Search

Expected end of text, found '.' (at char 38), (line:1, col:39)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (333315 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-6626 2 Theinnovs, Thelnnovs 2 Eleforms, Eleforms 2024-11-08 5.3 Medium
The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on several functions in all versions up to, and including, 2.9.9.9. This makes it possible for unauthenticated attackers to view form submissions.
CVE-2024-9307 1 Themelooks 2 Mfolio, Mfolio Lite 2024-11-08 9.9 Critical
The mFolio Lite plugin for WordPress is vulnerable to file uploads due to a missing capability check in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file or upload arbitrary EXE files on the affected site's server which may make remote code execution possible if the attacker can also gain access to run the .exe file, or trick a site visitor into downloading and running the .exe file.
CVE-2024-43998 1 Websiteinwp 1 Blogpoet 2024-11-08 6.5 Medium
Missing Authorization vulnerability in WebsiteinWP Blogpoet allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blogpoet: from n/a through 1.0.3.
CVE-2024-43982 2 Geek Code Lab, Geekcodelab 2 Login As Users, Login As Users 2024-11-08 8.8 High
Missing Authorization vulnerability in Geek Code Lab Login As Users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login As Users: from n/a through 1.4.3.
CVE-2024-43981 1 Ayecode 1 Geodirectory 2024-11-08 4.3 Medium
Missing Authorization vulnerability in AyeCode – WP Business Directory Plugins GeoDirectory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GeoDirectory: from n/a through 2.3.70.
CVE-2024-51740 1 Combodo 1 Itop 2024-11-08 4.3 Medium
Combodo iTop is a simple, web based IT Service Management tool. This vulnerability can be used to create HTTP requests on behalf of the server, from a low privileged user. The user portal form manager has been fixed to only instantiate classes derived from it. This issue has been addressed in versions 2.7.11, 3.0.5, 3.1.2, and 3.2.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2024-44006 1 Onthegosystems 1 Woocommerce Multilingual \& Multicurrency 2024-11-08 4.3 Medium
Missing Authorization vulnerability in OnTheGoSystems WooCommerce Multilingual & Multicurrency multilingual allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Multilingual & Multicurrency: from n/a through 5.3.6.
CVE-2024-10919 1 Didi 2 Super-jacoco, Super Jacoco 2024-11-08 6.3 Medium
A vulnerability has been found in didi Super-Jacoco 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /cov/triggerUnitCover. The manipulation of the argument uuid leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-44019 1 Renzojohnson 2 Contact Form 7 Campaign Monitor Extension, Contact Form 7 Compaign Monitor Extension 2024-11-08 5.3 Medium
Missing Authorization vulnerability in Renzo Johnson Contact Form 7 Campaign Monitor Extension allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Contact Form 7 Campaign Monitor Extension: from n/a through 0.4.67.
CVE-2024-44020 1 Prasadkirpekar 1 Wp Free Ssl 2024-11-08 4.3 Medium
Missing Authorization vulnerability in Prasad Kirpekar WP Free SSL – Free SSL Certificate for WordPress and force HTTPS allows . This issue affects WP Free SSL – Free SSL Certificate for WordPress and force HTTPS: from n/a through 1.2.6.
CVE-2024-9484 2 Avast, Avg 2 Antivirus, Antivirus 2024-11-08 5.1 Medium
An null-pointer-derefrence in the engine module in AVG/Avast Antivirus signature <24092400 released on 24/Sep/2024 on MacOS allows a malformed xar file to crash the application during file processing.
CVE-2024-9483 2 Avast, Avg 2 Antivirus, Antivirus 2024-11-08 5.1 Medium
A null-pointer-dereference in the signature verification module in AVG/Avast Antivirus signature <24092400 released on 24/Sep/2024 on MacOS may allow a malformed xar file to crash the application during processing.
CVE-2024-9482 2 Avast, Avg 2 Antivirus, Antivirus 2024-11-08 5.1 Medium
An out-of-bounds write in the engine module in AVG/Avast Antivirus signature <24092400 released on 24/Sep/2024 on MacOS allows a malformed Mach-O file to crash the application during file processing.
CVE-2024-9481 2 Avast, Avg 2 Antivirus, Antivirus 2024-11-08 5.1 Medium
An out-of-bounds write in the engine module in AVG/Avast Antivirus signature <24092400 released on 24/Sep/2024 on MacOS allows a malformed eml file to crash the application during file processing.
CVE-2024-43980 1 Cozythemes 1 Fotawp 2024-11-08 6.5 Medium
Missing Authorization vulnerability in CozyThemes Fota WP allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fota WP: from n/a through 1.4.1.
CVE-2024-43979 1 Cozythemes 1 Blockbooster 2024-11-08 6.5 Medium
Missing Authorization vulnerability in CozyThemes Blockbooster allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blockbooster: from n/a through 1.0.10.
CVE-2024-43974 1 Cozythemes 1 Revivenews 2024-11-08 6.5 Medium
Missing Authorization vulnerability in CozyThemes ReviveNews allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects ReviveNews: from n/a through 1.0.2.
CVE-2024-43973 1 Ayecode 1 Getpaid 2024-11-08 4.3 Medium
Missing Authorization vulnerability in AyeCode Ltd GetPaid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GetPaid: from n/a through 2.8.11.
CVE-2024-43962 1 Lws 1 Affiliation 2024-11-08 5.4 Medium
Missing Authorization vulnerability in LWS LWS Affiliation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LWS Affiliation: from n/a through 2.3.4.
CVE-2024-43956 1 Caseproof 1 Memberpress 2024-11-08 6.5 Medium
Missing Authorization vulnerability in Caseproof, LLC Memberpress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Memberpress: from n/a through 1.11.34.