Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: November 2024

203 records · 16 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 3

  • CVE-2024-0105
    35Monitor

    NVIDIA ConnectX Firmware contains a vulnerability where an attacker may cause an improper handling of insufficient privileges issue.

    HighCVSS 8.9No exploitEPSS 0%

    nvidia · connectx4Nov 1, 2024

  • CVE-2024-10654
    27Monitor

    TOTOLINK LR350 formLoginAuth.htm authorization

    MediumCVSS 6.9Proof of conceptEPSS 1%

    totolink · lr350 firmwareNov 1, 2024

  • CVE-2024-7456
    39Monitor

    SQL Injection in lunary-ai/lunary

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    lunary · lunaryNov 1, 2024

  • CVE-2024-43919
    52Plan

    WordPress Yet Another Related Posts Plugin (YARPP) plugin <= 5.30.10 - Broken Access Control vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 44%

    yarpp · yet another related posts pluginNov 1, 2024

  • CVE-2024-43998
    39Monitor

    WordPress Blogpoet theme <= 1.0.3 - Broken Access Control vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    websiteinwp · blogpoetNov 1, 2024

  • CVE-2024-47308
    40Plan

    WordPress Templately plugin <= 3.1.2 - Broken Access Control vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    templately · templatelyNov 1, 2024

  • CVE-2024-48217
    35Monitor

    An Insecure Direct Object Reference (IDOR) in the dashboard of SiSMART v7.4.0 allows attackers to execute a horizontal-privilege escalation.

    HighCVSS 8.8Proof of conceptEPSS 0%

    Nov 1, 2024

  • CVE-2024-51483
    28Monitor

    changedetection.io Path Traversal vulnerability

    MediumCVSS 6.9Proof of conceptEPSS 2%

    dgtlmoon · changedetection.ioNov 1, 2024

  • CVE-2024-51774
    33Monitor

    qBittorrent before 5.0.1 proceeds with use of https URLs even after certificate validation errors.

    HighCVSS 8.1Proof of conceptEPSS 3%

    qbittorrent · qbittorrentNov 2, 2024

  • CVE-2024-10697
    29Monitor

    Tenda AC6 API Endpoint WriteFacMac formWriteFacMac command injection

    MediumCVSS 5.3No exploitEPSS 26%

    tenda · ac6 firmwareNov 2, 2024

  • CVE-2024-10758
    27Monitor

    code-projects/anirbandutta9 Content Management System/News-Buzz index.php sql injection

    MediumCVSS 6.9Proof of conceptEPSS 1%

    anirbandutta9 · news-buzzNov 4, 2024

  • CVE-2024-50526
    39Monitor

    WordPress Multi Purpose Mail Form plugin <= 1.0.2 - Arbitrary File Upload vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    lindeni · multi purpose mail formNov 4, 2024

  • CVE-2024-51665
    17Monitor

    WordPress Magical Addons For Elementor plugin <= 1.2.1 - Server Side Request Forgery (SSRF) vulnerability

    MediumCVSS 4.3Proof of conceptEPSS 0%

    wpthemespace · magical addons for elementorNov 4, 2024

  • CVE-2024-34887
    19Monitor

    Insufficiently protected credentials in AD/LDAP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to send AD/LDA

    MediumCVSS 4.9No exploitEPSS 0%

    bitrix24 · bitrix24Nov 4, 2024

  • CVE-2024-48336
    33Monitor

    The install() function of ProviderInstaller.java in Magisk App before canary version 27007 does not verify the GMS app before loading it, wh

    HighCVSS 8.4Proof of conceptEPSS 0%

    Nov 4, 2024

  • CVE-2024-34885
    27Monitor

    Insufficiently protected credentials in SMTP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to read SMTP acco

    MediumCVSS 6.8No exploitEPSS 0%

    bitrix24 · bitrix24Nov 4, 2024

  • CVE-2024-48061
    39Monitor

    langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the components run on th

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    langflow · langflowNov 4, 2024

  • CVE-2024-32870
    23Monitor

    iTop hub connector Information disclosure

    MediumCVSS 5.8Proof of conceptEPSS 0%

    combodo · itopNov 4, 2024

  • CVE-2024-51132
    40Plan

    An XML External Entity (XXE) vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    Nov 5, 2024

  • CVE-2024-51739
    21Monitor

    Users enumeration allowed through Rest API in Combodo iTop

    MediumCVSS 5.3Proof of conceptEPSS 1%

    combodo · itopNov 5, 2024

  • CVE-2024-50335
    21Monitor

    Authenticated XSS in "Publish Key" Field Allowing Unauthorized Administrator User Creation in SuiteCRM

    MediumCVSS 5.4Proof of conceptEPSS 0%

    salesagility · suitecrmNov 5, 2024

  • CVE-2024-51358
    39Monitor

    An issue in Linux Server Heimdall v.2.6.1 allows a remote attacker to execute arbitrary code via a crafted script to the Add new application

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    Nov 5, 2024

  • CVE-2024-9902
    25Monitor

    Ansible-core: ansible-core user may read/write unauthorized content

    MediumCVSS 6.3Proof of conceptEPSS 0%

    red hat · ansible automation platform execution environmentsNov 6, 2024

  • CVE-2024-10914
    65This week

    D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection

    CriticalCVSS 9.2Proof of conceptEPSS 96%

    dlink · dns-320 firmwareNov 6, 2024

  • CVE-2024-10915
    60This week

    D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection

    CriticalCVSS 9.2Proof of conceptEPSS 79%

    dlink · dns-320 firmwareNov 6, 2024

  • CVE-2024-10081
    52Plan

    CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.

    CriticalCVSS 10.0Proof of conceptEPSS 39%

    ericsson · codecheckerNov 6, 2024

  • CVE-2024-50340
    48Plan

    Ability to change environment from query in symfony/runtime

    HighCVSS 7.3Proof of conceptEPSS 63%

    symfony · symfonyNov 6, 2024

  • CVE-2024-48325
    32Monitor

    Portabilis i-Educar 2.8.0 is vulnerable to SQL Injection in the "getDocuments" function of the "InstituicaoDocumentacaoController" class.

    HighCVSS 8.1Proof of conceptEPSS 0%

    portabilis · i-educarNov 6, 2024

  • CVE-2024-43425
    60This week

    Moodle: remote code execution via calculated question types

    HighCVSS 8.1WeaponizedEPSS 87%

    moodle · moodleNov 7, 2024

  • CVE-2024-9926
    17Monitor

    Jetpack < 13.9.1 - Subscriber+ Arbitrary Feedback Access

    MediumCVSS 4.3Proof of conceptEPSS 1%

    automattic · jetpackNov 7, 2024

  • CVE-2024-47073
    37Monitor

    Dataease arbitrary interface access vulnerability

    CriticalCVSS 9.3Proof of conceptEPSS 1%

    dataease · dataeaseNov 7, 2024

  • CVE-2024-51428
    30Monitor

    An issue in Espressif Esp idf v5.3.0 allows attackers to cause a Denial of Service (DoS) via a crafted data channel packet.

    HighCVSS 7.5Proof of conceptEPSS 0%

    espressif · esp-idfNov 7, 2024

  • CVE-2024-50599
    43Plan

    A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Zimbra Collaboration Suite (ZCS) 8.8.15, affecting one of the we

    MediumCVSS 6.1No exploitEPSS 63%

    synacor · zimbra collaboration suiteNov 7, 2024

  • CVE-2024-24409
    37Monitor

    Privilege Escalation

    HighCVSS 8.8Proof of conceptEPSS 6%

    zohocorp · manageengine admanager plusNov 8, 2024

  • CVE-2024-51030
    26Monitor

    A SQL injection vulnerability in manage_client.php and view_cab.php of Sourcecodester Cab Management System 1.0 allows remote attackers to e

    MediumCVSS 6.5Proof of conceptEPSS 0%

    oretnom23 · cab management systemNov 8, 2024

  • CVE-2024-51031
    21Monitor

    A Cross-site Scripting (XSS) vulnerability in manage_account.php in Sourcecodester Cab Management System 1.0 allows remote authenticated use

    MediumCVSS 5.4Proof of conceptEPSS 0%

    oretnom23 · cab management systemNov 8, 2024

  • CVE-2024-51032
    21Monitor

    A Cross-site Scripting (XSS) vulnerability in manage_recipient.php of Sourcecodester Toll Tax Management System 1.0 allows remote authentica

    MediumCVSS 5.4Proof of conceptEPSS 0%

    oretnom23 · toll tax management systemNov 8, 2024

  • CVE-2024-44765
    26Monitor

    An Improper Authorization (Access Control Misconfiguration) vulnerability in MGT-COMMERCE GmbH CloudPanel v2.0.0 to v2.4.2 allows low-privil

    MediumCVSS 6.5Proof of conceptEPSS 0%

    Nov 8, 2024

  • CVE-2024-51211
    40Plan

    SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.php file.

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    os4ed · opensisNov 8, 2024

  • CVE-2024-52002
    35Monitor

    Cross-Site Request Forgery (CSRF) in several iTop pages

    HighCVSS 8.8Proof of conceptEPSS 0%

    combodo · itopNov 8, 2024

  • CVE-2024-10586
    40Plan

    Debug Tool <= 2.2 - Unauthenticated Arbitrary File Creation

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    eugenbobrowski · debug toolNov 8, 2024

  • CVE-2024-10673
    35Monitor

    Top Store <= 1.5.4 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation

    HighCVSS 8.8Proof of conceptEPSS 1%

    themehunk · top storeNov 9, 2024

  • CVE-2024-10674
    36Monitor

    Th Shop Mania <= 1.4.9 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation

    HighCVSS 8.8Proof of conceptEPSS 1%

    themehunk · th shop maniaNov 9, 2024

  • CVE-2024-10470
    49Plan

    WPLMS Learning Management System for WordPress <= 4.962 - Unauthenticated Arbitrary File Read and Deletion

    CriticalCVSS 9.8Proof of conceptEPSS 34%

    vibethemes · wordpress learning management systemNov 9, 2024

  • CVE-2024-10508
    39Monitor

    RegistrationMagic – User Registration Plugin with Custom Registration Forms <= 6.0.2.6 - Unauthenticated Privilege Escalation via Password Recovery

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    metagauss · registrationmagicNov 9, 2024

  • CVE-2024-50251
    24Monitor

    netfilter: nft_payload: sanitize offset and length before calling skb_checksum()

    MediumCVSS 6.2Proof of conceptEPSS 0%

    linux · linux kernelNov 9, 2024

  • CVE-2024-10958
    29Monitor

    WP Photo Album Plus <= 8.8.08.007 - Unauthenticated Arbitrary Shortcode Execution via getshortcodedrenderedfenodelay

    HighCVSS 7.3Proof of conceptEPSS 1%

    wppa · wp photo album plusNov 10, 2024

  • CVE-2024-41992
    36Monitor

    Wi-Fi Alliance wfa_dut (in Wi-Fi Test Suite) through 9.0.0 allows OS command injection via 802.11x frames because the system() library funct

    HighCVSS 8.8Proof of conceptEPSS 2%

    Nov 10, 2024

  • CVE-2024-51788
    40Plan

    WordPress The Novel Design Store Directory plugin <= 4.3.0 - Arbitrary File Upload vulnerability

    CriticalCVSS 10.0Proof of conceptEPSS 1%

    joshua wolfe · the novel design store directoryNov 11, 2024

  • CVE-2024-51791
    40Plan

    WordPress Forms plugin <= 2.8.0 - Arbitrary File Upload vulnerability

    CriticalCVSS 10.0Proof of conceptEPSS 0%

    made i.t. · formsNov 11, 2024

  • CVE-2024-51793
    40Plan

    WordPress RepairBuddy plugin <= 3.8115 - Arbitrary File Upload vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    webfulcreations · computer repair shopNov 11, 2024

  • CVE-2024-48322
    32Monitor

    UsersController.php in Run.codes 1.5.2 and older has a reset password race condition vulnerability.

    HighCVSS 8.1Proof of conceptEPSS 0%

    Nov 11, 2024

  • CVE-2024-51747
    28Monitor

    Arbitrary File Read and Delete in kanboard

    HighCVSS 7.2Proof of conceptEPSS 0%

    kanboard · kanboardNov 11, 2024

  • CVE-2024-51026
    21Monitor

    The NetAdmin IAM system (version 4.0.30319) has a Cross Site Scripting (XSS) vulnerability in the /BalloonSave.ashx endpoint, where it is po

    MediumCVSS 5.4Proof of conceptEPSS 0%

    Nov 11, 2024

  • CVE-2024-10245
    39Monitor

    Relais 2FA <= 1.0 - Authentication Bypass

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    mobisoft974 · relais 2faNov 12, 2024

  • CVE-2024-50320
    42Plan

    An infinite loop in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service.

    HighCVSS 7.5No exploitEPSS 39%

    ivanti · avalancheNov 12, 2024

  • CVE-2024-50324
    34Monitor

    Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenti

    HighCVSS 7.2No exploitEPSS 18%

    ivanti · endpoint managerNov 12, 2024

  • CVE-2024-50326
    36Monitor

    SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authentic

    HighCVSS 7.2No exploitEPSS 26%

    ivanti · endpoint managerNov 12, 2024

  • CVE-2024-50330
    51Plan

    SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote unauthent

    CriticalCVSS 9.8Proof of conceptEPSS 40%

    ivanti · endpoint managerNov 12, 2024

  • CVE-2024-49369
    40Plan

    Icinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API Connections

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    icinga · icingaNov 12, 2024

  • CVE-2024-52010
    34Monitor

    Zoraxy has an authenticated command injection in the Web SSH feature

    HighCVSS 8.6Proof of conceptEPSS 1%

    tobychui · zoraxyNov 12, 2024

  • CVE-2024-43451
    82Now

    NTLM Hash Disclosure Spoofing Vulnerability

    MediumCVSS 6.5KEVWeaponizedEPSS 85%

    microsoft · windows 10 1507Nov 12, 2024

  • CVE-2024-43452
    39Monitor

    Windows Registry Elevation of Privilege Vulnerability

    HighCVSS 7.5No exploitEPSS 28%

    microsoft · windows 10 1809Nov 12, 2024

  • CVE-2024-43630
    32Monitor

    Windows Kernel Elevation of Privilege Vulnerability

    HighCVSS 7.8Proof of conceptEPSS 3%

    microsoft · windows 10 21h2Nov 12, 2024

  • CVE-2024-43642
    49Plan

    Windows SMB Denial of Service Vulnerability

    HighCVSS 7.5No exploitEPSS 63%

    microsoft · windows 11 22h2Nov 12, 2024

  • CVE-2024-49019
    32Monitor

    Active Directory Certificate Services Elevation of Privilege Vulnerability

    HighCVSS 7.8Proof of conceptEPSS 1%

    microsoft · windows server 2008Nov 12, 2024

  • CVE-2024-49039
    69This week

    Windows Task Scheduler Elevation of Privilege Vulnerability

    HighCVSS 8.8KEVWeaponizedEPSS 14%

    microsoft · windows 10 1507Nov 12, 2024

  • CVE-2024-8068
    51Plan

    Privilege escalation to NetworkService Account access

    MediumCVSS 5.1KEVWeaponizedEPSS 3%

    citrix · session recordingNov 12, 2024

  • CVE-2024-8069
    54Plan

    Limited remote code execution with privilege of a NetworkService Account access

    MediumCVSS 5.1KEVWeaponizedEPSS 14%

    citrix · session recordingNov 12, 2024

  • CVE-2023-52268
    36Monitor

    The End-User Portal module before 1.0.65 for FreeScout sometimes allows an attacker to authenticate as an arbitrary user because a session t

    CriticalCVSS 9.1Proof of conceptEPSS 0%

    Nov 12, 2024

  • CVE-2024-23666
    36Monitor

    A client-side enforcement of server-side security in Fortinet FortiAnalyzer-BigData at least version 7.4.0 and 7.2.0 through 7.2.6 and 7.0

    HighCVSS 8.8Proof of conceptEPSS 2%

    fortinet · fortianalyzerNov 12, 2024

  • CVE-2024-52301
    47Plan

    Laravel allows environment manipulation via query string

    HighCVSS 8.7Proof of conceptEPSS 44%

    laravel · frameworkNov 12, 2024

  • CVE-2024-51179
    30Monitor

    An issue in Open 5GS v.2.7.1 allows a remote attacker to cause a denial of service via the Network Function Virtualizations (NFVs) such as t

    HighCVSS 7.5Proof of conceptEPSS 1%

    open5gs · open5gsNov 12, 2024

  • CVE-2024-10629
    35Monitor

    GPX Viewer <= 2.2.9 - Authenticated (Subscriber+) Arbitrary File Creation

    HighCVSS 8.8Proof of conceptEPSS 1%

    axelkeller · gpx viewerNov 12, 2024

  • CVE-2024-34781
    49Plan

    SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authentic

    HighCVSS 7.2No exploitEPSS 68%

    ivanti · endpoint managerNov 12, 2024

  • CVE-2024-34787
    36Monitor

    Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthent

    HighCVSS 7.8No exploitEPSS 17%

    ivanti · endpoint managerNov 12, 2024

  • CVE-2024-48510
    40Plan

    Directory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.Shared

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    mihula · prodotnetzipNov 13, 2024

  • CVE-2024-50969
    24Monitor

    A Reflected cross-site scripting (XSS) vulnerability in browse.php of Code-projects Jonnys Liquor 1.0 allows remote attackers to inject arbi

    MediumCVSS 6.1Proof of conceptEPSS 0%

    anisha · jonnys liquorNov 13, 2024

  • CVE-2024-50970
    35Monitor

    A SQL injection vulnerability in orderview1.php of Itsourcecode Online Furniture Shopping Project 1.0 allows remote attackers to execute arb

    HighCVSS 8.8Proof of conceptEPSS 0%

    nikoarroyocuraza · online furniture shopping projectNov 13, 2024

  • CVE-2024-50971
    28Monitor

    A SQL injection vulnerability in print.php of Itsourcecode Construction Management System 1.0 allows remote attackers to execute arbitrary S

    HighCVSS 7.2Proof of conceptEPSS 0%

    angeljudesuarez · construction management systemNov 13, 2024

  • CVE-2024-50972
    28Monitor

    A SQL injection vulnerability in printtool.php of Itsourcecode Construction Management System 1.0 allows remote attackers to execute arbitra

    HighCVSS 7.2Proof of conceptEPSS 0%

    angeljudesuarez · construction management systemNov 13, 2024

  • CVE-2024-51996
    30Monitor

    Symphony has an Authentication Bypass via RememberMe

    HighCVSS 7.5Proof of conceptEPSS 0%

    symfony · symfonyNov 13, 2024

  • CVE-2024-43093
    59Plan

    In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensit

    HighCVSS 7.3KEVWeaponizedEPSS 0%

    google · androidNov 13, 2024

  • CVE-2024-49379
    21Monitor

    Remote Code Execution (RCE) via Cross-Site Scripting (XSS) in Umbrel

    MediumCVSS 5.3Proof of conceptEPSS 1%

    getumbrel · umbrelNov 13, 2024

  • CVE-2024-40443
    17Monitor

    SQL Injection vulnerability in Simple Laboratory Management System using PHP and MySQL v.1.0 allows a remote attacker to cause a denial of s

