Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38,726 results · page 285 of 775
Dec 19, 2024Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ISDO Software Web Software allows SQL Injection.CVE-2024-10244 · Other software · ISDO Software · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ISDO Software Web Software allows SQL Injection. This issue affects Web Software: before 3.6.
- Product
- Web Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Dec 19, 2024A relative path traversal vulnerability (CWE-23) in FortiWAN version 4.5.7 and below, 4.4 all versions may allow a remote non-authenticated attacker to delete fCVE-2021-26102 · Network & remote access · Fortinet · reported by psirt@fortinet.comCritical 9.8
A relative path traversal vulnerability (CWE-23) in FortiWAN version 4.5.7 and below, 4.4 all versions may allow a remote non-authenticated attacker to delete files on the system by sending a crafted POST request. In particular, deleting specific configuration files will reset the Admin password to its default value.
- Product
- FortiWAN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.com
Dec 19, 2024AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in: Reflected Cross-Site ScriptingCVE-2024-12626 · WordPress plugins & themes · reported by WordfenceCritical 9.6
The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘a-0-o-search_field_value’ parameter in all versions up to, and including, 5.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. When used in conjunction with the plugin's import and code action feature, this vulnerability can be leveraged to execute arbitrary code.
- Product
- AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in
- Affected
- up to 5.0.9
- What to do
- Affects up to 5.0.9. Update AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 19, 2024Incorrect authorization vulnerability in HTTP POST method in Govee Home application on Android and iOS allows remote attacker to control devices owned by other CVE-2023-4617 · Other software · Govee · reported by cvd@cert.plCritical 10
Incorrect authorization vulnerability in HTTP POST method in Govee Home application on Android and iOS allows remote attacker to control devices owned by other users via changing "device", "sku" and "type" fields' values. This issue affects Govee Home applications on Android and iOS in versions before 5.9.
- Product
- Govee Home
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024A unrestricted upload of file with dangerous type vulnerability in epaper draft function in Corporate Training Management System before 10.13 allows remote authCVE-2024-11984 · Other software · SUNNET Technology Co., Ltd. · reported by ART@zuso.aiCritical 9.4
A unrestricted upload of file with dangerous type vulnerability in epaper draft function in Corporate Training Management System before 10.13 allows remote authenticated users to bypass file upload restrictions and perform arbitrary system commands with SYSTEM privilege via a crafted ZIP file.
- Product
- Corporate Training Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024SeaCMS <=13.0 is vulnerable to command execution in phome.php via the function Ebak_RepPathFiletext().CVE-2024-55461 · Other software · Seacms · reported by MITRECritical 9.8
SeaCMS <=13.0 is vulnerable to command execution in phome.php via the function Ebak_RepPathFiletext().
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024Craft CMS Code Injection VulnerabilityCVE-2024-56145 · Other software · Craft CMS · reported by GitHubExploitedCritical 9.3
Craft CMS contains a code injection vulnerability. Users with affected versions are vulnerable to remote code execution if their php.ini configuration has `register_argc_argv` enabled.
- Product
- Craft CMS
- On CISA’s list since
- Jun 2, 2025 (federal fix deadline Jun 23, 2025)
- What to do
- Attackers are using this now. Install Craft CMS’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comgithub.com
Dec 18, 2024WPLMS: Unrestricted Upload of File with Dangerous TypeCVE-2024-56057 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.2.
- Product
- WPLMS
- Fixed in
- 1.9.9.5.2
- What to do
- Update WPLMS to 1.9.9.5.2 or newer.
Dec 18, 2024WPLMS: Unrestricted Upload of File with Dangerous TypeCVE-2024-56054 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.2.
- Product
- WPLMS
- Fixed in
- 1.9.9.5.2
- What to do
- Update WPLMS to 1.9.9.5.2 or newer.
Dec 18, 2024WPLMS: Unrestricted Upload of File with Dangerous TypeCVE-2024-56052 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.2.
- Product
- WPLMS
- Fixed in
- 1.9.9.5.2
- What to do
- Update WPLMS to 1.9.9.5.2 or newer.
Dec 18, 2024WPLMS: Unrestricted Upload of File with Dangerous TypeCVE-2024-56050 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.3.
- Product
- WPLMS
- Fixed in
- 1.9.9.5.3
- What to do
- Update WPLMS to 1.9.9.5.3 or newer.
Dec 18, 2024WooCommerce PDF Vouchers: Incorrect Privilege AssignmentCVE-2024-54383 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in wpweb WooCommerce PDF Vouchers woocommerce-pdf-vouchers allows Privilege Escalation.This issue affects WooCommerce PDF Vouchers: from n/a through < 4.9.9.
