Explore CVE records

HighPublished 06 Dec 2024, 19:35 WIB

CVE-2024-10774

SICK InspectorP61x and SICK InspectorP62x have unauthenticated CROWN APIs

Unauthenticated CROWN APIs allow access to critical functions. This leads to the accessibility of large parts of the web application without authentication.

Excerpt language: en.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated09 Dec 2024, 21:48 WIB

Official record

CritPublished 06 Dec 2024, 19:31 WIB

CVE-2024-10773

SICK InspectorP61x, SICK InspectorP62x and SICK TiM3xx are vulnerable for pass-the-hash attacks

The product is vulnerable to pass-the-hash attacks in combination with hardcoded credentials of hidden user levels. This means that an attacker can log in with the hidden user levels and gain full access to the device.

Excerpt language: en.

HighPublished 06 Dec 2024, 19:28 WIB

CVE-2024-10772

SICK InspectorP61x and SICK InspectorP62x are vulnerable for firmware modification

Since the firmware update is not validated, an attacker can install modified firmware on the device. This has a high impact on the availabilty, integrity and confidentiality up to the complete compromise of the device.

Excerpt language: en.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated09 Dec 2024, 21:46 WIB

Official record

HighPublished 06 Dec 2024, 19:24 WIB

CVE-2024-10771

SICK InspectorP61x, SICK InspectorP62x and SICK TiM3xx are vulnerable for remote code execution

Due to missing input validation during one step of the firmware update process, the product is vulnerable to remote code execution. With network access and the user level ”Service”, an attacker can execute arbitrary system commands in the root user’s contexts.

Excerpt language: en.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated13 May 2026, 19:04 WIB

Official record

MedPublished 06 Dec 2024, 19:13 WIB

CVE-2024-11022

SICK InspectorP61x and SICK InspectorP62x are vulnerable for a replay attack

The authentication process to the web server uses a challenge response procedure which inludes the nonce and additional information. This challenge can be used several times for login and is therefore vulnerable for a replay attack.

Excerpt language: en.

CVSS5.6v3.1KEVNot listedEPSSPresentUpdated07 Dec 2024, 01:18 WIB

Official record

MedPublished 06 Dec 2024, 18:09 WIB

CVE-2024-11729

KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Subscriber+) SQL Injection

The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'service_list[0][service_id]' parameter of the get_widget_payment_options AJAX action in all versions up to, and including, 3.6.4 due to insufficient escaping on the user supplied parameter and lack of su…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:04 WIB

Official record

MedPublished 06 Dec 2024, 18:09 WIB

CVE-2024-11730

KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Doctor/Receptionist+) SQL Injection

The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'sort[]' parameter of the static_data_list AJAX action in all versions up to, and including, 3.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the exi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:44 WIB

Official record

UnscoredPublished 06 Dec 2024, 16:37 WIB

CVE-2024-53142

initramfs: avoid filename buffer overrun

In the Linux kernel, the following vulnerability has been resolved: initramfs: avoid filename buffer overrun The initramfs filename field is defined in Documentation/driver-api/early-userspace/buffer-format.rst as: 37 cpio_file := ALGN(4) + cpio_header + filename + "\0" + ALGN(4) + data ... 55 ============= ======…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 03:51 WIB

Official record

HighPublished 06 Dec 2024, 16:37 WIB

CVE-2024-53141

netfilter: ipset: add missing range check in bitmap_ip_uadt

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: add missing range check in bitmap_ip_uadt When tb[IPSET_ATTR_IP_TO] is not present but tb[IPSET_ATTR_CIDR] exists, the values of ip and ip_to are slightly swapped. Therefore, the range check for ip should be done later, but this par…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 04:41 WIB

Official record

MedPublished 06 Dec 2024, 16:23 WIB

CVE-2024-10681

ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.51 - Authenticated (Subscriber+) Arbitrary Shortcode Execution

The The ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.0.51. This is due to the software allowing users to execute an action that does not properly validate a value b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.3v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:31 WIB

Official record

HighPublished 06 Dec 2024, 16:22 WIB

CVE-2024-11460

Verowa Connect <= 3.0.1 - Unauthenticated SQL Injection

The Verowa Connect plugin for WordPress is vulnerable to SQL Injection via the 'search_string' parameter in all versions up to, and including, 3.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attac…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:13 WIB

Official record

HighPublished 06 Dec 2024, 16:22 WIB

CVE-2024-11289

Soledad <= 8.5.9 - Unauthenticated Limited Local File Inclusion

The Soledad theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8.5.9 via several functions like penci_archive_more_post_ajax_func, penci_more_post_ajax_func, and penci_more_featured_post_ajax_func. This makes it possible for unauthenticated attackers to include and execute P…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:09 WIB

Official record

HighPublished 06 Dec 2024, 16:22 WIB

CVE-2024-11728

KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Unauthenticated SQL Injection

The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'visit_type[service_id]' parameter of the tax_calculated_data AJAX action in all versions up to, and including, 3.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient pre…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:53 WIB

Official record

MedPublished 06 Dec 2024, 16:22 WIB

CVE-2024-10909

Pojo Forms <= 1.4.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via form_preview_shortcode

The The Pojo Forms plugin for WordPress is vulnerable to arbitrary shortcode execution via form_preview_shortcode AJAX action in all versions up to, and including, 1.4.7. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it po…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.3v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:52 WIB

Official record

MedPublished 06 Dec 2024, 15:24 WIB

CVE-2024-11339

Smart PopUp Blaster <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Smart PopUp Blaster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spb-button' shortcode in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:28 WIB

Official record

MedPublished 06 Dec 2024, 15:24 WIB

CVE-2024-10689

XLTab – Accordions and Tabs for Elementor Page Builder <= 1.4 - Authenticated (Contributor+) Post Disclosure

The XLTab – Accordions and Tabs for Elementor Page Builder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4 via the 'XLTAB_INSERT_TPL' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with C…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:27 WIB

Official record

MedPublished 06 Dec 2024, 15:24 WIB

CVE-2024-10692

PowerPack Elementor Addons (Free Widgets, Extensions and Templates) <= 2.8.1 - Authenticated (Contributor+) Post Disclosure

The PowerPack Elementor Addons (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.8.1 via the Content Reveal widget due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:24 WIB

Official record

MedPublished 06 Dec 2024, 15:24 WIB

CVE-2024-11204

ForumWP – Forum & Discussion Board <= 2.1.2 - Reflected Cross-Site Scripting via url Parameter

The ForumWP – Forum & Discussion Board plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:23 WIB

Official record

CritPublished 06 Dec 2024, 15:24 WIB

CVE-2024-12155

SV100 Companion <= 2.0.02 - Missing Authorization to Unuathenticated Arbitrary Options Update

The SV100 Companion plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the settings_import() function in all versions up to, and including, 2.0.02. This makes it possible for unauthenticated attackers to update arbitrary opt…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:20 WIB

Official record

MedPublished 06 Dec 2024, 15:24 WIB

CVE-2024-11823

Folder Gallery <= 1.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Folder Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'foldergallery' shortcode in all versions up to, and including, 1.7.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with con…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:16 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage