Explore CVE records

CritPublished 31 Dec 2024, 22:18 WIB

CVE-2024-56198

path-sanitizer allows bypassing the existing filters to achieve path-traversal vulnerability

path-sanitizer is a simple lightweight npm package for sanitizing paths to prevent Path Traversal. Prior to 3.1.0, the filters can be bypassed using .=%5c which results in a path traversal. This vulnerability is fixed in 3.1.0.

Excerpt language: en.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated31 Dec 2024, 22:50 WIB

Official record

CritPublished 31 Dec 2024, 20:20 WIB

CVE-2024-56066

WordPress Agency Toolkit plugin <= 1.0.23 - Privilege Escalation vulnerability

Missing Authorization vulnerability in inspry Agency Toolkit agency-toolkit allows Privilege Escalation.This issue affects Agency Toolkit: from n/a through <= 1.0.23.

Excerpt language: en.

CritPublished 31 Dec 2024, 20:17 WIB

CVE-2024-56045

WordPress WPLMS plugin < 1.9.9.5 - Unauthenticated Arbitrary Directory Deletion vulnerability

Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5.

Excerpt language: en.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

CritPublished 31 Dec 2024, 20:17 WIB

CVE-2024-56044

WordPress WPLMS plugin <= 1.9.9 - Unauthenticated Arbitrary User Token Generation vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in VibeThemes WPLMS wplms_plugin allows Authentication Bypass.This issue affects WPLMS: from n/a through <= 1.9.9.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

CritPublished 31 Dec 2024, 20:15 WIB

CVE-2024-56043

WordPress WPLMS plugin <= 1.9.9 - Unauthenticated Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in VibeThemes WPLMS wplms_plugin allows Privilege Escalation.This issue affects WPLMS: from n/a through <= 1.9.9.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

CritPublished 31 Dec 2024, 20:15 WIB

CVE-2024-56040

WordPress VibeBP plugin <= 1.9.9.4.1 - Unauthenticated Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in VibeThemes VibeBP vibebp allows Privilege Escalation.This issue affects VibeBP: from n/a through <= 1.9.9.4.1.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

CritPublished 31 Dec 2024, 19:57 WIB

CVE-2024-56042

WordPress WPLMS plugin < 1.9.9.5.3 - Unauthenticated SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows SQL Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.3.

Excerpt language: en.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

CritPublished 31 Dec 2024, 19:55 WIB

CVE-2024-56039

WordPress VibeBP plugin < 1.9.9.7.7 - Unauthenticated SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes VibeBP vibebp allows SQL Injection.This issue affects VibeBP: from n/a through < 1.9.9.7.7.

Excerpt language: en.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

CritPublished 31 Dec 2024, 19:54 WIB

CVE-2024-56064

WordPress WP SuperBackup plugin <= 2.3.3 - Unauthenticated Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Upload a Web Shell to a Web Server.This issue affects WP SuperBackup: from n/a through <= 2.3.3.

Excerpt language: en.

CVSS10v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

CritPublished 31 Dec 2024, 19:53 WIB

CVE-2024-56046

WordPress WPLMS plugin <= 1.9.9 - Unauthenticated Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through <= 1.9.9.

Excerpt language: en.

CVSS10v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

CritPublished 31 Dec 2024, 19:44 WIB

CVE-2024-56071

WordPress Simple Dashboard plugin <= 2.0 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in mikeleembruggen Simple Dashboard simple-dashboard allows Privilege Escalation.This issue affects Simple Dashboard: from n/a through <= 2.0.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 05:31 WIB

Official record

CritPublished 31 Dec 2024, 19:43 WIB

CVE-2024-56205

WordPress AI Magic – SEO Content Generator & Article Writer plugin <= 1.0.4 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in SunnyKai AI Magic newsletter-page-redirects allows Privilege Escalation.This issue affects AI Magic: from n/a through <= 1.0.4.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

CritPublished 31 Dec 2024, 18:13 WIB

CVE-2024-13061

2100 Technology Electronic Official Document Management System - Authentication Bypass

The Electronic Official Document Management System from 2100 Technology has an Authentication Bypass vulnerability. Although the product enforces an IP whitelist for the API used to query user tokens, unauthenticated remote attackers can still deceive the server to obtain tokens of arbitrary users, which can then be us…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated02 Jan 2025, 07:56 WIB

Official record

CritPublished 31 Dec 2024, 17:32 WIB

CVE-2024-12106

WhatsUp Gold - LDAP configuration interface leading to allowing attacker to configure LDAP settings without authentication

In WhatsUp Gold versions released before 2024.0.2, an unauthenticated attacker can configure LDAP settings.

Excerpt language: en.

CVSS9.4v3.1KEVNot listedEPSSPresentUpdated04 Jan 2025, 11:55 WIB

Official record

CritPublished 31 Dec 2024, 17:31 WIB

CVE-2024-12108

WhatsUp Gold - Public API signing key rotation issue

In WhatsUp Gold versions released before 2024.0.2, an attacker can gain access to the WhatsUp Gold server via the public API.

Excerpt language: en.

CVSS9.6v3.1KEVNot listedEPSSPresentUpdated04 Jan 2025, 11:55 WIB

Official record

CritPublished 31 Dec 2024, 17:05 WIB

CVE-2024-56220

WordPress SSL Wireless SMS Notification plugin <= 3.6.0 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in sslplugins SSL Wireless SMS Notification ssl-wireless-sms-notification allows Privilege Escalation.This issue affects SSL Wireless SMS Notification: from n/a through <= 3.6.0.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 05:30 WIB

Official record

CritPublished 31 Dec 2024, 01:20 WIB

CVE-2024-56799

Simofa Allows Unauthenticated Access to API Routes

Simofa is a tool to help automate static website building and deployment. Prior to version 0.2.7, due to a design mistake in the RouteLoader class, some API routes may be publicly accessible when they should require authentication. This vulnerability has been patched in v0.2.7.

Excerpt language: en.

CVSS10v3.1KEVNot listedEPSSPresentUpdated31 Dec 2024, 06:14 WIB

Official record

CritPublished 30 Dec 2024, 23:48 WIB

CVE-2024-12828

Webmin CGI Command Injection Remote Code Execution Vulnerability

Webmin CGI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Webmin. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of CGI requests. The issue results from the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS9.9v3.0KEVNot listedEPSSPresentUpdated31 Dec 2024, 00:35 WIB

Official record

CritPublished 30 Dec 2024, 18:47 WIB

CVE-2024-10044

SSRF in POST /worker_generate_stream API endpoint in lm-sys/fastchat

A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of the Controller API Server in lm-sys/fastchat, as of commit e208d5677c6837d590b81cb03847c0b9de100765. This vulnerability allows attackers to exploit the victim controller API server's credentials to perform unau…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS9.3v3.0KEVNot listedEPSSPresentUpdated30 Dec 2024, 21:13 WIB

Official record

CritPublished 30 Dec 2024, 17:06 WIB

CVE-2024-47926

Tecnick TCExam – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated30 Dec 2024, 21:15 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage