CVEs published in October 2024
3,640 vulnerabilities, 364 critical, 17 exploited.
- basercmsbaserCMS has a Cross-site Scripting (XSS) Vulnerability in Edit Email Form Settings Feature7.1 High
- basercmsbaserCMS has a Cross-site Scripting (XSS) Vulnerability in Blog posts Feature6.3 Medium
- basercmsbaserCMS has Cross-site Scripting Vulnerability in HTTP 400 Bad Request6.1 Medium
- basercmsbaserCMS has Cross-site Scripting Vulnerability in Blog posts and Contents list Feature5.4 Medium
- ininet solutions spidercontrol scada pc hmi editor, spidercontrol scada pc hmi editor +1 moreiniNet Solutions SpiderControl SCADA PC HMI Editor Path Traversal8.6 High
- ibm maximo application suite - monitor component, maximo application suite +1 moreIBM Maximo Application Suite - Monitor Component information disclosure5.9 Medium
- apple ipados, macos, safari +5 more +7 moreAn issue in the handling of URL protocols was addressed with improved logic. This issue is fixed...9.3 Critical
- apple ipados, macos, ios and ipados +1 more +3 moreA privacy issue was addressed with improved private data redaction for log entries. This issue is...5.5 Medium
- apple macosThe issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.6. A person...6.8 Medium
- apple macosAn out-of-bounds write issue was addressed with improved input validation. This issue is fixed in...5.5 Medium
- clothes recommendation system project recommendation system, sourcecodehero clothes recommendation system +1 moreSourceCodeHero Clothes Recommendation System Admin Login Page index.php sql injection6.9 Medium
- sadat garbage collection management systemSourceCodester Garbage Collection Management System login.php sql injection6.9 Medium
- vimesa vhf/fm transmitter blue plus, vhf\/fm transmitter blue plus +1 moreImproper Access Control in Input in VIMESA VHF/FM Transmitter Blue Plus6.9 Medium
- apache syncopeApache Syncope: Stored XSS in Console and Enduser6.1 Medium
- kraft plugins mega elementsWordPress Mega Elements – Addons for Elementor plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- spiffy plugins wp flow plusWordPress WP Flow Plus plugin <= 5.2.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- felipeelia contact form 7 – repeatable fields, contact form 7 repeatable fields +1 moreContact Form 7 - Repeatable Fields <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via field_group Shortcode6.4 Medium
- robosoft robo galleryWordPress Photo Gallery, Images, Slider in Rbs Image Gallery plugin <= 3.2.21 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- mycred elementor, saad iqbal mycred elementor +1 moreWordPress myCred Elementor plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- impronta jantoA Cross-Site Scripting vulnerability has been found in Janto v4.3r11 from Impronta. This...6.1 Medium
- magepeopleteam wpeventlyWordPress WpEvently plugin <= 4.2.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- activity-log.com wp sessions time monitoring full automaticWordPress WP Sessions Time Monitoring Full Automatic plugin <= 1.0.9 - SQL Injection vulnerability9.3 Critical
- wbw plugins product filter by wbwWordPress Product Filter by WBW plugin <= 2.7.0 - SQL Injection vulnerability7.6 High
pqcrypto-kybercrates.ioReplaced by `pqcrypto-mlkem`No scorepqcrypto-dilithiumcrates.ioReplaced by `pqcrypto-mldsa`No score- manageengine adaudit plus, zohocorp manageengine adaudit plus +1 moreSQL Injection8.3 High
- magazine3 schema & structured data for wp & ampWordPress Schema & Structured Data for WP & AMP plugin <= 1.3.5 - Sensitive Data Exposure vulnerability5.3 Medium
- simple-membership-plugin simple membershipWordPress Simple Membership plugin <= 4.5.3 - Open Redirection vulnerability4.7 Medium
- wpadminify wp adminify, litonice13 wp adminify – white label wordpress, admin menu editor, login customizer +1 moreWP Adminify – Best WordPress Custom Dashboard Plugin <= 4.0.1.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- edgarrojas extra product options builder for woocommerceExtra Product Options Builder for WooCommerce <= 1.2.133 - Unauthenticated Stored Cross-Site Scripting6.1 Medium
- mra13 compact wp audio playerCompact WP Audio Player <= 1.9.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via sc_embed_player Shortcode6.4 Medium
- bootstrapped wp recipe makerWP Recipe Maker <= 9.6.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'tooltip'6.5 Medium
- phpgurukul vehicle record systemPHPGurukul Vehicle Record System search-vehicle.php sql injection5.3 Medium
- gitlabAllocation of Resources Without Limits or Throttling in GitLab6.5 Medium
- gitlabImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab8.7 High
- dearhive dear flipbook – pdf flipbook, 3d flipbook, pdf embed, pdf viewerPDF Flipbook, 3D Flipbook, PDF embed, PDF viewer – DearFlip <= 2.3.32 - Reflected Cross-Site Scripting6.1 Medium
- brainstorm force ultimate addons for elementor, brainstormforce elementor header \& footer builder +1 moreElementor Header & Footer Builder <= 1.6.43 - Authenticated (Contributor+) Information Disclosure via Shortcode4.3 Medium
- lawo ag vsm ltc time sync (vtimesync), lawo vsm ltc timesync +1 moreUnauthenticated Path Traversal7.5 High
- multivendorx, wcmp multivendorx – woocommerce multivendor marketplace solutions +1 moreMultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.4 - Cross-Site Request Forgery to Vendor Updates6.3 Medium
- nlemsieh hurrytimer – an scarcity and urgency countdown timer for wordpress & woocommerceHurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce <= 2.10.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Publication4.3 Medium
- multivendorx, wcmp multivendorx – woocommerce multivendor marketplace solutions +1 moreMultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.4 - Missing Authorization to Forged Vendor Profile Deletion Email Sending4.3 Medium
- metagauss eventprime, eventprime – events calendar, bookings and tickets +1 moreEventPrime – Modern Events Calendar, Bookings and Tickets <= 4.0.4.7 - Unauthenticated Stored Cross-Site Scripting6.1 Medium
- metagauss eventprime, eventprime – events calendar, bookings and tickets +1 moreEventPrime – Modern Events Calendar, Bookings and Tickets <= 4.0.4.7 - Unauthenticated Stored Cross-Site Scripting via Transaction Log6.1 Medium
- vladimir statsenko terms descriptionsTerms descriptions <= 3.4.6 - Reflected Cross-Site Scripting6.1 Medium
libultrahdrOSS-FuzzHeap-buffer-overflow in convsampNo scoredistro-info-dataDebiandistro-info-data - security updateNo score- cloud smart lock firmwareThe APK file in Cloud Smart Lock v2.0.1 has a leaked a URL that can call an API for binding...9.3 Critical
- dreamcatcher iot technology life firmwareIncorrect access control in the firmware update and download processes of DreamCatcher Life v1.8...8.4 High
- shenzhen yingsheng technology co wear sync firmwareIncorrect access control in the firmware update and download processes of Wear Sync v1.2.0 allows...8.4 High
- ivyiot ivy smart firmwareIncorrect access control in the firmware update and download processes of IVY Smart v4.5.0 allows...8.4 High
- Show moreLoading…