[CVE_SUBSCRIPTIONS]

Receive alerts for specific vendors, products, or severities
📡 [FLUX RSS CVE]

Subscribe to the CVE feed

7 derniers jours

> FILTERS

> Last 7 Days

STATISTIQUES

Total CVE: 425077
> CVE-2024-33576 [MEDIUM 6.5]
[PUBLISHED: 2024-05-06] [EPSS 0.49%]
Missing Authorization vulnerability in Ollybach WPPizza.This issue affects WPPizza: from n/a through 3.18.10.
> CVE-2024-33570 [MEDIUM 4.3]
[PUBLISHED: 2024-05-06] [EPSS 0.44%]
Missing Authorization vulnerability in Wpmet Metform Elementor Contact Form Builder.This issue affects Metform Elementor Contact Form Builder: from n/a through 3.8.3.
AFFECTED_PRODUCTS: Wpmet Metform Elementor Contact Form Builder
> CVE-2024-33121 [MEDIUM 6.3]
[PUBLISHED: 2024-05-06] [EPSS 0.33%]
Roothub v2.6 was discovered to contain a SQL injection vulnerability via the 's' parameter in the search() function.
AFFECTED_PRODUCTS: Roothub Roothub
> CVE-2024-33118 [HIGH 7.5]
[PUBLISHED: 2024-05-06] [EPSS 0.25%]
LuckyFrameWeb v3.5.2 was discovered to contain an arbitrary read vulnerability via the fileDownload method in class com.luckyframe.project.common.CommonController.
AFFECTED_PRODUCTS: Luckyframe Luckyframeweb
> CVE-2024-33117 [MEDIUM 5.3]
[PUBLISHED: 2024-05-06] [EPSS 0.47%]
crmeb_java v1.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the mergeList method in class com.zbkj.front.pub.ImageMergeController.
AFFECTED_PRODUCTS: Crmeb Crmeb Java
> CVE-2024-3661 [HIGH 7.6]
[PUBLISHED: 2024-05-06] [EPSS 4.06%]
DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify net...
AFFECTED_PRODUCTS: F5 Big Ip Access Policy Manager, F5 Big Ip Access Policy Manager, F5 Big Ip Access Policy Manager ... (+13)
> CVE-2024-34412 [HIGH 8.5]
[PUBLISHED: 2024-05-06] [EPSS 0.52%]
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Parcel Panel ParcelPanel.This issue affects ParcelPanel: from n/a through 3.8.1.
> CVE-2024-34390 [MEDIUM 6.5]
[PUBLISHED: 2024-05-06] [EPSS 0.33%]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AddonMaster Post Grid Master allows Stored XSS.This issue affects Post Grid Master: from n/a through 3.4.8.
AFFECTED_PRODUCTS: Addonmaster Post Grid Master
> CVE-2024-34389 [MEDIUM 4.3]
[PUBLISHED: 2024-05-06] [EPSS 0.36%]
Missing Authorization vulnerability in AF themes WP Post Author.This issue affects WP Post Author: from n/a through 3.6.4.
AFFECTED_PRODUCTS: Afthemes Wp Post Author
> CVE-2024-34387 [MEDIUM 4.3]
[PUBLISHED: 2024-05-06] [EPSS 0.36%]
Missing Authorization vulnerability in AF themes WP Post Author.This issue affects WP Post Author: from n/a through 3.6.4.
AFFECTED_PRODUCTS: Afthemes Wp Post Author
> CVE-2024-34386 [HIGH 7.6]
[PUBLISHED: 2024-05-06] [EPSS 0.52%]
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Lucian Apostol Auto Affiliate Links.This issue affects Auto Affiliate Links: from n/a through 6.4.3.1.
> CVE-2024-34381 [MEDIUM 6.5]
[PUBLISHED: 2024-05-06] [EPSS 0.33%]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PropertyHive allows Stored XSS.This issue affects PropertyHive: from n/a through 2.0.10.
AFFECTED_PRODUCTS: Wp-Property-Hive Propertyhive
> CVE-2024-34380 [MEDIUM 5.9]
[PUBLISHED: 2024-05-06] [EPSS 0.35%]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud Conversational Forms for ChatBot allows Stored XSS.This issue affects Conversational Forms for ChatBot: from n/a through 1.2.0.
> CVE-2024-34379 [MEDIUM 4.3]
[PUBLISHED: 2024-05-06] [EPSS 0.21%]
Cross-Site Request Forgery (CSRF) vulnerability in Rara Theme Restaurant and Cafe.This issue affects Restaurant and Cafe: from n/a through 1.2.1.
> CVE-2024-34378 [HIGH 8.6]
[PUBLISHED: 2024-05-06] [EPSS 0.43%]
Missing Authorization vulnerability in LeadConnector.This issue affects LeadConnector: from n/a through 1.7.
> CVE-2024-34377 [MEDIUM 4.3]
[PUBLISHED: 2024-05-06] [EPSS 0.39%]
Missing Authorization vulnerability in A WP Life Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery.This issue affects Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery: from n/a through 1.5.3.
> CVE-2024-34376 [MEDIUM 6.5]
[PUBLISHED: 2024-05-06] [EPSS 0.33%]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Theme Freesia Edge allows Stored XSS.This issue affects Edge: from n/a through 2.0.9.
> CVE-2024-34375 [MEDIUM 5.9]
[PUBLISHED: 2024-05-06] [EPSS 0.36%]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPPOOL Sheets To WP Table Live Sync allows Stored XSS.This issue affects Sheets To WP Table Live Sync: from n/a through 3.7.0.
> CVE-2024-34374 [MEDIUM 6.5]
[PUBLISHED: 2024-05-06] [EPSS 0.34%]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuomodoSoft ElementsReady Addons for Elementor allows Stored XSS.This issue affects ElementsReady Addons for Elementor: from n/a through 5.8.0.
AFFECTED_PRODUCTS: Quomodosoft Elementsready
> CVE-2024-34373 [MEDIUM 6.5]
[PUBLISHED: 2024-05-06] [EPSS 0.31%]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite allows Stored XSS.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through 5.4.2.
AFFECTED_PRODUCTS: Posimyth The Plus Addons For Elementor
> CVE-2024-34372 [MEDIUM 5.3]
[PUBLISHED: 2024-05-06] [EPSS 0.45%]
Missing Authorization vulnerability in AddonMaster Post Grid Master.This issue affects Post Grid Master: from n/a through 3.4.7.
AFFECTED_PRODUCTS: Addonmaster Post Grid Master
> CVE-2024-34371 [MEDIUM 4.3]
[PUBLISHED: 2024-05-06] [EPSS 0.39%]
Missing Authorization vulnerability in Hamid Alinia – idehweb Login with phone number.This issue affects Login with phone number: from n/a through 1.7.18.
> CVE-2024-34369 [HIGH 7.1]
[PUBLISHED: 2024-05-06] [EPSS 0.35%]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webpushr Web Push Notifications Webpushr allows Reflected XSS.This issue affects Webpushr: from n/a through 4.35.0.
> CVE-2024-34368 [MEDIUM 5.3]
[PUBLISHED: 2024-05-06] [EPSS 0.46%]
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Mooberry Dreams Mooberry Book Manager.This issue affects Mooberry Book Manager: from n/a through 4.15.12.
> CVE-2024-34367 [HIGH 7.1]
[PUBLISHED: 2024-05-06] [EPSS 0.18%]
Cross-Site Request Forgery (CSRF) vulnerability in Popup Box Team Popup box allows Cross-Site Scripting (XSS).This issue affects Popup box: from n/a through 4.1.2.
> CVE-2024-34366 [MEDIUM 5.9]
[PUBLISHED: 2024-05-06] [EPSS 0.36%]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AltText.Ai Download Alt Text AI allows Stored XSS.This issue affects Download Alt Text AI: from n/a through 1.3.4.
> CVE-2024-33912 [HIGH 7.1]
[PUBLISHED: 2024-05-06] [EPSS 0.44%]
Missing Authorization vulnerability in Academy LMS.This issue affects Academy LMS: from n/a through 1.9.16.
AFFECTED_PRODUCTS: Kodezen Academy Lms
> CVE-2024-33910 [MEDIUM 5.3]
[PUBLISHED: 2024-05-06] [EPSS 0.42%]
Missing Authorization vulnerability in Supsystic Digital Publications by Supsystic.This issue affects Digital Publications by Supsystic: from n/a through 1.7.7.
> CVE-2024-34388 [HIGH 7.5]
[PUBLISHED: 2024-05-06] [EPSS 0.59%]
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Scribit GDPR Compliance.This issue affects GDPR Compliance: from n/a through 1.2.5.
> CVE-2024-34383 [MEDIUM 5.3]
[PUBLISHED: 2024-05-06] [EPSS 0.51%]
Authorization Bypass Through User-Controlled Key vulnerability in The SEO Guys at SEOPress SEOPress.This issue affects SEOPress: from n/a through 7.7.1.
> CVE-2024-34382 [MEDIUM 5.3]
[PUBLISHED: 2024-05-06] [EPSS 0.47%]
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in RoboSoft Robo Gallery.This issue affects Robo Gallery: from n/a through 3.2.18.
> CVE-2024-33411 [CRITICAL 9.8]
[PUBLISHED: 2024-05-06] [EPSS 0.71%]
A SQL injection vulnerability in /model/get_admin_profile.php in Campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the my_index parameter.
AFFECTED_PRODUCTS: Campcodes Complete Web Based School Management System
> CVE-2024-33410 [HIGH 8.1]
[PUBLISHED: 2024-05-06] [EPSS 0.64%]
SQL injection vulnerability in /model/delete_range_grade.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the id parameter.
AFFECTED_PRODUCTS: Campcodes Complete Web Based School Management System
> CVE-2024-33409 [CRITICAL 9.8]
[PUBLISHED: 2024-05-06] [EPSS 0.71%]
SQL injection vulnerability in index.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the name parameter.
AFFECTED_PRODUCTS: Campcodes Complete Web Based School Management System
> CVE-2024-33408 [CRITICAL 9.8]
[PUBLISHED: 2024-05-06] [EPSS 0.71%]
A SQL injection vulnerability in /model/get_classroom.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the id parameter.
AFFECTED_PRODUCTS: Campcodes Complete Web Based School Management System
> CVE-2024-33407 [MEDIUM 5.9]
[PUBLISHED: 2024-05-06] [EPSS 0.26%]
SQL injection vulnerability in /model/delete_record.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the id parameter.
AFFECTED_PRODUCTS: Campcodes Complete Web Based School Management System
> CVE-2024-33406 [HIGH 7.3]
[PUBLISHED: 2024-05-06] [EPSS 0.43%]
SQL injection vulnerability in /model/delete_student_grade_subject.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the index parameter.
AFFECTED_PRODUCTS: Campcodes Complete Web Based School Management System
> CVE-2024-33405 [HIGH 8.6]
[PUBLISHED: 2024-05-06] [EPSS 0.52%]
SQL injection vulnerability in add_friends.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the friend_index parameter.
AFFECTED_PRODUCTS: Campcodes Complete Web Based School Management System
> CVE-2024-33404 [HIGH 8.3]
[PUBLISHED: 2024-05-06] [EPSS 0.56%]
A SQL injection vulnerability in /model/add_student_first_payment.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the index parameter.
AFFECTED_PRODUCTS: Campcodes Complete Web Based School Management System
> CVE-2024-33403 [CRITICAL 9.8]
[PUBLISHED: 2024-05-06] [EPSS 0.71%]
A SQL injection vulnerability in /model/get_events.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the event_id parameter.
AFFECTED_PRODUCTS: Campcodes Complete Web Based School Management System
> CVE-2024-32807 [HIGH 8.5]
