Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-25 09:05Z
2024-03-13
2024-03-13 16:15Z
MED

CVE-2024-1380 — Relevanssi Relevanssi: The Relevanssi – A Better Search plugin for WordPress is vulnerable to unauthorized access

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-1380

The Relevanssi – A Better Search plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the relevanssi_export_log_check() function in all versions up to, and including, 4.22.0 (Free) and 2.25.0 (Premium). This makes it possible for unauthenticated attackers to export the query log data. The vendor has indicated that they may look into adding a capability check for proper authorization control, however, this vulnerability is theo CVSSv3.1 5.3 (MEDIUM) · EPSS 99th percentile

CWECWE 862VNDRelevanssiTYPVulnerability
5.3
CVSS v3.1
100
Edit Score
2024-03-13
2024-03-13 16:15Z
HIGH

CVE-2024-1358 — Webtechstreet Elementor_addon_elements: The Elementor Addon Elements plugin for WordPress is vulnerable to Directory Traversal in all

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-1358

The Elementor Addon Elements plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.12.12 via the render function. This makes it possible for authenticated attackers, with contributor access or higher, to include the contents of arbitrary PHP files on the server, which may expose sensitive information. CVSSv3.1 8.8 (HIGH) · EPSS 86th percentile

CWECWE 22VNDElementorVNDWebtechstreetTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
2024-03-13
2024-03-13 16:15Z
HIGH

CVE-2024-1311 — Brizy Brizy: The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-1311

The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the storeImages function in all versions up to, and including, 2.4.40. This makes it possible for authenticated attackers, with contributor access or above, to upload arbitrary files on the affected site's server which may make remote code execution possible. CVSSv3.1 8.8 (HIGH) · EPSS 93th percentile

CWECWE 434VNDBrizyTYPVulnerability
8.8
CVSS v3.1
97
Edit Score
2024-03-13
2024-03-13 16:15Z
HIGH

CVE-2024-1203 — Conversios Conversios: The Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-1203

The Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'valueData' parameter in all versions up to, and including, 7.0.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into a CVSSv3.1 8.8 (HIGH) · EPSS 72th percentile

CWECWE 89VNDConversiosTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-03-13
2024-03-13 16:15Z
HIGH

CVE-2024-0683 — Autopolis Bulgarisation_for_woocommerce: The Bulgarisation for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-0683

The Bulgarisation for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions in all versions up to, and including, 3.0.14. This makes it possible for unauthenticated and authenticated attackers, with subscriber-level access and above, to generate and delete labels. CVSSv3.1 7.3 (HIGH) · EPSS 96th percentile

CWECWE 862VNDAutopolisVNDBulgarisationTYPVulnerability
7.3
CVSS v3.1
94
Edit Score
2024-03-13
2024-03-13 16:15Z
HIGH

CVE-2024-0368 — Wpmudev Hustle: The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-0368

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.8.3 via hardcoded API Keys. This makes it possible for unauthenticated attackers to extract sensitive data including PII. CVSSv3.1 8.6 (HIGH) · EPSS 82th percentile

CWECWE 522VNDWpmudevVNDHustleTYPVulnerability
8.6
CVSS v3.1
94
Edit Score
2024-03-13
2024-03-13 16:15Z
CRIT

CVE-2023-6825 — Mndpsingh287 File_manager: The File Manager and File Manager Pro plugins for WordPress are vulnerable to Directory

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-6825

The File Manager and File Manager Pro plugins for WordPress are vulnerable to Directory Traversal in versions up to, and including version 7.2.1 (free version) and 8.3.4 (Pro version) via the target parameter in the mk_file_folder_manager_action_callback_shortcode function. This makes it possible for attackers to read the contents of arbitrary files on the server, which can contain sensitive information and to upload files into directories other than the intended directory f CVSSv3.1 9.9 (CRITICAL) · EPSS 98th percentile

CWECWE 22CWECWE 23VNDMndpsingh287TYPVulnerability
9.9
CVSS v3.1
100
Edit Score
728 × 90 / responsive · programmatic ad slot
2024-03-13
2024-03-13 16:15Z
HIGH

CVE-2023-5663 — Storeapps News_announcement_scroll: The News Announcement Scroll plugin for WordPress is vulnerable to SQL Injection via the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-5663

The News Announcement Scroll plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 9.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with contributor-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information f CVSSv3.1 8.8 (HIGH) · EPSS 54th percentile

CWECWE 89VNDStoreappsTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-03-13
2024-03-13 10:15Z
HIGH

CVE-2024-2123 — Ultimatemember Ultimate_member: The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-2123

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the several parameters in all versions up to, and including, 2.8.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVSSv3.1 7.2 (HIGH) · EPSS 97th percentile

CWECWE 79VNDUltimatememberVNDUltimateTYPVulnerability
7.2
CVSS v3.1
95
Edit Score
2024-03-12
2024-03-12 17:15Z
CRIT

CVE-2024-21400 — Microsoft Confcom: Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-21400

Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability CVSSv3.1 9.0 (CRITICAL) · EPSS 81th percentile

CWECWE 22VNDMicrosoftTYPVulnerability
9.0
CVSS v3.1
96
Edit Score
2024-03-12
2024-03-12 15:15Z
CRIT

CVE-2023-47534 — Fortinet Forticlient_endpoint_management_server: A improper neutralization of formula elements in a csv file vulnerability in Fortinet FortiClientEMS

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-47534

A improper neutralization of formula elements in a csv file vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2.2, FortiClientEMS 7.0.0 through 7.0.10, FortiClientEMS 6.4 all versions, FortiClientEMS 06.02 all versions, FortiClientEMS 6.2 all versions, FortiClientEMS 06.00 all versions, FortiClientEMS 6.0 all versions allows attacker to execute unauthorized code or commands via specially crafted packets. CVSSv3.1 9.6 (CRITICAL) · EPSS 64th percentile

CWECWE 1236VNDFortinetTYPVulnerability
9.6
CVSS v3.1
98
Edit Score
2024-03-12
2024-03-12 15:15Z
HIGH

CVE-2023-42790 — Fortinet Fortiproxy: A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-42790

A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, FortiProxy 7.4.0, FortiProxy 7.2.0 through 7.2.6, FortiProxy 7.0.0 through 7.0.12, FortiProxy 2.0.0 through 2.0.13, FortiSASE 23.2.b allows attacker to execute unauthorized code or commands via specially crafted HTTP requests. CVSSv3.1 8.1 (HIGH) · EPSS 61th percentile

CWECWE 121VNDFortinetTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2024-03-12
2024-03-12 15:15Z
CRIT

CVE-2023-42789 — Fortinet Fortiproxy: A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.5

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-42789

A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, FortiProxy 7.4.0, FortiProxy 7.2.0 through 7.2.6, FortiProxy 7.0.0 through 7.0.12, FortiProxy 2.0.0 through 2.0.13, FortiSASE 23.2.b allows attacker to execute unauthorized code or commands via specially crafted HTTP requests. CVSSv3.1 9.8 (CRITICAL) · EPSS 87th percentile

CWECWE 787VNDFortinetTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2024-03-11
2024-03-11 18:15Z
HIGH

CVE-2024-26620 — Linux Linux_kernel: Inspecting only the APID of the new adapter or APQI of the new domain

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-26620

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: always filter entire AP matrix The vfio_ap_mdev_filter_matrix function is called whenever a new adapter or domain is assigned to the mdev. The purpose of the function is to update the guest's AP configuration by filtering the matrix of adapters and domains assigned to the mdev. When an adapter or domain is assigned, only the APQNs associated with the APID of the new adapter or APQI of the new CVSSv3.1 8.2 (HIGH) · EPSS 58th percentile

CWECWE 787TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2024-03-07
2024-03-07 21:15Z
HIGH

CVE-2024-1986 — Booster Booster_for_woocommerce: The Booster Elite for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-1986

The Booster Elite for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wc_add_new_product() function in all versions up to, and including, 7.1.7. This makes it possible for customer-level attackers, and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. This is only exploitable when the user product upload functionality is enabled. CVSSv3.1 8.8 (HIGH) · EPSS 93th percentile

CWECWE 434VNDBoosterTYPVulnerability
8.8
CVSS v3.1
97
Edit Score
2024-03-07
2024-03-07 19:15Z
HIGH

CVE-2024-1773 — Acowebs Pdf_invoices_and_packing_slips_for_woocommerce: The PDF Invoices and Packing Slips For WooCommerce plugin for WordPress is vulnerable to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-1773

The PDF Invoices and Packing Slips For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.7 via deserialization of untrusted input via the order_id parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target sys CVSSv3.1 8.8 (HIGH) · EPSS 65th percentile

CWECWE 502CWECWE 74VNDAcowebsVNDPdfTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-03-07
2024-03-07 11:15Z
HIGH

CVE-2024-1170 — Themekraft Post_form: The Post Form – Registration Form – Profile Form for User Profiles – Frontend

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-1170

The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to unauthorized media file deletion due to a missing capability check on the handle_deleted_media function in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to delete arbitrary media files. CVSSv3.1 8.2 (HIGH) · EPSS 66th percentile

CWECWE 862VNDThemekraftVNDPostTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2024-03-07
2024-03-07 09:15Z
HIGH

CVE-2024-1382 — Nicdarkthemes Restaurant_reservations: The Restaurant Reservations plugin for WordPress is vulnerable to Local File Inclusion in all

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-1382

The Restaurant Reservations plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9 via the nd_rst_layout attribute of the nd_rst_search shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve cod CVSSv3.1 8.8 (HIGH) · EPSS 76th percentile

CWECWE 98VNDNicdarkthemesVNDRestaurantTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-03-07
2024-03-07 01:15Z
HIGH

CVE-2024-26566 — Iscute Cute_http_file_server: An issue in Cute Http File Server v.3.1 allows a remote attacker to escalate

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-26566

An issue in Cute Http File Server v.3.1 allows a remote attacker to escalate privileges via the password verification component. CVSSv3.1 8.2 (HIGH) · EPSS 44th percentile

CWECWE 288VNDIscuteVNDCuteTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2024-03-07
2024-03-07 01:15Z
HIGH

CVE-2023-47415 — Cypress Ctm-200_firmware: Solutions CTM-200 v2.7.1.5600 and below was discovered to contain an OS command injection

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-47415

Cypress Solutions CTM-200 v2.7.1.5600 and below was discovered to contain an OS command injection vulnerability via the cli_text parameter. CVSSv3.1 7.5 (HIGH) · EPSS 97th percentile

CWECWE 78VNDCypressTYPVulnerability
7.5
CVSS v3.1
92
Edit Score
2024-03-06
2024-03-06 19:15Z
CRIT

CVE-2024-27304 — Jackc Pgproto3: SQL injection can occur if an attacker can cause a single query or bind

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-27304

pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control. The problem is resolved in v4.18.2 and v5.5.4. As a workaround, reject user input large enough to cause a single query or bind message to exceed 4 GB in size. CVSSv3.1 9.8 (CRITICAL) · EPSS 83th percentile

CWECWE 89CWECWE 190VNDPostgresqlVNDJackcTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2024-03-06
2024-03-06 19:15Z
HIGH

CVE-2024-27289 — Jackc Pgx: Prior to version 4.18.2, SQL injection can occur when all of the following conditions

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-27289

pgx is a PostgreSQL driver and toolkit for Go. Prior to version 4.18.2, SQL injection can occur when all of the following conditions are met: the non-default simple protocol is used; a placeholder for a numeric value must be immediately preceded by a minus; there must be a second placeholder for a string value after the first placeholder; both must be on the same line; and both parameter values must be user-controlled. The problem is resolved in v4.18.2. As a workaround, do n CVSSv3.1 8.1 (HIGH) · EPSS 70th percentile

CWECWE 89VNDPostgresqlVNDJackcTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2024-03-05
2024-03-05 13:15Z
CRIT

CVE-2023-7103 — Zksoftware Uface_5: Authentication Bypass by Primary Weakness vulnerability in ZKSoftware Biometric Security Solutions UFace 5 allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-7103

Authentication Bypass by Primary Weakness vulnerability in ZKSoftware Biometric Security Solutions UFace 5 allows Authentication Bypass. This issue affects UFace 5: through 12022024. CVSSv3.1 9.8 (CRITICAL) · EPSS 6th percentile

CWECWE 305VNDZksoftwareTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-03-05
2024-03-05 12:15Z
HIGH

CVE-2022-48629 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: crypto: qcom-rng - ensure

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-48629

In the Linux kernel, the following vulnerability has been resolved: crypto: qcom-rng - ensure buffer for generate is completely filled The generate function in struct rng_alg expects that the destination buffer is completely filled if the function returns 0. qcom_rng_read() can run into a situation where the buffer is partially filled with randomness and the remaining part of the buffer is zeroed since qcom_rng_generate() doesn't check the return value. This issue can be re CVSSv3.1 8.1 (HIGH) · EPSS 31th percentile

TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2024-03-05
2024-03-05 02:15Z
HIGH

CVE-2024-1731 — Rymera Auto_refresh_single_page: The Auto Refresh Single Page plugin for WordPress is vulnerable to PHP Object Injection

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-1731

The Auto Refresh Single Page plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1 via deserialization of untrusted input from the arsp_options post meta option. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it cou CVSSv3.1 8.8 (HIGH) · EPSS 79th percentile

CWECWE 502VNDRymeraVNDAutoTYPVulnerability
8.8
CVSS v3.1
94
Edit Score