Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: October 2024

238 records · 17 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 3 of 3

  • CVE-2024-50427
    39Monitor

    WordPress SurveyJS plugin <= 1.9.136 - Arbitrary File Upload vulnerability

    CriticalCVSS 9.9Proof of conceptEPSS 1%

    devsoftbaltic · surveyjsOct 29, 2024

  • CVE-2024-50473
    40Plan

    WordPress Ajar in5 Embed plugin <= 3.1.3 - Arbitrary File Upload vulnerability

    CriticalCVSS 10.0Proof of conceptEPSS 1%

    ajar productions · ajar in5 embedOct 29, 2024

  • CVE-2024-50475
    39Monitor

    WordPress Signup Page plugin <= 1.0 - Arbitrary Option Update to Privilege Escalation vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    scott gamon · signup pageOct 29, 2024

  • CVE-2024-50476
    39Monitor

    WordPress GRÜN spendino Spendenformular plugin <= 1.0.1 - Arbitrary Option Update to Privilege Escalation vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    grün software group gmbh · grün spendino spendenformularOct 29, 2024

  • CVE-2024-50485
    39Monitor

    WordPress Exam Matrix plugin <= 1.5 - Privilege Escalation vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    udit rawat · exam matrixOct 29, 2024

  • CVE-2024-50490
    39Monitor

    WordPress PegaPoll plugin <= 1.0.2 - Arbitrary Option Update to Privilege Escalation vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    lowcage · pegapollOct 29, 2024

  • CVE-2024-10465
    26Monitor

    A clipboard "paste" button could persist across tabs which allowed a spoofing attack.

    MediumCVSS 6.5No exploitEPSS 0%

    mozilla · firefoxOct 29, 2024

  • CVE-2024-5982
    48Plan

    Path Traversal in gaizhenbiao/chuanhuchatgpt

    CriticalCVSS 9.8No exploitEPSS 31%

    gaizhenbiao · chuanhuchatgptOct 29, 2024

  • CVE-2024-8309
    43Plan

    SQL Injection in langchain-ai/langchain

    CriticalCVSS 9.8Proof of conceptEPSS 13%

    langchain · langchainOct 29, 2024

  • CVE-2024-50334
    34Monitor

    Semicolon Path Injection on API /api;/config

    HighCVSS 8.7Proof of conceptEPSS 1%

    erudika · scooldOct 29, 2024

  • CVE-2024-7985
    36Monitor

    FileOrganizer <= 1.0.9 - Authenticated (Subscriber+) Arbitrary File Upload

    HighCVSS 8.8Proof of conceptEPSS 2%

    fileorganizer · fileorganizerOct 29, 2024

  • CVE-2024-9989
    41Plan

    Crypto <= 2.18 - Authentication Bypass via log_in

    CriticalCVSS 9.8Proof of conceptEPSS 7%

    odude · crypto toolOct 29, 2024

  • CVE-2024-48955
    32Monitor

    Broken access control in NetAdmin 4.030319 returns data with functionalities on the endpoint that "assembles" the functionalities menus, the

    HighCVSS 8.1Proof of conceptEPSS 0%

    Oct 29, 2024

  • CVE-2024-48573
    39Monitor

    A NoSQL injection vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to reset user and administrator account pas

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    aquila-cms · aquilacmsOct 29, 2024

  • CVE-2024-51378
    97Now

    getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authenticat

    CriticalCVSS 9.8KEVWeaponizedEPSS 94%

    cyberpanel · cyberpanelOct 29, 2024

  • CVE-2024-51567
    94Now

    upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and

    CriticalCVSS 9.8KEVWeaponizedEPSS 84%

    cyberpanel · cyberpanelOct 29, 2024

  • CVE-2024-51568
    60This week

    CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink.

    CriticalCVSS 9.8WeaponizedEPSS 47%

    cyberpanel · cyberpanelOct 29, 2024

  • CVE-2024-50507
    39Monitor

    WordPress DS.DownloadList plugin <= 1.3 - PHP Object Injection vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    daschmi · ds.downloadlistOct 30, 2024

  • CVE-2024-50508
    30Monitor

    WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Download vulnerability

    HighCVSS 7.5Proof of conceptEPSS 1%

    chetan khandla · woocommerce product designOct 30, 2024

  • CVE-2024-50509
    34Monitor

    WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Deletion vulnerability

    HighCVSS 8.6Proof of conceptEPSS 1%

    chetan khandla · woocommerce product designOct 30, 2024

  • CVE-2024-50510
    40Plan

    WordPress AR For Woocommerce plugin <= 6.3 - Arbitrary File Upload vulnerability

    CriticalCVSS 10.0Proof of conceptEPSS 1%

    webandprint · ar for woocommerceOct 30, 2024

  • CVE-2024-10525
    46Plan

    Eclipse Mosquito: Heap Buffer Overflow in my_subscribe_callback

    HighCVSS 7.2No exploitEPSS 59%

    eclipse · mosquittoOct 30, 2024

  • CVE-2024-31152
    35Monitor

    The LevelOne WBR-6012 router with firmware R0.40e6 is vulnerable to improper resource allocation within its web application, where a series

    HighCVSS 7.5No exploitEPSS 17%

    level1 · wbr-6012 firmwareOct 30, 2024

  • CVE-2024-33623
    34Monitor

    A denial of service vulnerability exists in the Web Application functionality of LevelOne WBR-6012 R0.40e6.

    HighCVSS 7.5No exploitEPSS 11%

    level1 · wbr-6012 firmwareOct 30, 2024

  • CVE-2024-33699
    38Monitor

    The LevelOne WBR-6012 router's web application has a vulnerability in its firmware version R0.40e6, allowing attackers to change the adminis

    HighCVSS 8.8No exploitEPSS 11%

    level1 · wbr-6012 firmwareOct 30, 2024

  • CVE-2024-10456
    42Plan

    Delta Electronics InfraSuite Device Master Deserialization of Untrusted Data

    CriticalCVSS 9.3No exploitEPSS 17%

    delta electronics · infrasuite device masterOct 30, 2024

  • CVE-2024-10005
    23Monitor

    Consul L7 Intentions Vulnerable To URL Path Bypass

    MediumCVSS 5.8Proof of conceptEPSS 0%

    hashicorp · consulOct 30, 2024

  • CVE-2024-10557
    27Monitor

    code-projects Blood Bank Management System updateprofile.php cross-site request forgery

    MediumCVSS 6.9Proof of conceptEPSS 0%

    fabian · blood bank management systemOct 30, 2024

  • CVE-2024-48307
    54Plan

    JeecgBoot v3.7.1 was discovered to contain a SQL injection vulnerability via the component /onlDragDatasetHead/getTotalData.

    CriticalCVSS 9.8Proof of conceptEPSS 50%

    jeecg · jeecg bootOct 30, 2024

  • CVE-2024-10392
    43Plan

    AI Power: Complete AI Pack <= 1.8.89 - Unauthenticated Arbitrary File Upload

    CriticalCVSS 9.8No exploitEPSS 14%

    senols · ai puffer – your ai engine for wordpress (formerly ai power)Oct 31, 2024

  • CVE-2024-48910
    39Monitor

    DOMPurify vulnerable to tampering by prototype polution

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    cure53 · dompurifyOct 31, 2024

  • CVE-2024-51430
    25Monitor

    Cross Site Scripting vulnerability in online diagnostic lab management system using php v.1.0 allows a remote attacker to execute arbitrary

    MediumCVSS 6.4Proof of conceptEPSS 0%

    Oct 31, 2024

  • CVE-2024-51482
    50Plan

    Boolean-based SQL Injection in ZoneMinder v1.37.* <= 1.37.64

    CriticalCVSS 9.9Proof of conceptEPSS 36%

    zoneminder · zoneminderOct 31, 2024

  • CVE-2024-39719
    31Monitor

    An issue was discovered in Ollama through 0.3.14.

    HighCVSS 7.5Proof of conceptEPSS 4%

    ollama · ollamaOct 31, 2024

  • CVE-2024-39722
    31Monitor

    An issue was discovered in Ollama before 0.1.46.

    HighCVSS 7.5Proof of conceptEPSS 3%

    ollama · ollamaOct 31, 2024

  • CVE-2024-48359
    40Plan

    Qualitor v8.24 was discovered to contain a remote code execution (RCE) vulnerability via the gridValoresPopHidden parameter.

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    qualitor · qualitorOct 31, 2024

  • CVE-2024-48360
    31Monitor

    Qualitor v8.24 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /request/viewValidacao.php.

    HighCVSS 7.5Proof of conceptEPSS 3%

    qualitor · qualitorOct 31, 2024

  • CVE-2024-10605
    27Monitor

    code-projects Blood Bank Management System request.php cross-site request forgery

    MediumCVSS 6.9Proof of conceptEPSS 0%

    fabian · blood bank management systemOct 31, 2024