Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-24 19:04Z
2024-07-09
2024-07-09 08:15Z
HIGH

CVE-2024-6320 — ScrollTo: The ScrollTo Top plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-6320

The ScrollTo Top plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 1.2.2. This is due to missing nonce validation and missing file type validation in the 'options_page' function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible via a forged request granted they can trick a site administrator into pe CVSSv3.1 8.8 (HIGH)

CWECWE 352VNDScrolltoTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-07-09
2024-07-09 08:15Z
HIGH

CVE-2024-6317 — Zealousweb Generate_pdf_using_contact_form_7: The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-6317

The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 4.1.2. This is due to missing nonce validation and the plugin not properly validating a file or its path prior to deleting it in the 'wp_cf7_pdf_dashboard_html_page' function. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover CVSSv3.1 8.8 (HIGH)

CWECWE 352VNDZealouswebVNDGenerateTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-07-09
2024-07-09 08:15Z
HIGH

CVE-2024-6316 — Zealousweb Generate_pdf_using_contact_form_7: The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-6316

The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 4.1.2. This is due to missing nonce validation and missing file type validation in the 'wp_cf7_pdf_dashboard_html_page' function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible via a forged request granted they CVSSv3.1 8.8 (HIGH)

CWECWE 352VNDZealouswebVNDGenerateTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-07-09
2024-07-09 08:15Z
CRIT

CVE-2024-6314 — Testimonials: The IQ Testimonials plugin for WordPress is vulnerable to arbitrary file uploads due to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-6314

The IQ Testimonials plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'process_image_upload' function in versions up to, and including, 2.2.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. This can only be exploited if the 'gd' php extension is not loaded on the server. CVSSv3.1 9.8 (CRITICAL)

CWECWE 434VNDTestimonialsTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-07-09
2024-07-09 08:15Z
CRIT

CVE-2024-6313 — Gutenberg: The Gutenberg Forms plugin for WordPress is vulnerable to arbitrary file uploads due to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-6313

The Gutenberg Forms plugin for WordPress is vulnerable to arbitrary file uploads due to the users can specify the allowed file types in the 'upload' function in versions up to, and including, 2.2.9. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. CVSSv3.1 9.8 (CRITICAL)

CWECWE 434VNDGutenbergTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-07-09
2024-07-09 08:15Z
HIGH

CVE-2024-6310 — Advanced: The Advanced AJAX Page Loader plugin for WordPress is vulnerable to Cross-Site Request Forgery

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-6310

The Advanced AJAX Page Loader plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 2.7.7. This is due to missing nonce validation in the 'admin_init_AAPL' function and missing file type validation in the 'AAPL_options_validate' function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible via a forged req CVSSv3.1 8.8 (HIGH)

CWECWE 352VNDAdvancedTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-07-09
2024-07-09 08:15Z
HIGH

CVE-2024-6309 — Attachment: The Attachment File Icons (AF Icons) plugin for WordPress is vulnerable to Cross-Site Request

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-6309

The Attachment File Icons (AF Icons) plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 1.3. This is due to missing nonce validation in the 'afi_overview' function and missing file type validation in the 'upload_icons' function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible via a forged request gr CVSSv3.1 8.8 (HIGH)

CWECWE 352VNDAttachmentTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
728 × 90 / responsive · programmatic ad slot
2024-07-09
2024-07-09 08:15Z
HIGH

CVE-2024-6161 — Default: The Default Thumbnail Plus plugin for WordPress is vulnerable to arbitrary file uploads due

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-6161

The Default Thumbnail Plus plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'get_cache_image' function in all versions up to, and including, 1.0.2.3. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible. CVSSv3.1 8.8 (HIGH)

CWECWE 434TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-07-09
2024-07-09 08:15Z
CRIT

CVE-2024-37555 — Zealousweb Generate_pdf_using_contact_form_7: Unrestricted Upload of File with Dangerous Type vulnerability in ZealousWeb Generate PDF using Contact

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-37555

Unrestricted Upload of File with Dangerous Type vulnerability in ZealousWeb Generate PDF using Contact Form 7 generate-pdf-using-contact-form-7.This issue affects Generate PDF using Contact Form 7: from n/a through <= 4.1.2. CVSSv3.1 9.1 (CRITICAL)

CWECWE 434VNDZealouswebTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2024-07-09
2024-07-09 06:15Z
HIGH

CVE-2024-5441 — Webnus Modern_events_calendar: The Modern Events Calendar plugin for WordPress is vulnerable to arbitrary file uploads due

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-5441

The Modern Events Calendar plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_featured_image function in all versions up to, and including, 7.11.0. This makes it possible for authenticated attackers, with subscriber access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The plugin allows administrators (via its settings) to extend the ability to submit ev CVSSv3.1 8.8 (HIGH)

CWECWE 434VNDWebnusVNDModernTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-07-09
2024-07-09 05:15Z
HIGH

CVE-2024-6166 — Unlimited-elements Unlimited_elements_for_elementor_\(free_widgets\,_addons\,_templ: The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vuln

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-6166

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘addons_order’ parameter in all versions up to, and including, 1.5.112 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above and granted plugin setting edit permissions by an ad CVSSv3.1 8.8 (HIGH)

CWECWE 89VNDUnlimited ElementsVNDUnlimitedTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-07-09
2024-07-09 04:15Z
CRIT

CVE-2024-6365 — Product: The Product Table by WBW plugin for WordPress is vulnerable to Remote Code Execution

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-6365

The Product Table by WBW plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.1 via the 'saveCustomTitle' function. This is due to missing authorization and lack of sanitization of appended data in the languages/customTitle.php file. This makes it possible for unauthenticated attackers to execute code on the server. CVSSv3.1 9.8 (CRITICAL)

CWECWE 94TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-07-09
2024-07-09 02:15Z
HIGH

CVE-2024-5793 — Houzez: The Houzez Theme - Functionality plugin for WordPress is vulnerable to SQL Injection via

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-5793

The Houzez Theme - Functionality plugin for WordPress is vulnerable to SQL Injection via the ‘currency_code’ parameter in all versions up to, and including, 3.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Custom-level (seller) access and above, to append additional SQL queries into already existing queries that can be used to extract sensiti CVSSv3.1 8.8 (HIGH)

CWECWE 89VNDHouzezTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-07-08
2024-07-08 18:15Z
HIGH

CVE-2024-6409 — A race condition vulnerability was discovered in how signals are handled by OpenSSH's server

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-6409

A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). As a consequence of a successful attack, in the worst case scenario, an attacker may be able to perform a remote code execution (RCE) as an unprivil CVSSv3.1 7.0 (HIGH) · EPSS 98th percentile

CWECWE 364TYPVulnerability
7.0
CVSS v3.1
93
Edit Score
2024-07-05
2024-07-05 07:15Z
HIGH

CVE-2024-39480 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: kdb: Fix buffer overflow

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-39480

In the Linux kernel, the following vulnerability has been resolved: kdb: Fix buffer overflow during tab-complete Currently, when the user attempts symbol completion with the Tab key, kdb will use strncpy() to insert the completed symbol into the command buffer. Unfortunately it passes the size of the source buffer rather than the destination to strncpy() with predictably horrible results. Most obviously if the command buffer is already full but cp, the cursor position, is i CVSSv3.1 8.4 (HIGH)

CWECWE 120CWECWE 121TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2024-07-04
2024-07-04 12:15Z
HIGH

CVE-2024-5943 — Kylephillips Nested_pages: The Nested Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-5943

The Nested Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.7. This is due to missing or incorrect nonce validation on the 'settingsPage' function and missing santization of the 'tab' parameter. This makes it possible for unauthenticated attackers to call local php files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVSSv3.1 8.8 (HIGH)

CWECWE 352VNDKylephillipsVNDNestedTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-07-04
2024-07-04 09:15Z
HIGH

CVE-2024-6319 — Wbolt Imgspider: The IMGspider plugin for WordPress is vulnerable to arbitrary file uploads due to missing

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-6319

The IMGspider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload' function in all versions up to, and including, 2.3.10. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible. CVSSv3.1 8.8 (HIGH)

CWECWE 434VNDWboltVNDImgspiderTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-07-04
2024-07-04 09:15Z
HIGH

CVE-2024-6318 — Wbolt Imgspider: The IMGspider plugin for WordPress is vulnerable to arbitrary file uploads due to missing

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-6318

The IMGspider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload_img_file' function in all versions up to, and including, 2.3.10. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible. CVSSv3.1 8.8 (HIGH)

CWECWE 434VNDWboltVNDImgspiderTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-07-04
2024-07-04 04:15Z
HIGH

CVE-2024-2385 — Livemeshelementor Addons_for_elementor: The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Local File Inclusion

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-2385

The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8.4 via several of the plugin's widgets through the 'style' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve CVSSv3.1 8.8 (HIGH)

CWECWE 22VNDElementorVNDLivemeshelementorTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-07-02
2024-07-02 07:15Z
CRIT

CVE-2024-6172 — Icegram Email_subscribers_\&_newsletters: The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress &

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-6172

The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the db parameter in all versions up to, and including, 5.7.25 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries CVSSv3.1 9.8 (CRITICAL)

CWECWE 89VNDIcegramTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-07-02
2024-07-02 05:15Z
HIGH

CVE-2024-5349 — La-studioweb Element_kit_for_elementor: The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-5349

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.8.1 via the 'map_style' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases CVSSv3.1 8.8 (HIGH)

CWECWE 22VNDLa StudiowebVNDStudioTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-07-01
2024-07-01 13:15Z
HIGH

CVE-2024-6387 — Sonicwall Sma_6200_firmware: There is a race condition which can lead sshd to handle some signals in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-6387

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period. CVSSv3.1 8.1 (HIGH) · EPSS 98th percentile

CWECWE 362CWECWE 364VNDAristaVNDSonicwallVNDCanonicalTYPVulnerability
8.1
CVSS v3.1
100
Edit Score
2024-06-29
2024-06-29 13:15Z
HIGH

CVE-2024-2386 — WordPress: The WordPress Plugin for Google Maps – WP MAPS plugin for WordPress is vulnerable

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-2386

The WordPress Plugin for Google Maps – WP MAPS plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'put_wpgm' shortcode in all versions up to, and including, 4.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that ca CVSSv3.1 8.8 (HIGH)

CWECWE 89VNDWordpressTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-06-29
2024-06-29 05:15Z
CRIT

CVE-2024-6265 — Ayecode Userswp: The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-6265

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uwp_sort_by’ parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing CVSSv3.1 9.8 (CRITICAL)

CWECWE 89VNDAyecodeVNDUserswpTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-06-28
2024-06-28 23:15Z
CRIT

CVE-2024-37371 — Mit Kerberos_5: In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-37371

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields. CVSSv3.1 9.1 (CRITICAL) · EPSS 86th percentile

CWECWE 125VNDMitTYPVulnerability
9.1
CVSS v3.1
96
Edit Score