Explore CVE records

HighPublished 20 Nov 2024, 16:36 WIB

CVE-2024-11494

**UNSUPPORTED WHEN ASSIGNED** The improper authentication vulnerability in the Zyxel P-6101C ADSL modem firmware version P-6101CSA6AP_20140331 could allow an unauthenticated attacker to read some device information via a crafted HTTP HEAD method.

Excerpt language: en.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated20 Nov 2024, 21:52 WIB

Official record

MedPublished 20 Nov 2024, 16:31 WIB

CVE-2024-11179

MStore API <= 4.15.7 - Authenticated (Subscriber+) SQL Injection

The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to SQL Injection via the 'status_type' parameter in all versions up to, and including, 4.15.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

MedPublished 20 Nov 2024, 16:31 WIB

CVE-2024-10891

Save as PDF Plugin by Pdfcrowd <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Save as PDF Plugin by Pdfcrowd plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'save_as_pdf_pdfcrowd' shortcode in all versions up to, and including, 4.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authentica…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:46 WIB

Official record

MedPublished 20 Nov 2024, 16:31 WIB

CVE-2024-10665

Yaad Sarig Payment Gateway For WC <= 2.2.4 - Missing Authorization to Authenticated (Subscriber+) Log Read/Deletion

The Yaad Sarig Payment Gateway For WC plugin for WordPress is vulnerable to unauthorized modification & access of data due to a missing capability check on the yaadpay_view_log_callback() and yaadpay_delete_log_callback() functions in all versions up to, and including, 2.2.4. This makes it possible for authenticated at…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:35 WIB

Official record

MedPublished 20 Nov 2024, 15:37 WIB

CVE-2024-10126

Local file inclusion vulnerability in M-Files Server

Local File Inclusion vulnerability in M-Files Server in versions before 24.11 (excluding 24.8 SR1, 24.2 SR3 and 23.8 SR7) allows an authenticated user to read server local files of a limited set of filetypes via document preview.

Excerpt language: en.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated23 Feb 2026, 17:20 WIB

Official record

CritPublished 20 Nov 2024, 15:36 WIB

CVE-2024-10127

Support for authentication bypass condition in M-Files LDAP authentication

Authentication bypass condition in LDAP authentication in M-Files server versions before 24.11 supported usage of OpenLDAP configurations that allowed user authentication without a password when the LDAP server itself had the vulnerable configuration.

Excerpt language: en.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated23 Feb 2026, 17:21 WIB

Official record

MedPublished 20 Nov 2024, 15:33 WIB

CVE-2024-11176

Incorrect evaluation of effective permissions in M-Files Aino

Improper access control vulnerability in M-Files Aino in versions before 24.10 allowed an authenticated user to access object information via incorrect evaluation of effective permissions.

Excerpt language: en.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated23 Feb 2026, 17:22 WIB

Official record

MedPublished 20 Nov 2024, 14:30 WIB

CVE-2024-47865

Missing authentication for critical function vulnerability exists in Rakuten Turbo 5G firmware version V1.3.18 and earlier. If this vulnerability is exploited, a remote unauthenticated attacker may update or downgrade the firmware on the device.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated20 Nov 2024, 22:16 WIB

Official record

HighPublished 20 Nov 2024, 14:30 WIB

CVE-2024-48895

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Rakuten Turbo 5G firmware version V1.3.18 and earlier. If this vulnerability is exploited, a remote authenticated attacker may execute an arbitrary OS command.

Excerpt language: en.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated20 Nov 2024, 22:16 WIB

Official record

MedPublished 20 Nov 2024, 14:29 WIB

CVE-2024-52033

Exposure of sensitive system information to an unauthorized control sphere issue exists in Rakuten Turbo 5G firmware version V1.3.18 and earlier. If this vulnerability is exploited, a remote unauthenticated attacker may obtain information of the other devices connected through the Wi-Fi.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated20 Nov 2024, 22:05 WIB

Official record

MedPublished 20 Nov 2024, 13:42 WIB

CVE-2024-10365

The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.0.3 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates

The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.3 via the render function in modules/widgets/tp_carousel_anything.php, modules/widgets/tp_page_scroll.php, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:33 WIB

Official record

HighPublished 20 Nov 2024, 13:42 WIB

CVE-2024-10855

Image Optimizer, Resizer and CDN – Sirv <= 7.3.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Option Deletion

The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to insufficient validation on the filename parameter of the sirv_upload_file_by_chunks() function and lack of in all versions up to, and including, 7.3.0. This ma…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:26 WIB

Official record

HighPublished 20 Nov 2024, 13:42 WIB

CVE-2024-10899

WooCommerce Product Table Lite <= 3.8.6 - Unauthenticated Arbitrary Shortcode Execution & Reflected Cross-Site Scripting

The The WooCommerce Product Table Lite plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.8.6. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthen…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:21 WIB

Official record

MedPublished 20 Nov 2024, 13:42 WIB

CVE-2024-9239

Booster for WooCommerce <= 7.2.3 - Reflected Cross-Site Scripting

The Booster for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 7.2.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:20 WIB

Official record

MedPublished 20 Nov 2024, 13:42 WIB

CVE-2024-8726

MailChimp Forms by MailMunch <= 3.2.3 - Reflected Cross-Site Scripting

The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.2.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that ex…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:12 WIB

Official record

MedPublished 20 Nov 2024, 13:42 WIB

CVE-2024-10900

ProfileGrid – User Profiles, Groups and Communities <= 5.9.3.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Meta Deletion

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pm_remove_file_attachment() function in all versions up to, and including, 5.9.3.6. This makes it possible for authenticated attackers, with subscriber…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:12 WIB

Official record

MedPublished 20 Nov 2024, 13:42 WIB

CVE-2024-11277

404 Solution <= 2.35.19 - Reflected Cross-Site Scripting

The 404 Solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URLs in all versions up to, and including, 2.35.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:42 WIB

Official record

UnscoredPublished 20 Nov 2024, 13:00 WIB

CVE-2024-10515

SEO Plugin by Squirrly SEO < 12.3.21 - Editor+ Stored XSS

In the process of testing the SEO Plugin by Squirrly SEO WordPress plugin before 12.3.21, a vulnerability was found that allows you to implement Stored XSS on behalf of the editor by embedding malicious script, which entails account takeover backdoor

Excerpt language: en.

CVSS—KEVNot listedEPSSPresentUpdated20 Nov 2024, 22:33 WIB

Official record

MedPublished 20 Nov 2024, 12:32 WIB

CVE-2024-9653

Restaurant Menu – Food Ordering System – Table Reservation <= 2.4.2 - Reflected Cross-Site Scripting

The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'action' parameter in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:36 WIB

Official record

MedPublished 20 Nov 2024, 12:12 WIB

CVE-2024-52614

Use of hard-coded cryptographic key issue exists in "Kura Sushi Official App Produced by EPARK" for Android versions prior to 3.8.5. If this vulnerability is exploited, a local attacker may obtain the login ID and password for the affected product.

Excerpt language: en.

CVSS4v3.0KEVNot listedEPSSPresentUpdated20 Nov 2024, 22:16 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage