VYPR

CVEs

9,105 total · page 89 of 183

AllCriticalHighKEV
  • CVE-2024-21546CriDec 18, 2024
    risk 0.57cvss 9.8epss 0.01

    Versions of the package unisharp/laravel-filemanager before 2.9.1 are vulnerable to Remote Code Execution (RCE) through using a valid mimetype and inserting the . character after the php file extension. This allows the attacker to execute malicious code.

  • CVE-2024-54662CriDec 17, 2024
    Inet
    Inet
    risk 0.59cvss 9.1epss 0.00

    Dante 1.4.0 through 1.4.3 (fixed in 1.4.4) has incorrect access control for some sockd.conf configurations involving socksmethod.

  • CVE-2024-8972CriDec 17, 2024
    Mobil365 Informatics
    Saha365 App
    risk 0.64cvss 9.8epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mobil365 Informatics Saha365 App allows SQL Injection. This issue affects Saha365 App: before 30.09.2024.

  • CVE-2024-10205CriDec 17, 2024
    Hitachi
    Infrastructure Analytics Advisor
    risk 0.61cvss 9.4epss 0.01

    Authentication Bypass vulnerability in Hitachi Ops Center Analyzer on Linux, 64 bit (Hitachi Ops Center Analyzer detail view component), Hitachi Infrastructure Analytics Advisor on Linux, 64 bit (Hitachi Data Center Analytics component ).This issue affects Hitachi Ops Center…

  • CVE-2024-29671CriDec 16, 2024
    Nextu
    FLATA AX1500
    risk 0.68cvss 9.8epss 0.21

    Buffer Overflow vulnerability in NEXTU FLATA AX1500 Router v.1.0.2 allows a remote attacker to execute arbitrary code via the POST request handler component.

  • CVE-2024-55557CriDec 16, 2024
    Nroduit
    Weasis
    risk 0.58cvss 9.8epss 0.01

    ui/pref/ProxyPrefView.java in weasis-core in Weasis 4.5.1 has a hardcoded key for symmetric encryption of proxy credentials.

  • CVE-2024-55949CriDec 16, 2024
    Minio
    Minio
    risk 0.54cvss —epss 0.01

    MinIO is a high-performance, S3 compatible object store, open sourced under GNU AGPLv3 license. Minio is subject to a privilege escalation in IAM import API, all users are impacted since MinIO commit `580d9db85e04f1b63cc2909af50f0ed08afa965f`. This issue has been addressed in…

  • CVE-2024-54285CriDec 16, 2024
    Seedprod
    SeedProd Pro
    risk 0.59cvss 9.1epss 0.00

    Unrestricted Upload of File with Dangerous Type vulnerability in SeedProd LLC SeedProd Pro allows Upload a Web Shell to a Web Server.This issue affects SeedProd Pro: from n/a through 6.18.10.

  • CVE-2024-54280CriDec 16, 2024
    Iqonicdesign
    Wpbookit
    risk 0.60cvss 9.3epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design WPBookit wpbookit allows SQL Injection.This issue affects WPBookit: from n/a through <= 1.6.0.

  • CVE-2024-54229CriDec 16, 2024
    WordPress
    Sv100 Companion
    risk 0.64cvss 9.8epss 0.00

    Incorrect Privilege Assignment vulnerability in straightvisions GmbH SV100 Companion sv100-companion allows Privilege Escalation.This issue affects SV100 Companion: from n/a through <= 2.0.02.

  • CVE-2024-43234CriDec 16, 2024
    Xtendify
    Woffice
    risk 0.64cvss 9.8epss 0.01

    Authentication Bypass Using an Alternate Path or Channel vulnerability in WofficeIO Woffice woffice allows Authentication Bypass.This issue affects Woffice: from n/a through <= 5.4.14.

  • CVE-2024-56012CriDec 16, 2024
    WordPress
    Flashnews Fading Effect Pearlbells
    risk 0.64cvss 9.8epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in lizeipe Flash News / Post (Responsive) flashnews-fading-effect-pearlbells allows Privilege Escalation.This issue affects Flash News / Post (Responsive): from n/a through <= 4.1.

