Explore CVE records

MedPublished 16 Dec 2024, 22:53 WIB

CVE-2024-55999

WordPress XML Multilanguage Sitemap Generator plugin <= 2.0.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in Marco Giannini XML Multilanguage Sitemap Generator xml-multilanguage-sitemap-generator.This issue affects XML Multilanguage Sitemap Generator: from n/a through <= 2.0.6.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

MedPublished 16 Dec 2024, 22:51 WIB

CVE-2024-54348

WordPress Brandy theme <= 1.1.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yaycommerce Brand brand allows Stored XSS.This issue affects Brand: from n/a through <= 1.1.6.

Excerpt language: en.

CritPublished 16 Dec 2024, 22:50 WIB

CVE-2024-54285

WordPress SeedProd Pro plugin <= 6.18.10 - Remote Code Execution (RCE) vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in SeedProd LLC SeedProd Pro allows Upload a Web Shell to a Web Server.This issue affects SeedProd Pro: from n/a through 6.18.10.

Excerpt language: en.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

HighPublished 16 Dec 2024, 22:47 WIB

CVE-2024-54284

WordPress SeedProd Pro plugin <= 6.18.10 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SeedProd LLC SeedProd Pro allows SQL Injection.This issue affects SeedProd Pro: from n/a through 6.18.10.

Excerpt language: en.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

HighPublished 16 Dec 2024, 22:46 WIB

CVE-2024-54283

WordPress SeedProd Pro plugin <= 6.18.10 - SQL Injection vulnerability

Excerpt language: en.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

CritPublished 16 Dec 2024, 22:43 WIB

CVE-2024-54280

WordPress WPBookit plugin <= 1.6.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design WPBookit wpbookit allows SQL Injection.This issue affects WPBookit: from n/a through <= 1.6.0.

Excerpt language: en.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

HighPublished 16 Dec 2024, 22:41 WIB

CVE-2024-54279

WordPress WP-NERD Toolkit plugin <= 1.1 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Tobias Keller WP-NERD Toolkit wp-nerd-toolkit.This issue affects WP-NERD Toolkit: from n/a through <= 1.1.

Excerpt language: en.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 16:51 WIB

Official record

HighPublished 16 Dec 2024, 22:40 WIB

CVE-2024-54257

WordPress tydskrif theme <= 1.1.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Molefed allows Reflected XSS.This issue affects tydskrif: from n/a through 1.1.3.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

HighPublished 16 Dec 2024, 22:37 WIB

CVE-2024-54249

WordPress Advanced Options Editor plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jules Colle Advanced Options Editor allows Reflected XSS.This issue affects Advanced Options Editor: from n/a through 1.0.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

CritPublished 16 Dec 2024, 22:36 WIB

CVE-2024-43234

WordPress Woffice theme <= 5.4.14 - Unauthenticated Account Takeover vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in WofficeIO Woffice woffice allows Authentication Bypass.This issue affects Woffice: from n/a through <= 5.4.14.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 16:51 WIB

Official record

MedPublished 16 Dec 2024, 22:31 WIB

CVE-2024-12653

FabulaTech USB over Network IOCT ftusbbus2.sys 0x22040C null pointer dereference

A vulnerability classified as problematic has been found in FabulaTech USB over Network 6.0.6.1. Affected is the function 0x22040C in the library ftusbbus2.sys of the component IOCT Handler. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated16 Dec 2024, 23:24 WIB

Official record

CritPublished 16 Dec 2024, 22:18 WIB

CVE-2024-54229

WordPress SV100 Companion plugin <= 2.0.02 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in straightvisions GmbH SV100 Companion sv100-companion allows Privilege Escalation.This issue affects SV100 Companion: from n/a through <= 2.0.02.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 05:26 WIB

Official record

HighPublished 16 Dec 2024, 22:07 WIB

CVE-2024-12092

Stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x

A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

Excerpt language: en.

CVSS8.7v3.1KEVNot listedEPSSPresentUpdated16 Dec 2024, 23:27 WIB

Official record

HighPublished 16 Dec 2024, 22:06 WIB

CVE-2024-12091

Stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x

A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

Excerpt language: en.

CVSS8.7v3.1KEVNot listedEPSSPresentUpdated16 Dec 2024, 23:29 WIB

Official record

HighPublished 16 Dec 2024, 22:06 WIB

CVE-2024-12090

Stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x

Excerpt language: en.

CVSS8.7v3.1KEVNot listedEPSSPresentUpdated16 Dec 2024, 23:31 WIB

Official record

HighPublished 16 Dec 2024, 22:06 WIB

CVE-2024-12089

Stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x

Excerpt language: en.

CVSS8.7v3.1KEVNot listedEPSSPresentUpdated16 Dec 2024, 23:32 WIB

Official record

CritPublished 16 Dec 2024, 22:06 WIB

CVE-2024-49775

A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2501.0001), Opcenter Intelligence (All versions < V2501.0001), Opcenter Quality (All versions < V2512), Opcenter RDnL (All versions < V2410), SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions < V4.1 Update 3), SI…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated13 Jan 2026, 16:43 WIB

Official record

MedPublished 16 Dec 2024, 22:03 WIB

CVE-2024-37251

WordPress Advanced Custom Fields Pro plugin < 6.3.2 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in WPENGINE, INC. Advanced Custom Fields PRO.This issue affects Advanced Custom Fields PRO: from n/a before 6.3.2.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:09 WIB

Official record

HighPublished 16 Dec 2024, 21:56 WIB

CVE-2024-12668

Velocidex WinPmem Out of Bounds Write Vulnerability

Velocidex WinPmem versions below 4.1 suffer from an Out of Bounds Write vulnerability. By using an IO Control, a user space program can trick the driver into writing a 0 into any chosen memory location. In conjunction with information leakage from the WinPmem driver, attackers can discover the location in memory for th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated16 Dec 2024, 23:14 WIB

Official record

HighPublished 16 Dec 2024, 21:49 WIB

CVE-2024-10972

WinPmem Improper Input Validation vulnerability

Velocidex WinPmem versions 4.1 and below suffer from an Improper Input Validation vulnerability whereby an attacker with admin access can trigger a BSOD with a parallel thread changing the memory’s access right under the control of the user-mode application. This is due to verification only being performed at the begin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated05 Sep 2025, 15:40 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage