitemsllc shoplentor – all-in-one woocommerce growth & store enhancement plugin +1 moreShopLentor <= 2.8.8 - Missing Authorization to WordPress Option Modification7.1 High
- hasthemes shoplentor, devitemsllc shoplentor – all-in-one woocommerce growth & store enhancement plugin +1 moreShopLentor <= 2.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via woolentorsearch Shortcode6.4 Medium
- hasthemes ht mega, devitemsllc ht mega addons for elementor – elementor widgets & template builder +1 moreHT Mega – Absolute Addons For Elementor <= 2.5.2 - Missing Authorization to Options Update4.3 Medium
- salonbookingsystem salon booking system, wordpresschef salon booking system – free version +1 moreSalon booking system <= 9.9 - Unauthenticated Arbitrary File Deletion9.1 Critical
- averta master slider – responsive touch slider, master slider +1 moreMaster Slider – Responsive Touch Slider <= 3.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- sevenspark ubermenuUber Menu <= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes6.4 Medium
- majeedraza carousel sliderCarousel Slider < 2.2.11 - Editor+ Stored XSS5.4 Medium
- jontasc sailthru triggermailSailthru Triggermail <= 1.1 - Admin+ Stored XSS7.1 High
- jontasc sailthru triggermailSailthru Triggermail <= 1.1 - Reflected XSS6.1 Medium
- ays pro survey makerSurvey Maker < 4.2.9 - Admin+ Stored XSS via Plugin Settings4.8 Medium
- unknown social icons widget & block by wpzoom, wpzoom social icons widget +1 moreSocial Icons Widget & Block < 4.2.18 - Admin+ Stored XSS6.1 Medium
- creativethemes blocksyBlocksy <= 2.0.46 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- pickplugins post grid, post grid combo +1 morePost Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks <= 2.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- zyxel dx3300-t1 firmware, ax7501-b0 firmware, ax7501-b1 firmware +62 more +64 moreThe buffer overflow vulnerability in the DX3300-T1 firmware version V5.50(ABVY.4)C0 could allow...5.5 Medium
- zyxel vmg3625-t50b firmware, ax7501-b0 firmware, ax7501-b1 firmware +30 more +32 moreThe buffer overflow vulnerability in the CGI program of the VMG3625-T50B firmware version V5.50...6.5 Medium
pymysqlPyPI,python3.11-PyMySQLAlmaLinux,python3.11-PyMySQL+rsaAlmaLinux +4 more +6 morePyMySQL SQL Injection vulnerability6.3 Medium- nasa ait-core, ait core +1 moreNASA AIT-Core uses unencrypted channels to exchange data over the network7.3 High
- nasa ait-core, ait core +1 moreAn issue in the YAML Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary...7.5 High
- nasa ait-core, ait core +1 moreNASA AIT-Core vulnerable to remote code execution7.5 High
- nasa ait-core, ait core +1 moreNASA AIT-Core vulnerable to remote code execution7.5 High
- nasa ait-core, ait core +1 moreNASA AIT-Core vulnerable to remote code execution7.5 High
- nasa ait-core, ait core +1 moreNASA AIT-Core vulnerable to SQL Injection9.8 Critical
- itsourcecode vehicle management systemSourceCodester Vehicle Management System HTTP POST Request newdriver.php unrestricted upload5.3 Medium
- requarks wiki, wiki.js +1 moreWiki.js Stored XSS through Client Side Template Injection7.1 High
github.com/bincyber/go-sqlcrypterGogithub.com/bincyber/go-sqlcrypter vulnerable to IV collision3.7 Lowgithub.com/cosmos/ibc-goGo,github.com/cosmos/ibc-go/v2Go,github.com/cosmos/ibc-go/v3Go +4 more +6 moregithub.com/cosmos/ibc-go affected by IBC protocol "Huckleberry" vulnerabilityNo score- github enterprise serverAn authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when...10.0 Critical
- mindersec minderStacklok Minder vulnerable to denial of service from maliciously crafted templates5.3 Medium
- aquasecurity trivyTrivy possibly leaks registry credential when scanning images from malicious registries5.5 Medium
- keepassxcKeePassXC 2.7.7 allows attackers to recover cleartext credentials.6.5 Medium
- verbb formieverbb/formie Server-Side Template Injection for variable-enabled settings4.4 Medium
- keepassxcIssue in KeePassXC 2.7.7 allows an attacker to recover some passwords stored in the .kdbx database.6.5 Medium
- psf requests, request project request +1 moreRequests `Session` object does not verify requests after making first request with verify=False5.6 Medium
- solarwinds platformSolarWinds Platform Reflected XSS Vulnerability7.9 High
robrichards/xmlseclibsPackagistrobrichards/xmlseclibs XPath injection7.5 High- manageengine adaudit plus, zohocorp manageengine adaudit plus +1 moreZoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection while getting file server...8.3 High
- manageengine adaudit plus, zohocorp manageengine adaudit plus +1 moreZoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while exporting a full...8.3 High
- manageengine adaudit plus, zohocorp manageengine adaudit plus +1 moreZoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection in the dashboard graph...8.3 High
- Show moreLoading…