- Product
- WooCommerce PDF Vouchers
- Fixed in
- 4.9.9
- What to do
- Update WooCommerce PDF Vouchers to 4.9.9 or newer.
Dec 18, 2024There is a possible UAF due to a logic error in the code.CVE-2024-47040 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comCritical 10
There is a possible UAF due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024In isSlotMarkedSuccessful of BootControl.cpp, there is a possible out of bounds read due to a missing bounds check.CVE-2024-47039 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comCritical 10
In isSlotMarkedSuccessful of BootControl.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024In dhd_prot_flowrings_pool_release of dhd_msgbuf.c, there is a possible outcof bounds write due to a missing bounds check.CVE-2024-47038 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comCritical 10
In dhd_prot_flowrings_pool_release of dhd_msgbuf.c, there is a possible outcof bounds write due to a missing bounds check. This could lead to localcescalation of privilege with no additional execution privileges needed. Usercinteraction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024A denial-of-service vulnerability exists in the Rockwell Automation Power Monitor 1000.CVE-2024-12373 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comCritical 9.3
A denial-of-service vulnerability exists in the Rockwell Automation Power Monitor 1000. The vulnerability results in a buffer-overflow, potentially causing denial-of-service.
- Product
- PM1k 1408-BC3A-485
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Dec 18, 2024A denial-of-service and possible remote code execution vulnerability exists in the Rockwell Automation Power Monitor 1000.CVE-2024-12372 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comCritical 9.3
A denial-of-service and possible remote code execution vulnerability exists in the Rockwell Automation Power Monitor 1000. The vulnerability results in corruption of the heap memory which may compromise the integrity of the system, potentially allowing for remote code execution or a denial-of-service attack.
- Product
- PM1k 1408-BC3A-485
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Dec 18, 2024A device takeover vulnerability exists in the Rockwell Automation Power Monitor 1000.CVE-2024-12371 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comCritical 9.3
A device takeover vulnerability exists in the Rockwell Automation Power Monitor 1000. This vulnerability allows configuration of a new Policyholder user without any authentication via API. Policyholder user is the most privileged user that can perform edit operations, creating admin users and performing factory reset.
- Product
- PM1k 1408-BC3A-485
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Dec 18, 2024A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via CVE-2023-34990 · Network & remote access · Fortinet · reported by psirt@fortinet.comCritical 9.8
A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specially crafted web requests.
- Product
- FortiWLM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024Partners: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')CVE-2024-56059 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in farinspace Partners partners allows Object Injection.This issue affects Partners: from n/a through <= 0.2.0.
- Product
- Partners
- Affected
- up to 0.2.0
- What to do
- Affects up to 0.2.0. Update Partners to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2024VRPConnector: Deserialization of Untrusted DataCVE-2024-56058 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in denniskravetstns VRPConnector vrpconnector allows Object Injection.This issue affects VRPConnector: from n/a through <= 2.0.1.
- Product
- VRPConnector
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update VRPConnector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2024Use of a hard-coded password for a database administrator account created during Wapro ERP installation allows an attacker to retrieve embedded sensitive data sCVE-2024-4996 · Other software · Asseco Business Solutions S.A. · reported by cvd@cert.plCritical 9.3
Use of a hard-coded password for a database administrator account created during Wapro ERP installation allows an attacker to retrieve embedded sensitive data stored in the database. The password is same among all Wapro ERP installations. This issue affects Wapro ERP Desktop versions before 8.90.0.
- Product
- Wapro ERP Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024Wapro ERP Desktop is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data inteCVE-2024-4995 · Other software · Asseco Business Solutions S.A. · reported by cvd@cert.plCritical 9.1
Wapro ERP Desktop is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data interception and modification. This issue affects Wapro ERP Desktop versions before 9.00.0.
- Product
- Wapro ERP Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024Biagiotti Membership: Authentication bypassCVE-2024-12287 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Biagiotti Membership plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.0.2. This is due to the plugin not properly verifying a user's identity prior to authenticating them. This makes it possible for unauthenticated attackers to log in as other users, such as administrators, granted they have access to an email.
- Product
- Biagiotti Membership
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Biagiotti Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Dec 17, 2024rizin before v0.6.3 is vulnerable to Improper Neutralization of Special Elements via meta_set function in librz/analysis/meta.CVE-2024-31668 · Other software · Rizin · reported by MITRECritical 9.1
rizin before v0.6.3 is vulnerable to Improper Neutralization of Special Elements via meta_set function in librz/analysis/meta.
- Product
- Rizin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Dec 17, 2024Buffer Overflow vulnerability in radarorg radare2 v.5.8.8 allows an attacker to execute arbitrary code via the name, type, or group fields.CVE-2024-29646 · Other software · Radare · reported by MITRECritical 9.8
Buffer Overflow vulnerability in radarorg radare2 v.5.8.8 allows an attacker to execute arbitrary code via the name, type, or group fields.
