CVEs published in September 2024
3,764 vulnerabilities, 306 critical, 13 exploited.
- uncanny owl groups for learndash, uncannyowl uncanny groups for learndash +1 moreUncanny Groups for LearnDash <= 6.1.0.1 - Authenticated (Group Leader+) Privilege Escalation7.2 High
- gutengeek free gutenberg blocks, wpopal gutengeek free gutenberg blocks for wordpress +1 moreGutenGeek Free Gutenberg Blocks for WordPress <= 1.1.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- realmag777 husky, husky – products filter professional for woocommerce, pluginus husky - products filter professional for woocommerce +2 moreHUSKY – Products Filter Professional for WooCommerce <= 1.3.6.1 - Insecure Direct Object Reference to Unsubscribe5.3 Medium
- javmah spreadsheet integration, wpgsi: spreadsheet integration +1 moreSpreadsheet Integration – Automate Google Sheets With WordPress, WooCommerce & Most Popular Form Plugins. Also, Display Google sheet as a Table. <= 3.8.0 - Missing Authorization to Authenticated (Subs…6.3 Medium
- themehunk mega menu, easy mega menu for wordpress – themehunk +1 moreEasy Mega Menu Plugin for WordPress – ThemeHunk <= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Settings Updates4.3 Medium
- jianbo rest api to miniprogram, rest-api-to-miniprogram +1 moreREST API TO MiniProgram <= 4.7.1 - Unauthenticated Arbitrary User Email Update and Privilege Escalation via Account Takeover9.8 Critical
- braginteractive material design iconsMaterial Design Icons <= 0.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via mdi-icon Shortcode6.4 Medium
- bastianonm wp gpx mapsWP GPX Maps <= 1.7.08 - Authenticated (Contributor+) Stored Cross-Site Scripting via sgpx Shortcode6.4 Medium
- mmrs151 daily prayer timeDaily Prayer Time <= 2024.08.26 - Authenticated (Contributor+) SQL Injection9.9 Critical
- farookibrahim mas static contentMAS Static Content <= 1.0.8 - Authenticated (Contributor+) Private Static Content Page Disclosure4.3 Medium
- jianbo rest api to miniprogram, rest-api-to-miniprogram +1 moreREST API TO MiniProgram <= 4.7.1 - Unauthenticated SQL Injection7.5 High
- wpplugin easy paypal events, scottpaterson easy paypal events & tickets +1 moreEasy PayPal Events <= 1.2.1 - Cross-Site Request Forgery to Arbitrary Post Deletion4.3 Medium
- pierre-lebedel kodex posts likesKodex Posts likes <= 2.5.0 - Reflected Cross-Site Scripting6.1 Medium
- themexclub oneelements, oneelements – best elementor addons, oneelements best elementor addons +2 moreOneElements – Best Elementor Addons <= 1.3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- it path solutions pvt ltd contact form to any apiContact Form to Any API <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting via Contact Form7.2 High
- besnikac graphicsly – the ultimate graphics plugin for wordpress website builder ( gutenberg, elementor, beaver builder, wpbakery ), graphicsly +1 moreGraphicsly – The ultimate graphics plugin for WordPress website builder ( Gutenberg, Elementor, Beaver Builder, WPBakery ) <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File U…6.4 Medium
- out the box beam me up scotty – back to top button, outtheboxthemes beam me up scotty +1 moreBeam me up Scotty – Back to Top Button <= 1.0.21 - Reflected Cross-Site Scripting6.1 Medium
- peepso community by peepso, peepso, peepso community by peepso – download from peepso.com +2 moreCommunity by PeepSo – Social Network, Membership, Registration, User Profiles <= 6.4.6.0 - Unauthenticated Full Path Disclosure5.3 Medium
- wpzoom shortcodesWPZOOM Shortcodes <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via box Shortcode6.4 Medium
- simplecalendar simple calendar – google calendar plugin, xtendify simple calendar +1 moreSimple Calendar – Google Calendar Plugin <= 3.4.2 - Reflected Cross-Site Scripting6.1 Medium
- minimus special text boxesSpecial Text Boxes <= 6.2.4 - Unauthenticated Arbitrary Shortcode Execution7.3 High
- codename065 premium packages – sell digital products securely, wpdownloadmanager premium packages - sell digital products securely +1 morePremium Packages – Sell Digital Products Securely <= 5.9.1 - Cross-Site Request Forgery4.3 Medium
- ellevoA reflected cross-site scripting (XSS) vulnerability in Ellevo 6.2.0.38160 allows attackers to...6.1 Medium
- timgreen dingfanzu cms, dingfangzu +1 moredingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via...4.7 Medium
- ferrislucas promptrRemote command execution in promptr8.8 High
- asg017 sqlite-vecHeap-based Buffer Overflow in sqlite-vec5.5 Medium
- dingfanzu cms, timgreen dingfanzu cms +1 moredingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin...6.3 Medium
- thegreenbow android vpn, vpn client linux, vpn client macos +2 more +4 moreAn issue in TheGreenBow Windows Standard VPN Client 6.87.108 (and older), Windows Enterprise VPN...7.3 High
- invesaliusDirectory Traversal vulnerability in Centro de Tecnologia da Informaco Renato Archer InVesalius3...7.5 High
- gigastone travel router r101 firmwareGigastone TR1 Travel Router R101 v1.0.2 is vulnerable to Command Injection. This allows an...8.0 High
- adacore ada web servicesAn issue was discovered in AdaCore ada_web_services 20.0 allows an attacker to escalate...7.5 High
- ihedvall mdf libraryLibrary MDF (mdflib) v2.1 is vulnerable to a heap-based buffer overread via a crafted mdf4 file...6.5 Medium
- openslidesOpenSlides 4.0.15 verifies passwords by comparing password hashes using a function with content...7.5 High
- openslidesOpenSlides 4.0.15 was discovered to be using a weak hashing algorithm to store passwords.7.5 High
- zkteco wdms, wdms pro +1 moreCross Site Scripting vulnerability in ZKTeco WDMS v.5.1.3 Pro allows a remote attacker to execute...5.4 Medium
- No product listedBTS is affected by information disclosure vulnerability where mobile network operator personnel...3.3 Low
- dover fueling solutions (dfs) progauge maglink lx console, doverfuelingsolutions maglink lx console, dover fueling solutions (dfs) progauge maglink lx4 console +3 more +5 moreDover Fueling Solutions ProGauge MAGLINK LX CONSOLE Command Injection10.0 Critical
- dover fueling solutions (dfs) progauge maglink lx console, doverfuelingsolutions maglink lx console, dover fueling solutions (dfs) progauge maglink lx4 console +3 more +5 moreDover Fueling Solutions ProGauge MAGLINK LX CONSOLE Command Injection10.0 Critical
- dover fueling solutions (dfs) progauge maglink lx console, progauge maglink lx4 console, doverfuelingsolutions maglink lx4 console +3 more +5 moreDover Fueling Solutions ProGauge MAGLINK LX CONSOLE Improper Privilege Management8.7 High
- dover fueling solutions (dfs) progauge maglink lx console, progauge maglink lx4 console, doverfuelingsolutions maglink lx4 console +3 more +5 moreDover Fueling Solutions ProGauge MAGLINK LX CONSOLE Use of Hard-coded Password9.3 Critical
- dover fueling solutions (dfs) progauge maglink lx console, doverfuelingsolutions maglink lx console, dover fueling solutions (dfs) progauge maglink lx4 console +3 more +5 moreDover Fueling Solutions ProGauge MAGLINK LX CONSOLE Authentication Bypass Using an Alternate Path or Channel9.3 Critical
- dover fueling solutions (dfs) progauge maglink lx console, doverfuelingsolutions maglink lx console, dover fueling solutions (dfs) progauge maglink lx4 console +3 more +5 moreDover Fueling Solutions ProGauge MAGLINK LX CONSOLE Cross-site Scripting8.7 High
- franklin fueling systems ts-550 evo, franklinfueling ts-550 evo firmware +1 moreFranklin Fueling Systems TS-550 EVO Absolute Path Traversal8.7 High
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS Stored XSS Vulnerability in Calendar Event Addition Feature4.6 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS Stored XSS in Image Editor Background Color5.1 Medium
- google chromeInteger overflow in Skia in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to...8.8 High
- google chromeType Confusion in V8 in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to perform...8.8 High
- google chromeInappropriate implementation in V8 in Google Chrome prior to 129.0.6668.70 allowed a remote...8.8 High
- google chromeUse after free in Dawn in Google Chrome on Windows prior to 129.0.6668.70 allowed a remote...8.8 High
- vmware spring frameworkSpring Framework DoS via conditional HTTP request5.3 Medium
- Show moreLoading…