Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: March 2024

206 records · 8 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 3

  • CVE-2024-22891
    40Plan

    Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link.

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    nteract · nteractMar 1, 2024

  • CVE-2024-25293
    37Monitor

    mjml-app versions 3.0.4 and 3.1.0-beta were discovered to contain a remote code execution (RCE) via the href attribute.

    CriticalCVSS 9.3Proof of conceptEPSS 0%

    mjml · mjml appMar 1, 2024

  • CVE-2024-0692
    63This week

    SolarWinds Security Event Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 92%

    solarwinds · security event managerMar 1, 2024

  • CVE-2024-27497
    43Plan

    Linksys E2000 Ver.1.0.06 build 1 is vulnerable to authentication bypass via the position.js file.

    HighCVSS 8.8Proof of conceptEPSS 26%

    linksys · e2000 firmwareMar 1, 2024

  • CVE-2024-2074
    25Monitor

    Mini-Tmall 1 sql injection

    MediumCVSS 6.3Proof of conceptEPSS 0%

    Mar 1, 2024

  • CVE-2024-20328
    46Plan

    ClamAV VirusEvent File Processing Command Injection Vulnerability

    MediumCVSS 5.3No exploitEPSS 84%

    clamav · clamavMar 1, 2024

  • CVE-2023-49539
    24Monitor

    Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/index.php/category.

    MediumCVSS 6.1Proof of conceptEPSS 0%

    oretnom23 · book store management systemMar 1, 2024

  • CVE-2023-49540
    24Monitor

    Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/index.php/history.

    MediumCVSS 6.1Proof of conceptEPSS 0%

    oretnom23 · book store management systemMar 1, 2024

  • CVE-2023-49543
    39Monitor

    Incorrect access control in Book Store Management System v1 allows attackers to access unauthorized pages and execute administrative functio

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    book store management system project · book store management systemMar 1, 2024

  • CVE-2023-49544
    19Monitor

    A local file inclusion (LFI) in Customer Support System v1 allows attackers to include internal PHP files and gain unauthorized acces via ma

    MediumCVSS 4.9Proof of conceptEPSS 0%

    oretnom23 · customer support systemMar 1, 2024

  • CVE-2023-49545
    30Monitor

    A directory listing vulnerability in Customer Support System v1 allows attackers to list directories and sensitive files within the applicat

    HighCVSS 7.5Proof of conceptEPSS 0%

    oretnom23 · customer support systemMar 1, 2024

  • CVE-2024-27743
    24Monitor

    Cross Site Scripting vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payloa

    MediumCVSS 6.1Proof of conceptEPSS 1%

    mayurik · petrol pump managementMar 1, 2024

  • CVE-2024-27744
    24Monitor

    Cross Site Scripting vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payloa

    MediumCVSS 6.1Proof of conceptEPSS 1%

    mayurik · petrol pump managementMar 1, 2024

  • CVE-2024-27746
    43Plan

    SQL Injection vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to th

    CriticalCVSS 9.8Proof of conceptEPSS 12%

    mayurik · petrol pump managementMar 1, 2024

  • CVE-2024-27747
    46Plan

    File Upload vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the

    CriticalCVSS 9.8Proof of conceptEPSS 23%

    mayurik · petrol pump managementMar 1, 2024

  • CVE-2024-25438
    24Monitor

    A cross-site scripting (XSS) vulnerability in the Submission module of Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTM

    MediumCVSS 6.1No exploitEPSS 0%

    public knowledge project · open journal systemsMar 1, 2024

  • CVE-2024-28088
    33Monitor

    LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a load_ch

    HighCVSS 8.1Proof of conceptEPSS 1%

    langchain · langchainMar 3, 2024

  • CVE-2024-20017
    53Plan

    In wlan service, there is a possible out of bounds write due to improper input validation.

    CriticalCVSS 9.8Proof of conceptEPSS 46%

    mediatek · software development kitMar 3, 2024

  • CVE-2023-33105
    30Monitor

    Configuration Issue in WLAN Host and Firmware

    HighCVSS 7.5Proof of conceptEPSS 0%

    qualcomm · ar8035 firmwareMar 4, 2024

  • CVE-2023-6241
    28Monitor

    Mali GPU Kernel Driver allows improper GPU memory processing operations

    HighCVSS 7.0Proof of conceptEPSS 0%

    arm · 5th gen gpu architecture kernel driverMar 4, 2024

  • CVE-2024-27198
    99Now

    In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    jetbrains · teamcityMar 4, 2024

  • CVE-2024-27199
    89Now

    In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible

    HighCVSS 7.3KEVWeaponizedEPSS 99%

    jetbrains · teamcityMar 4, 2024

  • CVE-2023-49546
    35Monitor

    Customer Support System v1 was discovered to contain a SQL injection vulnerability via the email parameter at /customer_support/ajax.php.

    HighCVSS 8.8Proof of conceptEPSS 0%

    oretnom23 · customer support systemMar 4, 2024

  • CVE-2023-49547
    39Monitor

    Customer Support System v1 was discovered to contain a SQL injection vulnerability via the username parameter at /customer_support/ajax.php?

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    oretnom23 · customer support systemMar 4, 2024

  • CVE-2023-49548
    35Monitor

    Customer Support System v1 was discovered to contain a SQL injection vulnerability via the lastname parameter at /customer_support/ajax.php?

    HighCVSS 8.8Proof of conceptEPSS 0%

    oretnom23 · customer support systemMar 4, 2024

  • CVE-2023-49968
    29Monitor

    Customer Support System v1 was discovered to contain a SQL injection vulnerability via the id parameter at /customer_support/manage_departme

    HighCVSS 7.3Proof of conceptEPSS 0%

    oretnom23 · customer support systemMar 4, 2024

  • CVE-2023-49969
    17Monitor

    Customer Support System v1 was discovered to contain a SQL injection vulnerability via the id parameter at /customer_support/index.php?page=

    MediumCVSS 4.3Proof of conceptEPSS 0%

    oretnom23 · customer support systemMar 4, 2024

  • CVE-2023-49970
    39Monitor

    Customer Support System v1 was discovered to contain a SQL injection vulnerability via the subject parameter at /customer_support/ajax.php?a

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    oretnom23 · customer support systemMar 4, 2024

  • CVE-2024-25731
    30Monitor

    The Elink Smart eSmartCam (com.cn.dq.ipc) application 2.1.5 for Android contains hardcoded AES encryption keys that can be extracted from a

    HighCVSS 7.5Proof of conceptEPSS 0%

    elinksmart · esmartcamMar 4, 2024

  • CVE-2024-27718
    31Monitor

    SQL Injection vulnerability in Baizhuo Network Smart s200 Management Platform v.S200 allows a local attacker to obtain sensitive information

    HighCVSS 7.8Proof of conceptEPSS 1%

    Mar 4, 2024

  • CVE-2024-27564
    38Monitor

    pictureproxy.php in the dirk1983 mm1.ltd source code f9f4bbc allows SSRF via the url parameter.

    MediumCVSS 6.5Proof of conceptEPSS 40%

    dirk1983 · chatgptMar 5, 2024

  • CVE-2024-23225
    61This week

    A memory corruption issue was addressed with improved validation.

    HighCVSS 7.8KEVWeaponizedEPSS 1%

    apple · ipadosMar 5, 2024

  • CVE-2024-23296
    61This week

    A memory corruption issue was addressed with improved validation.