- Product
- Radare2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Dec 17, 2024A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 v3.90.CVE-2024-55516 · Other software · Raisecom · reported by MITRECritical 9.1
A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 v3.90. The component affected by this issue is /upload_sysconfig.php on the web interface. By crafting a suitable form name, arbitrary files can be uploaded, potentially leading to unauthorized access to server permissions.
- Product
- Msg2300 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2024A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90.CVE-2024-55515 · Other software · Raisecom · reported by MITRECritical 9.8
A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90. The component affected by this issue is /upload_ipslib.php on the web interface. By crafting a suitable form name, arbitrary files can be uploaded.
- Product
- Msg2300 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2024A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90.CVE-2024-55513 · Other software · Raisecom · reported by MITRECritical 9.1
A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90. The component affected by this issue is /upload_netaction.php on the web interface. By crafting a suitable form name, arbitrary files can be uploaded, potentially leading to unauthorized access to server permissions.
- Product
- Msg2300 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2024A vulnerability has been found in the 1000projects Bookstore Management System PHP MySQL Project 1.0.CVE-2024-55496 · Other software · 1000projects · reported by MITRECritical 9.1
A vulnerability has been found in the 1000projects Bookstore Management System PHP MySQL Project 1.0. This issue affects some unknown functionality of add_company.php. Actions on the delete parameter result in SQL injection.
- Product
- Bookstore Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record1000projects.orggithub.com
Dec 17, 2024Dante 1.4.0 through 1.4.3 (fixed in 1.4.4) has incorrect access control for some sockd.conf configurations involving socksmethod.CVE-2024-54662 · Other software · reported by MITRECritical 9.1
Dante 1.4.0 through 1.4.3 (fixed in 1.4.4) has incorrect access control for some sockd.conf configurations involving socksmethod.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2024Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mobil365 Informatics Saha365 App allows SQL Injection.CVE-2024-8972 · Other software · Mobil365 Informatics · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mobil365 Informatics Saha365 App allows SQL Injection. This issue affects Saha365 App: before 30.09.2024.
- Product
- Saha365 App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Dec 17, 2024Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when theCVE-2024-50379 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
- Product
- Apache Tomcat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Dec 17, 2024BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability CVE-2024-12356 · Other software · BeyondTrust · reported by 13061848-ea10-403d-bd75-c83a022c2891ExploitedCritical 9.8
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain a command injection vulnerability, which can allow an unauthenticated attacker to inject commands that are run as a site user.
- Product
- Privileged Remote Access (PRA) and Remote Support (RS)
- On CISA’s list since
- Dec 19, 2024 (federal fix deadline Dec 27, 2024)
- What to do
- Attackers are using this now. Install BeyondTrust’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalognvd.nist.govbeyondtrust.com
Dec 16, 2024Authentication Bypass vulnerability in Hitachi Ops Center Analyzer on Linux, 64 bit (Hitachi Ops Center Analyzer detail view component), Hitachi Infrastructure CVE-2024-10205 · Other software · Hitachi · reported by hirt@hitachi.co.jpCritical 9.4
Authentication Bypass vulnerability in Hitachi Ops Center Analyzer on Linux, 64 bit (Hitachi Ops Center Analyzer detail view component), Hitachi Infrastructure Analytics Advisor on Linux, 64 bit (Hitachi Data Center Analytics component ).This issue affects Hitachi Ops Center Analyzer: from 10.0.0-00 before 11.0.3-00; Hitachi Infrastructure Analytics Advisor: from 2.1.0-00 through 4.4.0-00.
- Product
- Hitachi Ops Center Analyzer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2024GetSimple CMS CE 3.3.19 suffers from arbitrary code execution in the template editing function in the background management system, which can be used by an attaCVE-2024-55085 · Other software · Getsimple-ce · reported by MITRECritical 9.8
GetSimple CMS CE 3.3.19 suffers from arbitrary code execution in the template editing function in the background management system, which can be used by an attacker to implement RCE.
- Product
- Getsimple CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgetsimple-ce.ovhtasteful-stamp-da4.notion.site
Dec 16, 2024Buffer Overflow vulnerability in NEXTU FLATA AX1500 Router v.1.0.2 allows a remote attacker to execute arbitrary code via the POST request handler component.CVE-2024-29671 · Other software · reported by MITRECritical 9.8
Buffer Overflow vulnerability in NEXTU FLATA AX1500 Router v.1.0.2 allows a remote attacker to execute arbitrary code via the POST request handler component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordez-net.co.krgist.github.com
Dec 16, 2024ui/pref/ProxyPrefView.java in weasis-core in Weasis 4.5.1 has a hardcoded key for symmetric encryption of proxy credentials.CVE-2024-55557 · Other software · reported by MITRECritical 9.8
ui/pref/ProxyPrefView.java in weasis-core in Weasis 4.5.1 has a hardcoded key for symmetric encryption of proxy credentials.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapps.microsoft.comgithub.com
Dec 16, 2024MinIO is a high-performance, S3 compatible object store, open sourced under GNU AGPLv3 license.CVE-2024-55949 · Other software · minio · reported by GitHubCritical 9.3
MinIO is a high-performance, S3 compatible object store, open sourced under GNU AGPLv3 license. Minio is subject to a privilege escalation in IAM import API, all users are impacted since MinIO commit `580d9db85e04f1b63cc2909af50f0ed08afa965f`. This issue has been addressed in commit `f246c9053f9603e610d98439799bdd2a6b293427` which is included in RELEASE.2024-12-13T22-19-12Z. There are no workarounds possible, all users are advised to upgrade immediately.
- Product
- minio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2024The server lacks thread safety and can be crashed by anomalous data sent by an anonymous user from a remote network.CVE-2024-11144 · Other software · LightFTP · reported by disclosure@synopsys.comCritical 9.2
The server lacks thread safety and can be crashed by anomalous data sent by an anonymous user from a remote network. The crash causes the FTP service to become unavailable, affecting all users and processes that rely on it for file transfers. If the crash occurs during file upload or download, it could lead to incomplete file transfers, potentially corrupting data. The repeated crash might also affect the stability of the underlying system, especially if it leads to resource leaks or affects other services.
- Product
- LightFTP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2024SeedProd Pro: Unrestricted Upload of File with Dangerous TypeCVE-2024-54285 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in SeedProd LLC SeedProd Pro allows Upload a Web Shell to a Web Server.This issue affects SeedProd Pro: from n/a through 6.18.10.
- Product
- SeedProd Pro
- Affected
- up to 6.18.10
- What to do
- Affects up to 6.18.10. Update SeedProd Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024WPBookit: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-54280 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design WPBookit wpbookit allows SQL Injection.This issue affects WPBookit: from n/a through <= 1.6.0.
- Product
- WPBookit
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update WPBookit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024SV100 Companion: Incorrect Privilege AssignmentCVE-2024-54229 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in straightvisions GmbH SV100 Companion sv100-companion allows Privilege Escalation.This issue affects SV100 Companion: from n/a through <= 2.0.02.
- Product
- SV100 Companion
- Affected
- up to 2.0.02
- What to do
- Affects up to 2.0.02. Update SV100 Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Woffice: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-43234 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in WofficeIO Woffice woffice allows Authentication Bypass.This issue affects Woffice: from n/a through <= 5.4.14.
- Product
- Woffice
- Affected
- up to 5.4.14
- What to do
- Affects up to 5.4.14. Update Woffice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Flash News / Post (Responsive): Cross-Site Request Forgery (CSRF)CVE-2024-56012 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Cross-Site Request Forgery (CSRF) vulnerability in lizeipe Flash News / Post (Responsive) flashnews-fading-effect-pearlbells allows Privilege Escalation.This issue affects Flash News / Post (Responsive): from n/a through <= 4.1.
- Product
- Flash News / Post (Responsive)
- Affected
- up to 4.1
- What to do
- Affects up to 4.1. Update Flash News / Post (Responsive) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Navayan CSV Export: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55988 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Amol Nirmala Waman Navayan CSV Export navayan-csv-export allows Blind SQL Injection.This issue affects Navayan CSV Export: from n/a through <= 1.0.9.
- Product
- Navayan CSV Export
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Navayan CSV Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Share Buttons – Social Media: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55982 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in richteam Share Buttons – Social Media rich-web-share-button allows Blind SQL Injection.This issue affects Share Buttons – Social Media: from n/a through <= 1.0.2.
- Product
- Share Buttons – Social Media
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Share Buttons – Social Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Nabz Image Gallery: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55981 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nabajit Roy Nabz Image Gallery nabz-image-gallery allows SQL Injection.This issue affects Nabz Image Gallery: from n/a through <= v1.00.
- Product
- Nabz Image Gallery
- Affected
- up to 1.00
- What to do
- Affects up to 1.00. Update Nabz Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Wr Age Verification: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55980 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in robindkumar Wr Age Verification wr-age-verification allows SQL Injection.This issue affects Wr Age Verification: from n/a through <= 2.0.0.
- Product
- Wr Age Verification
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Wr Age Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Code Generator Pro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55978 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WalletStation Code Generator Pro code-generator-pro allows SQL Injection.This issue affects Code Generator Pro: from n/a through <= 1.2.
- Product
- Code Generator Pro
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Code Generator Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.