Total
277464 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-47294 | 1 Huawei | 2 Emui, Harmonyos | 2024-10-01 | 4.4 Medium |
| Access permission verification vulnerability in the input method framework module Impact: Successful exploitation of this vulnerability may affect availability. | ||||
| CVE-2024-47293 | 1 Huawei | 2 Emui, Harmonyos | 2024-10-01 | 4.7 Medium |
| Out-of-bounds write vulnerability in the HAL-WIFI module Impact: Successful exploitation of this vulnerability may affect availability. | ||||
| CVE-2024-47292 | 1 Huawei | 2 Emui, Harmonyos | 2024-10-01 | 6.2 Medium |
| Path traversal vulnerability in the Bluetooth module Impact: Successful exploitation of this vulnerability may affect service confidentiality. | ||||
| CVE-2024-47291 | 1 Huawei | 2 Emui, Harmonyos | 2024-10-01 | 5.6 Medium |
| Permission vulnerability in the ActivityManagerService (AMS) module Impact: Successful exploitation of this vulnerability may affect availability. | ||||
| CVE-2024-47290 | 1 Huawei | 2 Emui, Harmonyos | 2024-10-01 | 5.5 Medium |
| Input validation vulnerability in the USB service module Impact: Successful exploitation of this vulnerability may affect availability. | ||||
| CVE-2024-8633 | 1 10web | 1 Form Maker | 2024-10-01 | 5.5 Medium |
| The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.15.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2024-8725 | 2 Advancedfilemanager, Modalweb | 2 Advanced File Manager, Advanced File Manager | 2024-10-01 | 6.8 Medium |
| Multiple plugins and/or themes for WordPress are vulnerable to Limited File Upload in various versions. This is due to a lack of proper checks to ensure lower-privileged roles cannot upload .css and .js files to arbitrary directories. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an administrator, to upload .css and .js files to any directory within the WordPress root directory, which could lead to Stored Cross-Site Scripting. The Advanced File Manager Shortcodes plugin must be installed to exploit this vulnerability. | ||||
| CVE-2024-8704 | 2 Advancedfilemanager, Modalweb | 2 Advanced File Manager, Advanced File Manager | 2024-10-01 | 7.2 High |
| The Advanced File Manager plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and including, 5.2.8 via the 'fma_locale' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. | ||||
| CVE-2024-46839 | 2024-10-01 | 5.5 Medium | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2024-8126 | 2 Advancedfilemanager, Modalweb | 2 Advanced File Manager, Advanced File Manager | 2024-10-01 | 7.5 High |
| The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads via the 'class_fma_connector.php' file in all versions up to, and including, 5.2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an Administrator, to upload a new .htaccess file allowing them to subsequently upload arbitrary files on the affected site's server which may make remote code execution possible. | ||||
| CVE-2024-9173 | 1 Alefypimentel | 1 Gf Custom Style | 2024-10-01 | 6.4 Medium |
| The GF Custom Style plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. | ||||
| CVE-2024-9127 | 1 Codecabin | 1 Super Testimonials | 2024-10-01 | 6.4 Medium |
| The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘alignment’ parameter in all versions up to, and including, 3.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2024-9125 | 1 Kingblack | 1 King Ie | 2024-10-01 | 6.4 Medium |
| The king_IE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. | ||||
| CVE-2024-9117 | 1 Mapplic | 1 Mapplic | 2024-10-01 | 6.4 Medium |
| The Mapplic Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. | ||||
| CVE-2024-9115 | 1 Chetanvaghela | 1 Common Tools For Site | 2024-10-01 | 6.4 Medium |
| The Common Tools for Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. | ||||
| CVE-2022-4541 | 2 Nitinmaurya, Nitinmaurya12 | 2 Wordpress Visitors, Wordpress Visitors | 2024-10-01 | 7.2 High |
| The WordPress Visitors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a spoofed HTTP Header value in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the nm_vistior page. | ||||
| CVE-2024-9025 | 2 Codesupply, Codesupplyco | 2 Sight, Sight Professional Image Gallery And Portfolio | 2024-10-01 | 5.3 Medium |
| The Sight – Professional Image Gallery and Portfolio plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handler_post_title' function in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to expose private, pending, trashed, and draft post titles. Successful exploitation requires the Elementor plugin to be installed and activated. | ||||
| CVE-2024-8872 | 1 Bizswoop | 1 Store Hours For Woocommerce | 2024-10-01 | 6.1 Medium |
| The Store Hours for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 4.3.20. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. | ||||
| CVE-2024-8861 | 1 Metagauss | 1 Profilegrid | 2024-10-01 | 6.4 Medium |
| The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.9.3.2 due to incorrect use of the wp_kses_allowed_html function, which allows the 'onclick' attribute for certain HTML elements without sufficient restriction or context validation. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2024-9297 | 1 Oretnom23 | 1 Railway Reservation System | 2024-10-01 | 6.3 Medium |
| A vulnerability was found in SourceCodester Online Railway Reservation System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/. The manipulation of the argument page with the input trains/schedules/system_info leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. | ||||