[PUBLISHED: 2024-05-06] [EPSS 0.65%]
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Brevo Sendinblue for WooCommerce allows Relative Path Traversal, Manipulating Web Input to File System Calls.This issue affects Sendinblue for WooCommerce: from n/a through 4.0.17.
> CVE-2024-34471 [MEDIUM 5.4]
[PUBLISHED: 2024-05-06] [EPSS 0.74%]
An issue was discovered in HSC Mailinspector 5.2.17-3. A Path Traversal vulnerability (resulting in file deletion) exists in the mliRealtimeEmails.php file. The filename parameter in the export HTML functionality does not properly validate the file location, allowing an attacker to read and delete a...
AFFECTED_PRODUCTS: Hsclabs Mailinspector
> CVE-2024-34251 [HIGH 7.5]
[PUBLISHED: 2024-05-06] [EPSS 0.76%]
An out-of-bound memory read vulnerability was discovered in Bytecode Alliance wasm-micro-runtime v2.0.0 which allows a remote attacker to cause a denial of service via the "block_type_get_arity" function in core/iwasm/interpreter/wasm.h.
AFFECTED_PRODUCTS: Bytecodealliance Webassembly Micro Runtime
> CVE-2024-34250 [MEDIUM 6.2]
[PUBLISHED: 2024-05-06] [EPSS 0.33%]
A heap buffer overflow vulnerability was discovered in Bytecode Alliance wasm-micro-runtime v2.0.0 which allows a remote attacker to cause at least a denial of service via the "wasm_loader_check_br" function in core/iwasm/interpreter/wasm_loader.c.
AFFECTED_PRODUCTS: Bytecodealliance Webassembly Micro Runtime
> CVE-2024-34246 [HIGH 7.5]
[PUBLISHED: 2024-05-06] [EPSS 0.52%]
wasm3 v0.5.0 was discovered to contain an out-of-bound memory read which leads to segmentation fault via the function "main" in wasm3/platforms/app/main.c.
AFFECTED_PRODUCTS: Wasm3 Project Wasm3
> CVE-2024-34093 [MEDIUM 5.3]
[PUBLISHED: 2024-05-06] [EPSS 0.44%]
An issue was discovered in Archer Platform 6 before 2024.03. There is an X-Forwarded-For Header Bypass vulnerability. An unauthenticated attacker could potentially bypass intended whitelisting when X-Forwarded-For header is enabled.
AFFECTED_PRODUCTS: Archerirm Archer
> CVE-2024-34092 [HIGH 8.8]
[PUBLISHED: 2024-05-06] [EPSS 0.39%]
An issue was discovered in Archer Platform 6 before 2024.04. Authentication was mishandled because lock did not terminate an existing session. 6.14 P3 (6.14.0.3) is also a fixed release.
AFFECTED_PRODUCTS: Archerirm Archer, Archerirm Archer
> CVE-2024-34091 [HIGH 7.3]
[PUBLISHED: 2024-05-06] [EPSS 0.51%]
An issue was discovered in Archer Platform 6 before 2024.04. There is a stored cross-site scripting (XSS) vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When vict...
AFFECTED_PRODUCTS: Archerirm Archer, Archerirm Archer
> CVE-2024-34090 [HIGH 7.3]
[PUBLISHED: 2024-05-06] [EPSS 0.42%]
An issue was discovered in Archer Platform 6 before 2024.04. There is a stored cross-site scripting (XSS) vulnerability. The login banner in the Archer Control Panel (ACP) did not previously escape content appropriately. 6.14 P3 (6.14.0.3) is also a fixed release.
AFFECTED_PRODUCTS: Archerirm Archer, Archerirm Archer
> CVE-2024-34089 [HIGH 7.3]
[PUBLISHED: 2024-05-06] [EPSS 0.46%]
An issue was discovered in Archer Platform 6 before 2024.04. There is a stored cross-site scripting (XSS) vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When vict...
AFFECTED_PRODUCTS: Archerirm Archer, Archerirm Archer