    MediumCVSS 4.3Proof of conceptEPSS 0%

    oretnom23 · computer laboratory management systemNov 13, 2024

  • CVE-2024-42834
    21Monitor

    A stored cross-site scripting (XSS) vulnerability in the Create Customer API in Incognito Service Activation Center (SAC) UI v14.11 allows a

    MediumCVSS 5.4Proof of conceptEPSS 0%

    Nov 13, 2024

  • CVE-2024-52550
    32Monitor

    Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile

    HighCVSS 8.0Proof of conceptEPSS 0%

    jenkins · pipeline\Nov 13, 2024

  • CVE-2024-5083
    20Monitor

    Nexus Repository 2 - Stored XSS

    MediumCVSS 5.1Proof of conceptEPSS 0%

    sonatype · nexus repositoryNov 13, 2024

  • CVE-2024-5082
    29Monitor

    Nexus Repository 2 - Remote Code Execution

    HighCVSS 7.1Proof of conceptEPSS 2%

    sonatype · nexus repositoryNov 13, 2024

  • CVE-2024-10146
    21Monitor

    Simple File List < 6.1.13 - Reflected Cross-Site Scripting

    MediumCVSS 5.4Proof of conceptEPSS 0%

    simplefilelist · simple file listNov 14, 2024

  • CVE-2024-9186
    35Monitor

    Automation By Autonami < 3.3.0 - Unauthenticated SQLi

    HighCVSS 8.6Proof of conceptEPSS 2%

    funnelkit · funnelkit automationsNov 14, 2024

  • CVE-2024-10571
    40Plan

    Chartify – WordPress Chart Plugin <= 2.9.5 - Unauthenticated Local File Inclusion via source

    CriticalCVSS 9.8Proof of conceptEPSS 4%

    ays-pro · chartifyNov 14, 2024

  • CVE-2024-7124
    21Monitor

    Reflected XSS in DInGO dLibra

    MediumCVSS 5.3Proof of conceptEPSS 1%

    poznan supercomputing and networking center · dingo dlibraNov 14, 2024

  • CVE-2024-52302
    35Monitor

    common-user-management Unrestricted File Upload Leading to Remote Code Execution (RCE)

    HighCVSS 8.7Proof of conceptEPSS 3%

    osamataher · java-springboot-codebaseNov 14, 2024

  • CVE-2024-52375
    40Plan

    WordPress Datasets Manager by Arttia Creative plugin <= 1.5 - Arbitrary File Upload vulnerability

    CriticalCVSS 10.0Proof of conceptEPSS 1%

    arttia creative · datasets manager by arttia creativeNov 14, 2024

  • CVE-2024-52380
    40Plan

    WordPress Picsmize plugin <= 1.0.0 - Arbitrary File Upload vulnerability

    CriticalCVSS 10.0Proof of conceptEPSS 1%

    softpulseinfotech · picsmizeNov 14, 2024

  • CVE-2024-52382
    39Monitor

    WordPress Matix Popup Builder plugin <= 1.0.0 - Arbitrary Option Update to Privilege Escalation vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    medmatech · matix popup builderNov 14, 2024

  • CVE-2024-50968
    30Monitor

    A business logic vulnerability exists in the Add to Cart function of itsourcecode Agri-Trading Online Shopping System 1.0, which allows remo

    HighCVSS 7.5Proof of conceptEPSS 0%

    adonesevangelista · agri-trading online shopping systemNov 14, 2024

  • CVE-2024-11120
    78This week

    GeoVision EOL devices - OS Command Injection

    CriticalCVSS 9.8KEVWeaponizedEPSS 28%

    geovision · gv-vs12 firmwareNov 14, 2024

  • CVE-2024-10924
    64This week

    Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass

    CriticalCVSS 9.8WeaponizedEPSS 82%

    really-simple-plugins · really simple securityNov 15, 2024