    HighCVSS 7.8KEVWeaponizedEPSS 1%

    apple · ipadosMar 5, 2024

  • CVE-2024-2056
    44Plan

    Artica Proxy Loopback Services Remotely Accessible Unauthenticated

    CriticalCVSS 9.8No exploitEPSS 16%

    articatech · artica proxyMar 5, 2024

  • CVE-2023-38944
    44Plan

    An issue in Multilaser RE160V firmware v12.03.01.09_pt and Multilaser RE163V firmware v12.03.01.10_pt allows attackers to bypass the access

    CriticalCVSS 9.8No exploitEPSS 15%

    multilaser · re160v firmwareMar 5, 2024

  • CVE-2023-43318
    35Monitor

    TP-Link JetStream Smart Switch TL-SG2210P 5.0 Build 20211201 allows attackers to escalate privileges via modification of the 'tid' and 'usrl

    HighCVSS 8.8Proof of conceptEPSS 1%

    tp-link · tl-sg2210p firmwareMar 5, 2024

  • CVE-2024-22889
    30Monitor

    Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a cr

    HighCVSS 7.5Proof of conceptEPSS 0%

    plone · ploneMar 5, 2024

  • CVE-2023-49971
    24Monitor

    A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a cra

    MediumCVSS 6.1Proof of conceptEPSS 0%

    oretnom23 · customer support systemMar 5, 2024

  • CVE-2023-49973
    24Monitor

    A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a cra

    MediumCVSS 6.1Proof of conceptEPSS 0%

    oretnom23 · customer support systemMar 5, 2024

  • CVE-2023-49974
    24Monitor

    A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a cra

    MediumCVSS 6.1Proof of conceptEPSS 0%

    oretnom23 · customer support systemMar 5, 2024

  • CVE-2023-49976
    21Monitor

    A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a cra

    MediumCVSS 5.4Proof of conceptEPSS 0%

    oretnom23 · customer support systemMar 5, 2024

  • CVE-2023-49977
    21Monitor

    A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a cra

    MediumCVSS 5.4Proof of conceptEPSS 0%

    oretnom23 · customer support systemMar 5, 2024

  • CVE-2024-20337
    41Plan

    A vulnerability in the SAML authentication process of Cisco Secure Client could allow an unauthenticated, remote attacker to conduct a carri

    HighCVSS 8.2No exploitEPSS 29%

    cisco · secure clientMar 6, 2024

  • CVE-2024-20338
    29Monitor

    A vulnerability in the ISE Posture (System Scan) module of Cisco Secure Client for Linux could allow an authenticated, local attacker to ele

    HighCVSS 7.3Proof of conceptEPSS 0%

    cisco · secure clientMar 6, 2024

  • CVE-2024-28156
    45Plan

    Jenkins Build Monitor View Plugin 1.14-860.vd06ef2568b_3f and earlier does not escape Build Monitor View names, resulting in a stored cross-

    MediumCVSS 5.4No exploitEPSS 79%

    jenkins · build monitor viewMar 6, 2024

  • CVE-2024-28157
    32Monitor

    Jenkins GitBucket Plugin 0.8 and earlier does not sanitize Gitbucket URLs on build views, resulting in a stored cross-site scripting (XSS) v

    HighCVSS 8.0Proof of conceptEPSS 1%

    jenkins · gitbucketMar 6, 2024

  • CVE-2024-25111
    50Plan

    SQUID-2024:1 Denial of Service in HTTP Chunked Decoding

    HighCVSS 7.5No exploitEPSS 65%

    squid-cache · squidMar 6, 2024

  • CVE-2024-27304
    39Monitor

    pgx SQL Injection via Protocol Message Size Overflow

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    jackc · pgproto3Mar 6, 2024

  • CVE-2024-2173
    39Monitor

    Out of bounds memory access in V8 in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to perform out of bounds memory access

    HighCVSS 8.8No exploitEPSS 13%

    google · chromeMar 6, 2024

  • CVE-2024-2174
    39Monitor

    Inappropriate implementation in V8 in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to potentially exploit heap corruption

    HighCVSS 8.8No exploitEPSS 12%

    google · chromeMar 6, 2024

  • CVE-2023-47415
    34Monitor

    Cypress Solutions CTM-200 v2.7.1.5600 and below was discovered to contain an OS command injection vulnerability via the cli_text parameter.

    HighCVSS 7.5No exploitEPSS 13%

    cypress · ctm-200 firmwareMar 6, 2024

  • CVE-2023-49986
    18Monitor

    A cross-site scripting (XSS) vulnerability in the component /admin/parent of School Fees Management System 1.0 allow attackers to execute ar

    MediumCVSS 4.7Proof of conceptEPSS 0%

    oretnom23 · school fees management systemMar 6, 2024

  • CVE-2023-49987
    21Monitor

    A cross-site scripting (XSS) vulnerability in the component /management/term of School Fees Management System v1.0 allows attackers to execu

    MediumCVSS 5.4Proof of conceptEPSS 0%

    oretnom23 · school fees management systemMar 6, 2024

  • CVE-2023-49988
    30Monitor

    Hotel Booking Management v1.0 was discovered to contain a SQL injection vulnerability via the npss parameter at rooms.php.

    HighCVSS 7.5Proof of conceptEPSS 0%

    pratham-jaiswal · hotel booking management systemMar 6, 2024

  • CVE-2023-49989
    39Monitor

    Hotel Booking Management v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at update.php.

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    pratham-jaiswal · hotel booking management systemMar 6, 2024

  • CVE-2023-51281
    21Monitor

    Cross Site Scripting vulnerability in Customer Support System v.1.0 allows a remote attacker to escalate privileges via a crafted script fir

    MediumCVSS 5.4Proof of conceptEPSS 0%

    oretnom23 · customer support systemMar 6, 2024

  • CVE-2023-48725
    41Plan

    A stack-based buffer overflow vulnerability exists in the JSON Parsing getblockschedule() functionality of Netgear RAX30 1.0.11.96 and 1.0.7

    HighCVSS 8.8No exploitEPSS 19%

    netgear · rax30 firmwareMar 7, 2024

  • CVE-2024-22752
    32Monitor

    Insecure permissions issue in EaseUS MobiMover 6.0.5 Build 21620 allows attackers to gain escalated privileges via use of crafted executable

    HighCVSS 8.1Proof of conceptEPSS 0%

    Mar 7, 2024

  • CVE-2024-24035
    24Monitor

    Cross Site Scripting (XSS) vulnerability in Setor Informatica SIL 3.1 allows attackers to run arbitrary code via the hmessage parameter.

    MediumCVSS 6.1Proof of conceptEPSS 0%

    setorinformatica · s.i.l.Mar 7, 2024

  • CVE-2024-2044
    63This week

    Unsafe Deserialisation and Remote Code Execution by an Authenticated user in pgAdmin 4

    CriticalCVSS 9.9WeaponizedEPSS 79%

    pgadmin · pgadmin 4Mar 7, 2024

  • CVE-2024-0258
    34Monitor

    The issue was addressed with improved memory handling.

    HighCVSS 8.6Proof of conceptEPSS 0%

    apple · ipad osMar 7, 2024

  • CVE-2024-27612
    27Monitor

    Numbas editor before 7.3 mishandles editing of themes and extensions.

    MediumCVSS 6.2Proof of conceptEPSS 10%

    numbas · editorMar 8, 2024

  • CVE-2024-21899
    46Plan

    QTS, QuTS hero, QuTScloud

    CriticalCVSS 9.8No exploitEPSS 24%

    qnap · qtsMar 8, 2024

  • CVE-2024-21901
    24Monitor

    A SQL injection vulnerability has been reported to affect myQNAPcloud.

    MediumCVSS 4.7No exploitEPSS 18%

    qnap · myqnapcloudMar 8, 2024

  • CVE-2024-2330
    44Plan

    Netentsec NS-ASG Application Security Gateway index.php sql injection

    CriticalCVSS 9.8Proof of conceptEPSS 17%

    netentsec · application security gatewayMar 9, 2024

  • CVE-2024-28757
    31Monitor

    libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityP

    HighCVSS 7.5Proof of conceptEPSS 2%

    libexpat project · libexpatMar 10, 2024

  • CVE-2024-1441
    22Monitor

    Libvirt: off-by-one error in udevlistinterfacesbystatus()

    MediumCVSS 5.5Proof of conceptEPSS 0%

    red hat · red hat enterprise linux 9Mar 11, 2024

  • CVE-2024-0670
    31Monitor

    Privilege escalation in windows agent

    HighCVSS 7.8Proof of conceptEPSS 0%

    checkmk · checkmkMar 11, 2024

  • CVE-2024-0039
    39Monitor

    In attp_build_value_cmd of att_protocol.cc, there is a possible out of bounds write due to a missing bounds check.

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    google · androidMar 11, 2024

  • CVE-2024-0044
    26Monitor

    In createSessionInternal of PackageInstallerService.java, there is a possible run-as any app due to improper input validation.

    MediumCVSS 6.7Proof of conceptEPSS 1%

    google · androidMar 11, 2024

  • CVE-2023-6444
    22Monitor

    Seriously Simple Podcasting < 3.0.0 - Unauthenticated Administrator Email Disclosure

    MediumCVSS 5.3Proof of conceptEPSS 2%

    castos · seriously simple podcastingMar 11, 2024

  • CVE-2023-49785
    64This week

    NextChat vulnerable to Server-Side Request Forgery and Cross-site Scripting

    CriticalCVSS 9.8Proof of conceptEPSS 83%

    nextchat · nextchatMar 11, 2024

  • CVE-2024-22127
    36Monitor

    Code Injection vulnerability in SAP NetWeaver AS Java (Administrator Log Viewer plug-in)

    CriticalCVSS 9.1Proof of conceptEPSS 1%

    sap · netweaver application server javaMar 11, 2024

  • CVE-2024-26521
    19Monitor

    HTML Injection vulnerability in CE Phoenix v1.0.8.20 and before allows a remote attacker to execute arbitrary code, escalate privileges, and

    MediumCVSS 4.8Proof of conceptEPSS 0%

    Mar 12, 2024

  • CVE-2023-42789
    40Plan

    A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, Fort

    CriticalCVSS 9.8Proof of conceptEPSS 3%

    fortinet · fortiproxyMar 12, 2024

  • CVE-2023-48788
    99Now

    A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.

    CriticalCVSS 9.8KEVWeaponizedEPSS 98%

    fortinet · forticlient enterprise management serverMar 12, 2024

  • CVE-2024-1301
    31Monitor

    Multiple Vulnerabilities in Badger Meter's Monitool

    HighCVSS 7.5Proof of conceptEPSS 2%

    badgermeter · monitoolMar 12, 2024

  • CVE-2024-1302
    22Monitor

    Multiple Vulnerabilities in Badger Meter's Monitool

    MediumCVSS 5.5Proof of conceptEPSS 0%

    badgermeter · monitoolMar 12, 2024

  • CVE-2024-1303
    26Monitor

    Multiple Vulnerabilities in Badger Meter's Monitool

    MediumCVSS 6.5Proof of conceptEPSS 1%

    badgermeter · monitoolMar 12, 2024

  • CVE-2024-1304
    24Monitor

    Multiple Vulnerabilities in Badger Meter's Monitool

    MediumCVSS 6.1Proof of conceptEPSS 0%

    badgermeter · monitoolMar 12, 2024

  • CVE-2024-21334
    45Plan

    Open Management Infrastructure (OMI) Remote Code Execution Vulnerability

    CriticalCVSS 9.8No exploitEPSS 20%

    microsoft · open management infrastructureMar 12, 2024

  • CVE-2024-21407
    37Monitor

    Windows Hyper-V Remote Code Execution Vulnerability

    HighCVSS 8.1No exploitEPSS 16%

    microsoft · windows 10 1507Mar 12, 2024

  • CVE-2024-26160
    25Monitor

    Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability

    MediumCVSS 5.5Proof of conceptEPSS 11%

    microsoft · windows 11 22h2Mar 12, 2024

  • CVE-2024-26169
    62This week

    Windows Error Reporting Service Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 3%

    microsoft · windows 10 1507Mar 12, 2024

  • CVE-2024-26170
    33Monitor

    Windows Composite Image File System (CimFS) Elevation of Privilege Vulnerability

    HighCVSS 7.8Proof of conceptEPSS 6%

    microsoft · windows 10 21h2Mar 12, 2024

  • CVE-2024-26185
    35Monitor

    Windows Compressed Folder Tampering Vulnerability

    MediumCVSS 6.5No exploitEPSS 30%

    microsoft · windows 11 22h2Mar 12, 2024

  • CVE-2024-27317
    56Plan

    Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification

    CriticalCVSS 9.9No exploitEPSS 56%

    apache · pulsarMar 12, 2024

  • CVE-2024-28623
    24Monitor

    RiteCMS v3.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component main_menu/edit_section.

    MediumCVSS 6.1Proof of conceptEPSS 1%

    ritecms · ritecmsMar 13, 2024

  • CVE-2024-2123
    32Monitor

    Ultimate Member <= 2.8.3 - Unauthenticated Stored Cross-Site Scripting

    MediumCVSS 6.1No exploitEPSS 26%

    ultimatemember · ultimate memberMar 13, 2024

  • CVE-2024-25153
    52Plan

    Remote Code Execution in FileCatalyst Workflow 5.x prior to 5.1.6 Build 114

    CriticalCVSS 9.8Proof of conceptEPSS 41%

    fortra · filecatalyst workflowMar 13, 2024

  • CVE-2023-6825
    41Plan

    File Manager And File Manager Pro (Multiple Versions) - Directory Traversal

    CriticalCVSS 9.9Proof of conceptEPSS 5%

    mndpsingh287 · file managerMar 13, 2024

  • CVE-2024-0368
    34Monitor

    Hustle <= 7.8.3 - Sensitive Information Exposure via Exposed Hubspot API Keys

    HighCVSS 8.6Proof of conceptEPSS 0%

    wpmudev · hustleMar 13, 2024

  • CVE-2024-0683
    30Monitor

    Bulgarisation for WooCommerce <= 3.0.14 - Missing Authorization

    HighCVSS 7.5Proof of conceptEPSS 1%

    autopolis · bulgarisation for woocommerceMar 13, 2024

  • CVE-2024-1071
    66This week

    The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v

    CriticalCVSS 9.8WeaponizedEPSS 89%

    ultimatemember · ultimate memberMar 13, 2024

  • CVE-2024-1234
    21Monitor

    Exclusive Addons for Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

    MediumCVSS 5.4Proof of conceptEPSS 1%

    exclusiveaddons · exclusive addons for elementorMar 13, 2024

  • CVE-2024-1380
    36Monitor

    Relevanssi – A Better Search <= 4.22.0 (Free) and <= 2.25.0 (Premium) - Missing Authorization to Unauthenticated Query Log Export

    MediumCVSS 5.3Proof of conceptEPSS 50%

    relevanssi · relevanssiMar 13, 2024

  • CVE-2024-1751
    36Monitor

    Tutor LMS – eLearning and online course solution <= 2.6.1 - Authenticated (Subscriber+) SQL Injection

    HighCVSS 8.8Proof of conceptEPSS 3%

    themeum · tutor lmsMar 13, 2024

  • CVE-2024-24549
    37Monitor

    Apache Tomcat: HTTP/2 header handling DoS

    HighCVSS 7.5Proof of conceptEPSS 23%

    apache · tomcatMar 13, 2024

  • CVE-2024-2194
    48Plan

    WP Statistics <= 14.5 - Unauthenticated Stored Cross-Site Scripting

    HighCVSS 7.2No exploitEPSS 67%

    veronalabs · wp statistics – simple, privacy-friendly google analytics alternativeMar 13, 2024

  • CVE-2024-2432
    28Monitor

    GlobalProtect App: Local Privilege Escalation (PE) Vulnerability

    HighCVSS 7.0Proof of conceptEPSS 0%

    paloaltonetworks · globalprotectMar 13, 2024