Medium
CVE-2024-27300
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,436
High
CVE-2024-28105
phpMyFAQ's File Upload Bypass at Category Image Leads to RCE
Medium
CVE-2024-28106
phpMyFAQ Stored Cross-site Scripting at FAQ News Content
High
CVE-2024-28107
phpMyFAQ SQL injections at insertentry & saveentry
Medium
CVE-2024-28108
phpMyFAQ Stored HTML Injection at contentLink
Medium
CVE-2024-29179
phpMyFAQ Stored Cross-site Scripting at File Attachments
High
CVE-2024-27299
phpMyFAQ SQL Injection at "Save News"
Medium
CVE-2023-48296
Storefront user can access history and most viewed data from matching back-office user with the same ID
High
CVE-2024-29187
WiX based installers are vulnerable to binary hijack when run as SYSTEM
High
CVE-2024-29188
Malicious directory junction can cause WiX RemoveFoldersEx to possibly delete elevated files
Medium
CVE-2024-29025
Netty's HttpPostRequestDecoder can OOM
Medium
CVE-2024-29041
Express.js Open Redirect in malformed URLs
Medium
CVE-2023-45824
Pinned entity creation form shows wrong data
Medium
CVE-2024-28246
KaTeX missing normalization of the protocol in URLs allows bypassing forbidden protocols
Medium
CVE-2024-28245
KaTeX's `\includegraphics` does not escape filename
Medium
CVE-2024-28244
KaTeX's maxExpand bypassed by Unicode sub/superscripts
Medium
CVE-2024-28243
KaTeX's maxExpand bypassed by `\edef`
High
CVE-2024-29194
OneUptime Vulnerable to a Privilege Escalation via Local Storage Key Manipulation
High
ghsa-g4v6-69p6-q3p4
WiX Burn-based bundles are vulnerable to binary hijack when run as SYSTEM
High
ghsa-wq88-fq4x-h2pm
WiX Burn-based bundles are vulnerable to binary hijack when run as SYSTEM
Low
CVE-2024-29196
phpMyFAQ Path Traversal in Attachments
Critical
CVE-2024-29650
@thi.ng/paths Prototype Pollution vulnerability
High
CVE-2024-2857
Simple Buttons Creator <=1.04 - Unauthenticated Stored Cross-Site Scripting via Add Button
Medium
CVE-2024-1663
Ultimate Noindex Nofollow Tool II <= 1.3.5 - Authenticated (Admin+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.