Medium
CVE-2024-1857
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,405
Medium
CVE-2024-29097
User profile <= 2.0.20 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2024-29095
Site Reviews <= 6.11.6 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2024-1733
Word Replacer Pro <= 1.0 - Missing Authorization to Unauthenticated Arbitrary Content Update
Medium
CVE-2024-1904
MasterStudy LMS <= 3.2.13 - Missing Authorization to Sensitive Information Exposure in search_posts
Medium
CVE-2024-1239
ElementsKit Elementor addons <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Critical
CVE-2024-22203
Whoogle Search is a self-hosted metasearch engine. In versions prior to 0.8.4, the `element` method in `app/routes.py` does not validate the user-controlled `src_type` and `element_url` variables and
Critical
CVE-2024-22205
Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the `window` endpoint does not sanitize user-supplied input from the `location` variable and passes it to the `send` met
Medium
CVE-2024-22204
Whoogle Search is a self-hosted metasearch engine. Versions 0.8.3 and prior have a limited file write vulnerability when the configuration options in Whoogle are enabled. The `config` function in `app
Medium
CVE-2024-22417
Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the `element` method in `app/routes.py` does not validate the user-controlled `src_type` and `element_url` variables and
High
CVE-2024-28425
greykite v1.0.0 was discovered to contain an arbitrary file upload vulnerability in the load_obj function at /templates/pickle_utils.py. This vulnerability allows attackers to execute arbitrary code v
Medium
CVE-2024-23823
vantage6's CORS settings overly permissive
Medium
CVE-2024-28849
follow-redirects' Proxy-Authorization header kept across hosts
Medium
CVE-2024-28746
Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI which t
High
CVE-2024-1795
HUSKY – Products Filter for WooCommerce Professional <= 1.3.5.2 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2024-2399
Premium Addons for Elementor <= 4.10.23 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-2335
Elements Plus! <= 2.16.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget links
High
CVE-2024-1991
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 5.3.0.0 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2024-1796
HUSKY – Products Filter for WooCommerce Professional <= 1.3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2024-1571
WP Recipe Maker <= 9.2.1 - Authenticated Stored Cross-Site Scripting via Video Embed
Medium
CVE-2024-2249
LA-Studio Element Kit for Elementor <= 1.3.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-1960
ShopLentor <= 2.8.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Banner Link
Medium
CVE-2024-2423
UsersWP <= 1.2.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2024-2256
oik <= 4.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.