CVEs published in November 2024
4,194 vulnerabilities, 370 critical, 16 exploited.
- combodo itopiTop hub connector Information disclosure5.8 Medium
- combodo itopCSRF security issue on CSV import in Combodo iTop8.8 High
- combodo itopCross-site Scripting vulnerability in link CSV import in Combodo iTop8.8 High
- combodo itopCross-site Scripting vulnerability on pages/ajax.render.php in Combodo iTop8.8 High
- combodo itopCross-site Scripting vulnerability on pages/ajax.searchform.php in Combodo iTop8.8 High
- combodo itopCross-site Scripting vulnerability in the run_query.php page in Combodo iTop8.8 High
- taoso webfeedWebFeed HTML injection vulnerabilities5.1 Medium
- ashlar-vellum cobalt[@imput/cobalt-web] Cross-site Scripting when downloading picker image from malicious instance6.0 Medium
- meshtastic firmwareFailure to check for packets from the broadcast address allows potential DDoS amplification attack in Meshtastic firmware5.3 Medium
- reactiveui refitCRLF injection in Refit's [Header], [HeaderCollection] and [Authorize] attributes10.0 Critical
- bearcove loonaPanic Vulnerability in loona-hpack5.1 Medium
- anisha university event management systemcode-projects University Event Management System doedit.php sql injection5.3 Medium
- zope accesscontrolUser data deletion by anoynmous users in Zope8.7 High
- golang-jwt jwtBad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt3.1 Low
- codezips hospital appointment systemCodezips Hospital Appointment System doctorAction.php sql injection6.9 Medium
- ibm websphere application serverIBM WebSphere Application Server XML external entity injection5.5 Medium
- campcodes online shopping portalPHPGurukul Online Shopping Portal two_tables.php cross site scripting5.3 Medium
- codezips free exam hall seating management systemCodezips Free Exam Hall Seating Management System save_user.php unrestricted upload5.3 Medium
- codezips online institute management systemCodezips Online Institute Management System profile.php unrestricted upload5.3 Medium
- codezips online institute management systemCodezips Online Institute Management System save_user.php unrestricted upload5.3 Medium
- ajay knowledge baseWordPress Knowledge Base plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- marcel pol elo rating shortcodeWordPress Elo Rating Shortcode plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- crestaproject cresta addons for elementorWordPress Cresta Addons for Elementor plugin <= 1.0.9 - Stored Cross Site Scripting (XSS) vulnerability6.5 Medium
- coderevolution wp pocket urlsWordPress WP Pocket URLs plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- hasthemes ht builder – wordpress theme builder for elementor, ht builder +1 moreWordPress HT Builder – WordPress Theme Builder for Elementor plugin <= 1.3.0 - Stored Cross Site Scripting (XSS) vulnerability6.5 Medium
- michael custom post type templates for elementorWordPress Custom post type templates for Elementor plugin <= 1.10.1 - Stored Cross Site Scripting (XSS) vulnerability6.5 Medium
- michael gangolf accordion title for elementorWordPress Accordion title for Elementor plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- chenyenming woocommerce quote calculatorWordPress Woocommerce Quote Calculator plugin <= 1.1 - SQL Injection vulnerability8.5 High
- wpdeveloper betterlinksWordPress BetterLinks plugin <= 2.1.7 - SQL Injection vulnerability7.6 High
- stacks mobile app builder, stacksmarket stacks mobile app builder +1 moreWordPress Stacks Mobile App Builder plugin <= 5.2.3 - Sensitive Data Exposure vulnerability7.5 High
- rainbow-link all post contact formWordPress All Post Contact Form plugin <= 1.8.2 - Arbitrary File Upload vulnerability10.0 Critical
- helloprintWordPress Helloprint plugin <= 2.0.4 - Arbitrary File Upload vulnerability10.0 Critical
- lindeni multi purpose mail formWordPress Multi Purpose Mail Form plugin <= 1.0.2 - Arbitrary File Upload vulnerability10.0 Critical
- stacks mobile app builder, stacksmarket stacks mobile app builder +1 moreWordPress Stacks Mobile App Builder plugin <= 5.2.3 - Arbitrary File Upload vulnerability10.0 Critical
- rudra innnovative software training – courses, rudra innovative software training courses, rudrainnovative training - courses +2 moreWordPress Training – Courses plugin <= 2.0.1 - Arbitrary File Upload vulnerability9.9 Critical
- myriad solutionz stars smtp mailerWordPress Stars SMTP Mailer plugin <= 2.2.1 - Arbitrary File Upload vulnerability9.9 Critical
- carrcommunications rsvpmaker, david f. carr rsvpmaker for toastmasters, davidfcarr rsvpmarker +2 moreWordPress RSVPMaker for Toastmasters plugin <= 6.2.4 - Arbitrary File Upload vulnerability10.0 Critical
- thimpress wp hotel bookingWordPress WP Hotel Booking plugin <= 2.2.9 - Local File Inclusion vulnerability7.5 High
- noor alam magical addons for elementorWordPress Magical Addons For Elementor plugin <= 1.2.1 - Server Side Request Forgery (SSRF) vulnerability4.9 Medium
- bna pospratikHTML Injection in Bna Informatics' PosPratik6.9 Medium
- 63moons aero, wave 2.0 +1 moreAuthentication bypass Vulnerability in Aero9.3 Critical
- 63moons wave 2.0, aero +1 moreImproper Error Handling Vulnerability in Wave 2.07.1 High
- 63moons wave 2.0, aero +1 moreImproper Access Control Vulnerability in Wave 2.07.1 High
- 63moons wave 2.0, aero +1 moreBrute Force Attack Vulnerability in Wave 2.09.3 Critical
- 63moons wave 2.0, aero +1 moreNo Rate Limiting Vulnerability in Wave 2.07.1 High
- 63moons wave 2.0, aero +1 moreSensitive Information Disclosure Vulnerability in Wave 2.07.1 High
- tp-link tapo h100 firmware, tapo h100 iot smart hub +1 moreInformation Disclosure Vulnerability in TP-Link IoT Smart Hub4.4 Medium
- bg-tek coslat, bg-tek informatics security technologies coslatv3, bg-tek coslatv3 firmware +2 moreCode Injection in BG-TEK's CoslatV39.2 Critical
- manageengine adaudit plus, zohocorp manageengine adaudit plus +1 moreSQL Injection8.3 High
- david lingren media library assistantWordPress Media Library Assistant plugin <= 3.19 - Remote Code Execution (RCE) vulnerability9.1 Critical
- Show moreLoading…