  • CVE-2024-55988CriDec 16, 2024
    Amol Nirmala Waman
    Navayan CSV Export
    risk 0.63cvss 9.3epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Amol Nirmala Waman Navayan CSV Export navayan-csv-export allows Blind SQL Injection.This issue affects Navayan CSV Export: from n/a through <= 1.0.9.

  • CVE-2024-55982CriDec 16, 2024
    WordPress
    Rich Web Share Button
    risk 0.63cvss 9.3epss 0.02

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in richteam Share Buttons – Social Media rich-web-share-button allows Blind SQL Injection.This issue affects Share Buttons – Social Media: from n/a through <= 1.0.2.

  • CVE-2024-55981CriDec 16, 2024
    Nabajit Roy
    Nabz Image Gallery
    risk 0.62cvss 9.3epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nabajit Roy Nabz Image Gallery nabz-image-gallery allows SQL Injection.This issue affects Nabz Image Gallery: from n/a through <= v1.00.

  • CVE-2024-55980CriDec 16, 2024
    robindkumar
    Wr Age Verification
    risk 0.61cvss 9.3epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in robindkumar Wr Age Verification wr-age-verification allows SQL Injection.This issue affects Wr Age Verification: from n/a through <= 2.0.0.

  • CVE-2024-55978CriDec 16, 2024
    WordPress
    Code Generator Pro
    risk 0.61cvss 9.3epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WalletStation Code Generator Pro code-generator-pro allows SQL Injection.This issue affects Code Generator Pro: from n/a through <= 1.2.

  • CVE-2024-55977CriDec 16, 2024
    WordPress
    Launchpage App Importer
    risk 0.60cvss 9.3epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BinaryCarpenter LaunchPage.app Importer launchpage-app-importer allows SQL Injection.This issue affects LaunchPage.app Importer: from n/a through <= 1.1.

  • CVE-2024-55976CriDec 16, 2024
    WordPress
    Critical Site Intel Stats
    risk 0.63cvss 9.3epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mikeleembruggen Critical Site Intel critical-site-intel-stats allows SQL Injection.This issue affects Critical Site Intel: from n/a through <= 1.0.

  • CVE-2024-55972CriDec 16, 2024
    WordPress
    Etemplates
    risk 0.61cvss 9.3epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in chriscarvache eTemplates etemplates allows SQL Injection.This issue affects eTemplates: from n/a through <= 0.2.1.

  • CVE-2024-54372CriDec 16, 2024
    WordPress
    Insertify
    risk 0.62cvss 9.6epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Sourov Amin Insertify insertify allows Code Injection.This issue affects Insertify: from n/a through <= 1.1.4.

  • CVE-2024-54370CriDec 16, 2024
    SuitePlugins
    Video & Photo Gallery for Ultimate Member
    risk 0.64cvss 9.9epss 0.01

    Unrestricted Upload of File with Dangerous Type vulnerability in SuitePlugins Video & Photo Gallery for Ultimate Member gallery-for-ultimate-member allows Upload a Web Shell to a Web Server.This issue affects Video & Photo Gallery for Ultimate Member: from n/a through <= 1.1.0.

  • CVE-2024-54369CriDec 16, 2024
    Themehunk
    Zita Site Builder
    risk 0.61cvss 9.1epss 0.02

    Missing Authorization vulnerability in ThemeHunk Zita Site Builder ai-site-builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Zita Site Builder: from n/a through <= 1.0.2.

  • CVE-2024-54368CriDec 16, 2024
    rubengarzajr
    GitSync
    risk 0.62cvss 9.6epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in rubengarzajr GitSync git-sync allows Code Injection.This issue affects GitSync: from n/a through <= 1.1.0.

  • CVE-2024-54367CriDec 16, 2024
    Ultimatemember
    Forumwp
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in Ultimate Member ForumWP forumwp allows Object Injection.This issue affects ForumWP: from n/a through <= 2.1.0.

  • CVE-2024-54363CriDec 16, 2024
    WordPress
    Wp Nssuser Register
    risk 0.67cvss 9.8epss 0.02

    Incorrect Privilege Assignment vulnerability in saiful.total Wp NssUser Register wp-nssuser-register allows Privilege Escalation.This issue affects Wp NssUser Register: from n/a through <= 1.0.0.

  • CVE-2024-54361CriDec 16, 2024
    WordPress
    Instant Appointment
    risk 0.60cvss 9.3epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tenteeglobal Instant Appointment instant-appointment allows SQL Injection.This issue affects Instant Appointment: from n/a through <= 1.2.

  • CVE-2024-49775CriDec 16, 2024
    risk 0.64cvss 9.8epss 0.02

    A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2501.0001), Opcenter Intelligence (All versions < V2501.0001), Opcenter Quality (All versions < V2512), Opcenter RDnL (All versions < V2410), SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS…

  • CVE-2024-55969CriDec 15, 2024
    Syncfusion
    Syncfusion
    risk 0.59cvss 9.1epss 0.01

    DocIO in Syncfusion Essential Studio for ASP.NET MVC before 27.1.55 throws XMLException during the resaving of a DOCX document with an external reference XML, aka I640714.

  • CVE-2023-29476CriDec 14, 2024
    Menlo Security
    Menlo On-Premise Appliance
    risk 0.59cvss 9.1epss 0.00

    In Menlo On-Premise Appliance before 2.88, web policy may not be consistently applied properly to intentionally malformed client requests. This is fixed in 2.88.2+, 2.89.1+, and 2.90.1+.

  • CVE-2024-54297CriDec 13, 2024
    WordPress
    Vbsso Lite
    risk 0.64cvss 9.8epss 0.01

    Authentication Bypass Using an Alternate Path or Channel vulnerability in extremeidea vBSSO-lite vbsso-lite allows Authentication Bypass.This issue affects vBSSO-lite: from n/a through <= 1.4.3.

  • CVE-2024-54296CriDec 13, 2024
    Codexpert
    CoSchool LMS
    risk 0.64cvss 9.8epss 0.01

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Codexpert, Inc CoSchool LMS coschool allows Authentication Bypass.This issue affects CoSchool LMS: from n/a through <= 1.4.3.

  • CVE-2024-54295CriDec 13, 2024
    WordPress
    Listapp Mobile Manager
    risk 0.64cvss 9.8epss 0.01

    Authentication Bypass Using an Alternate Path or Channel vulnerability in FluxBuilder ListApp Mobile Manager listapp-mobile-manager allows Authentication Bypass.This issue affects ListApp Mobile Manager: from n/a through <= 1.7.7.

  • CVE-2024-54294CriDec 13, 2024
    Appgenix Infotech
    Firebase OTP Authentication
    risk 0.64cvss 9.8epss 0.01

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Appgenix Infotech Firebase OTP Authentication authentication-via-otp-using-firebase allows Authentication Bypass.This issue affects Firebase OTP Authentication: from n/a through <= 1.0.1.

  • CVE-2024-54293CriDec 13, 2024
    Ce21com
    Ce21 Suite
    risk 0.64cvss 9.8epss 0.01

    Incorrect Privilege Assignment vulnerability in CE21 CE21 Suite ce21-suite allows Privilege Escalation.This issue affects CE21 Suite: from n/a through <= 2.2.0.

  • CVE-2024-54292CriDec 13, 2024
    appsplate
    Appsplate
    risk 0.61cvss 9.3epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in appsplate Appsplate appsplate allows SQL Injection.This issue affects Appsplate: from n/a through <= 2.1.3.

  • CVE-2024-54273CriDec 13, 2024
    WordPress
    Mail Picker
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in PickPlugins Mail Picker mail-picker allows Object Injection.This issue affects Mail Picker: from n/a through <= 1.0.14.

  • CVE-2024-54262CriDec 13, 2024
    Sidngr
    Import Export For Woocommerce
    risk 0.69cvss 9.9epss 0.01

    Unrestricted Upload of File with Dangerous Type vulnerability in sidngr Import Export For WooCommerce import-export-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects Import Export For WooCommerce: from n/a through <= 1.6.2.

  • CVE-2024-54261CriDec 13, 2024
    WordPress
    Tax Service Electronic Hdm
    risk 0.65cvss 10.0epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in HK Digital Agency LLC TAX SERVICE Electronic HDM virtual-hdm-for-taxservice-am allows SQL Injection.This issue affects TAX SERVICE Electronic HDM: from n/a through <= 1.2.2.

  • CVE-2024-54239CriDec 13, 2024
    WordPress
    Eyewear Prescription Form
    risk 0.64cvss 9.8epss 0.01

    Missing Authorization vulnerability in dugudlabs Eyewear prescription form eyewear-prescription-form allows Privilege Escalation.This issue affects Eyewear prescription form: from n/a through <= 4.0.18.

  • CVE-2024-54234CriDec 13, 2024
    Limit Login Attempts Project
    Limit Login Attempts
    risk 0.60cvss 9.3epss 0.01

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wp-buy Limit Login Attempts wp-limit-failed-login-attempts allows SQL Injection.This issue affects Limit Login Attempts: from n/a through <= 5.5.

  • CVE-2022-46838CriDec 13, 2024
    Joomsky
    Js Help Desk
    risk 0.59cvss 9.1epss 0.01

    Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1.

  • CVE-2024-11986CriDec 13, 2024
    Crushftp
    Crushftp
    risk 0.62cvss 9.6epss 0.01

    Improper input handling in the 'Host Header' allows an unauthenticated attacker to store a payload in web application logs. When an Administrator views the logs using the application's standard functionality, it enables the execution of the payload, resulting in Stored XSS or…

  • CVE-2024-21577CriDec 13, 2024
    risk 0.65cvss 10.0epss 0.01

    ComfyUI-Ace-Nodes is vulnerable to Code Injection. The ACE_ExpressionEval node contains an eval() in its entrypoint function that accepts arbitrary user-controlled data. A user can create a workflow that results in executing arbitrary code on the server.

  • CVE-2024-21576CriDec 13, 2024
    bmad4ever
    ComfyUI-Bmad-Nodes
    risk 0.65cvss 10.0epss 0.01

    ComfyUI-Bmad-Nodes is vulnerable to Code Injection. The issue stems from a validation bypass in the BuildColorRangeHSVAdvanced, FilterContour and FindContour custom nodes. In the entrypoint function to each node, there’s a call to eval which can be triggered by generating a…

  • CVE-2024-9290CriDec 13, 2024
    WordPress
    Super Backup Clone Migrate For Wordpress
    risk 0.69cvss 9.8epss 0.04

    The Super Backup & Clone - Migrate for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and a missing capability check on the ibk_restore_migrate_check() function in all versions up to, and including, 2.3.3. This makes it…

  • CVE-2024-12603CriDec 13, 2024
    Tecno
    Applock
    risk 0.64cvss 9.8epss 0.01

    A logic vulnerability in the the mobile application (com.transsion.applock) can lead to bypassing the application password.

  • CVE-2024-55875CriDec 12, 2024
    Http4k
    Http4k
    risk 0.57cvss 9.8epss 0.02

    http4k is a functional toolkit for Kotlin HTTP applications. Prior to version 6.50.0.0, there is a potential XXE (XML External Entity Injection) vulnerability when http4k handling malicious XML contents within requests, which might allow attackers to read local sensitive…

  • CVE-2024-21574CriDec 12, 2024
    Comfy Org
    Comfyui Manager
    risk 0.59cvss 10.0epss 0.01

    The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom nodes which is added to the server by the extension. This allows an attacker to craft a request that triggers a pip install on a user…

  • CVE-2024-10124CriDec 12, 2024
    Vayu
    Vayu Blocks
    risk 0.64cvss 9.8epss 0.31

    The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation and activation due to a missing capability check on the tp_install() function in all versions up to, and including, 1.1.1. This makes…