By publication date

Exploited and new serious CVEs: December 2024

155 records · 11 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 2

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
30Monitor	CVE-2024-20137Proof of concept	In wlan driver, there is a possible client disconnection due to improper handling of exceptional conditions.mediatek, inc. · mt6890, mt7622, mt7915, mt7916, mt7981, mt7986 · CWE-248 Pre-auth Denial of service	High7.5	—	1.2%	Dec 2, 2024
62This week	CVE-2024-53104Weaponized	media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_formatlinux · linux kernel · CWE-787 Memory safety	High7.8	KEV	3.3%	Dec 2, 2024
47Plan	CVE-2024-46906No exploit	WhatsUp Gold GetSqlWhereClause SQL Injection Privilege Escalation Vulnerabilityprogress · whatsup gold · CWE-89 SQL injection	High8.8	—	40.3%	Dec 2, 2024
54Plan	CVE-2024-46909No exploit	WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerabilityprogress · whatsup gold · CWE-16 pre-auth RCE Path traversal	Critical9.8	—	48.9%	Dec 2, 2024
33Monitor	CVE-2024-52806Proof of concept	SimpleSAMLphp SAML2 has an XXE in parsing SAML messagessimplesamlphp · saml2 · CWE-611 Pre-auth XXE	High8.3	—	0.4%	Dec 2, 2024
26Monitor	CVE-2024-53259Proof of concept	quic-go affected by an ICMP Packet Too Large Injection Attack on Linuxquic-go · quic-go · CWE-345 Pre-auth Denial of service	Medium6.5	—	0.6%	Dec 2, 2024
19Monitor	CVE-2024-53617Proof of concept	A Cross Site Scripting vulnerability in LibrePhotos before commit 32237 allows attackers to takeover any account via uploading an HTML file CWE-79 Broken access control (IDOR) XSS	Medium4.8	—	0.5%	Dec 2, 2024
37Monitor	CVE-2024-53900Proof of concept	Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.mongoosejs · mongoose · CWE-89 Pre-auth SQL injection	Critical9.1	—	3.9%	Dec 2, 2024
45Plan	CVE-2024-53375Proof of concept	An Authenticated Remote Code Execution (RCE) vulnerability affects the TP-Link Archer router series.CWE-78 RCE Command injection	High8.0	—	42.0%	Dec 2, 2024
31Monitor	CVE-2024-29404Proof of concept	An issue in Razer Synapse 3 v.3.9.131.20813 and Synapse 3 App v.20240213 allows a local attacker to execute arbitrary code via the export paCWE-77 RCE Command injection	High7.8	—	0.4%	Dec 3, 2024
37Monitor	CVE-2024-42455No exploit	A vulnerability in Veeam Backup & Replication allows a low-privileged user to connect to remoting services and exploit insecure deserializatveeam · veeam backup \& replication · CWE-306 Auth bypass Deserialization	High8.1	—	15.7%	Dec 3, 2024
35Monitor	CVE-2024-11643Proof of concept	Accessibility by AllAccessible <= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Updateallaccessible · accessibility by allaccessible · CWE-862 Broken access control (IDOR)	High8.8	—	0.7%	Dec 4, 2024
38Monitor	CVE-2024-48839Proof of concept	Remote Code Execution, RCEabb · aspect-ent-2 firmware · CWE-94 pre-auth RCE	Critical9.3	—	2.8%	Dec 5, 2024
38Monitor	CVE-2024-48840Proof of concept	Unauthorized Access vulnerabilities allow Remote Code Execution.abb · aspect-ent-2 firmware · CWE-94 pre-auth RCE	Critical9.3	—	2.0%	Dec 5, 2024
28Monitor	CVE-2024-48844Proof of concept	Denial of Service, DoSabb · aspect-ent-2 firmware · CWE-770 Denial of service	High7.2	—	0.8%	Dec 5, 2024
38Monitor	CVE-2024-48845Proof of concept	Weak Password Rules/Strengthabb · aspect-ent-2 firmware · CWE-521 Pre-auth	Critical9.3	—	1.8%	Dec 5, 2024
28Monitor	CVE-2024-48846Proof of concept	Cross Side Request Forgery, CSRFabb · aspect-ent-2 firmware · CWE-352 CSRF	High7.1	—	0.6%	Dec 5, 2024
39Monitor	CVE-2024-51544No exploit	Service Control vulnerabilities allow access to service restart requests and vm configuration settings.abb · aspect-ent-12 firmware · CWE-15 Pre-auth	High8.8	—	13.2%	Dec 5, 2024
34Monitor	CVE-2024-51546Proof of concept	Credentails Disclosureabb · aspect-ent-12 firmware · CWE-1287 Pre-auth	High8.7	—	1.4%	Dec 5, 2024
38Monitor	CVE-2024-51550Proof of concept	Data Validation / Sanitizationabb · aspect-ent-12 firmware · CWE-1287 Pre-auth	Critical9.3	—	1.8%	Dec 5, 2024
37Monitor	CVE-2024-6516Proof of concept	Cross Site Scripting XSSabb · aspect-ent-2 firmware · CWE-79 Pre-auth XSS	Critical9.3	—	1.0%	Dec 5, 2024
27Monitor	CVE-2024-12227Proof of concept	MSI Dragon Center IOCTL NTIOLib_X64.sys MmUnMapIoSpace null pointer dereferencemsi · dragon center · CWE-404	Medium6.8	—	0.1%	Dec 5, 2024
36Monitor	CVE-2024-53703Proof of concept	A vulnerability in the SonicWall SMA100 SSLVPN firmware 10.2.1.13-72sv and earlier versions mod_httprp library loaded by the Apache web servsonicwall · sma 200 firmware · CWE-121 Pre-auth Memory safety	High8.1	—	12.6%	Dec 5, 2024
26Monitor	CVE-2024-54679Proof of concept	CyberPanel (aka Cyber Panel) before 6778ad1 does not require the FilemanagerAdmin capability for restartMySQL actions.cyberpanel · cyberpanel · CWE-862 Broken access control (IDOR) Denial of service	Medium6.5	—	0.9%	Dec 5, 2024
35Monitor	CVE-2024-53457No exploit	A stored cross-site scripting (XSS) vulnerability in the Device Settings section of LibreNMS v24.9.0 to v24.10.0 allows attackers to executelibrenms · librenms · CWE-79 RCE XSS	Medium5.4	—	46.4%	Dec 5, 2024
35Monitor	CVE-2024-10578Proof of concept	Pubnews <= 1.0.7 - Authenticated (Subscriber+) Arbitrary Plugin Installationblazethemes · pubnews · CWE-434 File upload	High8.8	—	1.3%	Dec 6, 2024
25Monitor	CVE-2024-11201Proof of concept	myCred – Loyalty Points and Rewards plugin <= 2.7.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_send Shortcodesaadiqbal · points management system for gamification, ranks, badges, and loyalty rewards program – mycred · CWE-79 XSS	Medium6.4	—	0.8%	Dec 6, 2024
34Monitor	CVE-2024-11728Proof of concept	KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Unauthenticated SQL Injectioniqonic · kivicare · CWE-89 Pre-auth SQL injection	High7.5	—	13.6%	Dec 6, 2024
34Monitor	CVE-2024-10516Proof of concept	Swift Performance Lite <= 2.3.7.1 - Unauthenticated Local PHP File Inclusion via 'ajaxify'swte · swift performance lite · CWE-22 pre-auth RCE Path traversal	High8.1	—	6.4%	Dec 6, 2024
24Monitor	CVE-2024-50677Proof of concept	A cross-site scripting (XSS) vulnerability in OroPlatform CMS v5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted poroinc · oroplatform · CWE-79 pre-auth RCE XSS	Medium6.1	—	0.5%	Dec 6, 2024
27Monitor	CVE-2024-50404Proof of concept	A link following vulnerability has been reported to affect Qsync Central.qnap · qsync central · CWE-59	Medium6.8	—	1.4%	Dec 6, 2024
41Plan	CVE-2024-53691Proof of concept	A link following vulnerability has been reported to affect several QNAP operating system versions.qnap · qts · CWE-59	High8.7	—	23.7%	Dec 6, 2024
31Monitor	CVE-2024-12270Proof of concept	Beautiful Taxonomy Filters <= 2.4.3 - Unauthenticated SQL Injectionjonathandejong · beautiful taxonomy filters · CWE-89 Pre-auth SQL injection	High7.5	—	3.7%	Dec 7, 2024
46Plan	CVE-2024-12209Proof of concept	WP Umbrella: Update Backup Restore & Monitoring <= 2.17.0 - Unauthenticated Local File Inclusionwphealth · wp umbrella: update backup restore & monitoring · CWE-98 pre-auth RCE	Critical9.8	—	23.2%	Dec 8, 2024
31Monitor	CVE-2024-12342Proof of concept	TP-Link VN020 F3v(T) Incomplete SOAP Request WANIPConnection denial of servicetp-link · vn020 f3v(t) · CWE-404 Pre-auth	High7.1	—	9.2%	Dec 8, 2024
22Monitor	CVE-2024-12344Proof of concept	TP-Link VN020 F3v(T) FTP USER Command memory corruptiontp-link · vn020 f3v firmware · CWE-119 Memory safety	Medium5.3	—	1.8%	Dec 8, 2024
17Monitor	CVE-2023-30486Proof of concept	WordPress Square theme <= 2.0.0 - Broken Access Controlhashthemes · square · CWE-862 Broken access control (IDOR)	Medium4.3	—	0.7%	Dec 9, 2024
41Plan	CVE-2023-32117Proof of concept	WordPress Integrate Google Drive plugin <= 1.1.99 - Unauthenticated Broken Access Control vulnerabilitysoftlab · integrate google drive · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.8	—	7.3%	Dec 9, 2024
26Monitor	CVE-2024-21542Proof of concept	Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) due to improper destinatCWE-29 Pre-auth	Medium6.6	—	1.1%	Dec 10, 2024
20Monitor	CVE-2024-10708Proof of concept	System Dashboard < 2.8.15 - Admin+ Path Traversalbowo · system dashboard · CWE-22 Path traversal	Medium4.9	—	2.0%	Dec 10, 2024
21Monitor	CVE-2024-11868Proof of concept	LearnPress – WordPress LMS Plugin <= 4.2.7.3 - Course Material Sensitive Information Exposure via REST APIthimpress · learnpress · CWE-284 Pre-auth Broken access control (IDOR)	Medium5.3	—	1.1%	Dec 10, 2024
38Monitor	CVE-2024-54152Proof of concept	Angular Expressions - Remote Code Execution when using localspeerigon · angular-expressions · CWE-94 pre-auth RCE	Critical9.3	—	2.2%	Dec 10, 2024
38Monitor	CVE-2024-55544No exploit	Authenticated Command Injectionoringnet · iap-420 firmware · CWE-77 RCE Command injection	High8.7	—	12.0%	Dec 10, 2024
42Plan	CVE-2024-55547No exploit	Remote Command Execution via SNMPoringnet · iap-420 firmware · CWE-77 pre-auth RCE Command injection	Critical9.3	—	17.4%	Dec 10, 2024
35Monitor	CVE-2024-11773No exploit	SQL injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges to ruivanti · cloud services appliance · CWE-89 SQL injection	High7.2	—	23.4%	Dec 10, 2024
51Plan	CVE-2024-55550Weaponized	Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insumitel · micollab · CWE-22 Path traversal	Low2.7	KEV	38.1%	Dec 10, 2024
25Monitor	CVE-2024-10511Proof of concept	CWE-287: Improper Authentication vulnerability exists that could cause Denial of access to the web interface when someone on the local netwoschneider electric · powerchute serial shutdown · CWE-287 Pre-auth Auth bypass	Medium6.3	—	0.9%	Dec 11, 2024
59Plan	CVE-2024-53677Proof of concept	Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checksapache · struts · CWE-434 pre-auth RCE File upload	Critical9.5	—	70.1%	Dec 11, 2024
36Monitor	CVE-2024-12381Proof of concept	Type Confusion in V8 in Google Chrome prior to 131.0.6778.139 allowed a remote attacker to potentially exploit heap corruption via a craftedgoogle · chrome · CWE-843 Pre-auth	High8.8	—	4.8%	Dec 11, 2024
26Monitor	CVE-2024-12483Proof of concept	Dromara UJCMS User ID id authorizationujcms · ujcms · CWE-285 Pre-auth Broken access control (IDOR)	Medium6.3	—	3.5%	Dec 11, 2024
27Monitor	CVE-2024-12484Proof of concept	Codezips Technical Discussion Forum signuppost.php sql injectioncodezips · technical discussion forum · CWE-74 Pre-auth SQL injection	Medium6.9	—	0.9%	Dec 11, 2024
45Plan	CVE-2024-42448Proof of concept	From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform Remveeam · service provider console · CWE-94 RCE	Critical9.9	—	19.9%	Dec 11, 2024
37Monitor	CVE-2024-45337Proof of concept	Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/cryptogolang.org/x/crypto · golang.org/x/crypto/ssh · CWE-1108 Pre-auth	Critical9.1	—	3.1%	Dec 11, 2024
61This week	CVE-2024-49112Proof of concept	Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerabilitymicrosoft · windows 10 1507 · CWE-190 pre-auth RCE Memory safety	Critical9.8	—	71.8%	Dec 11, 2024
55Plan	CVE-2024-49113Proof of concept	Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerabilitymicrosoft · windows 10 1507 · CWE-125 Pre-auth Memory safety Denial of service	High7.5	—	83.5%	Dec 11, 2024
35Monitor	CVE-2024-49116No exploit	Windows Remote Desktop Services Remote Code Execution Vulnerabilitymicrosoft · windows server 2016 · CWE-416 pre-auth RCE Memory safety	High8.1	—	10.1%	Dec 11, 2024
35Monitor	CVE-2024-49117Proof of concept	Windows Hyper-V Remote Code Execution Vulnerabilitymicrosoft · windows 11 22h2 · CWE-393 RCE	High8.8	—	1.0%	Dec 11, 2024
38Monitor	CVE-2024-49122No exploit	Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerabilitymicrosoft · windows 10 1507 · CWE-416 pre-auth RCE Memory safety	High8.1	—	20.6%	Dec 11, 2024
69This week	CVE-2024-49138Weaponized	Windows Common Log File System Driver Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1507 · CWE-122 Local privilege escalation Memory safety	High7.8	KEV	26.2%	Dec 11, 2024
43Plan	CVE-2024-50339No exploit	GLPI vulnerable to unauthenticated session hijackingglpi-project · glpi · CWE-79 Pre-auth XSS	Critical9.3	—	18.7%	Dec 11, 2024
36Monitor	CVE-2024-55587Proof of concept	python-libarchive through 4.2.1 allows directory traversal (to create files) in extract in zip.py for ZipFile.extractall and ZipFile.extractCWE-22 Path traversal	High8.8	—	2.1%	Dec 11, 2024
35Monitor	CVE-2024-54498Proof of concept	A path handling issue was addressed with improved validation.apple · macos	High8.8	—	1.1%	Dec 11, 2024
31Monitor	CVE-2024-54502No exploit	The issue was addressed with improved checks.apple · safari · CWE-125 Pre-auth Memory safety Denial of service	Medium6.5	—	17.0%	Dec 11, 2024
31Monitor	CVE-2024-54515No exploit	A logic issue was addressed with improved restrictions.apple · macos · CWE-281 Local privilege escalation	High7.8	—	0.2%	Dec 11, 2024
34Monitor	CVE-2024-55659No exploit	SiYuan has an arbitrary file write in the host via /api/asset/uploadb3log · siyuan · CWE-22 Pre-auth Path traversal XSS	High8.7	—	0.3%	Dec 11, 2024
49Plan	CVE-2024-10124Proof of concept	Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce <= 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activationthemehunk · vayu blocks – website builder for the block editor · CWE-284 pre-auth RCE Broken access control (IDOR)	Critical9.8	—	32.7%	Dec 12, 2024
30Monitor	CVE-2024-12172Proof of concept	WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses <= 3.2.21 - Missing Authorization to Authenticated (Subscriber+)hookandhook · wp courses lms – online courses builder, elearning courses, courses solution, education courses · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.7%	Dec 12, 2024
39Monitor	CVE-2024-55099Proof of concept	A SQL Injection vulnerability was found in /admin/index.php in phpgurukul Online Nurse Hiring System v1.0, which allows remote attackers to phpgurukul · online nurse hiring system · CWE-89 pre-auth RCE SQL injection	Critical9.8	—	1.0%	Dec 12, 2024
40Plan	CVE-2024-55875Proof of concept	http4k has a potential XXE (XML External Entity Injection) vulnerabilityhttp4k · http4k · CWE-200 Pre-auth SSRF XXE	Critical9.8	—	1.9%	Dec 12, 2024
39Monitor	CVE-2024-12603Proof of concept	A logic vulnerability in the the mobile application (com.transsion.applock) can lead to bypassing the application password.tecno · com.transsion.applock · CWE-602 Pre-auth	Critical9.8	—	0.5%	Dec 12, 2024
33Monitor	CVE-2024-10783Proof of concept	MainWP Child <= 5.3.3 - Missing Authorization to Unauthenticated Privilege Escalationmainwp · mainwp child – securely connects to the mainwp dashboard to manage multiple sites · CWE-862 Pre-auth Broken access control (IDOR)	High8.1	—	2.3%	Dec 13, 2024
40Plan	CVE-2024-9290Proof of concept	Super Backup & Clone - Migrate for WordPress <= 2.3.3 - Unauthenticated Arbitrary File Uploadazzaroco · super backup & clone - migrate for wordpress · CWE-434 pre-auth RCE File upload	Critical9.8	—	3.5%	Dec 13, 2024
29Monitor	CVE-2024-55889Proof of concept	phpMyFAQ Vulnerable to Unintended File Download Triggered by Embedded Framesphpmyfaq · phpmyfaq · CWE-451	High7.2	—	2.1%	Dec 13, 2024
17Monitor	CVE-2023-36531Proof of concept	WordPress LiquidPoll plugin <= 3.3.68 - Broken Access Control vulnerabilityliquidpoll · liquidpoll – advanced polls for creators and brands · CWE-862 Broken access control (IDOR)	Medium4.3	—	1.0%	Dec 13, 2024
39Monitor	CVE-2024-54239Proof of concept	WordPress Eyewear prescription form plugin <= 4.0.18 - Arbitrary Option Update to Privilege Escalation vulnerabilitydugudlabs · eyewear prescription form · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.9%	Dec 13, 2024
39Monitor	CVE-2024-54262Proof of concept	WordPress Import Export For WooCommerce plugin <= 1.6.2 - Arbitrary File Upload vulnerabilitysidngr · import export for woocommerce · CWE-434 File upload	Critical9.9	—	1.4%	Dec 13, 2024
37Monitor	CVE-2024-54292Proof of concept	WordPress Appsplate plugin <= 2.1.3 - SQL Injection vulnerabilityappsplate · appsplate · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.8%	Dec 13, 2024
28Monitor	CVE-2024-54330Proof of concept	WordPress Hurrakify plugin <= 2.4 - Server Side Request Forgery (SSRF) vulnerabilityhurraki · hurrakify · CWE-918 Pre-auth SSRF	High7.2	—	1.4%	Dec 13, 2024
43Plan	CVE-2024-55661Proof of concept	Laravel Pulse Allows Remote Code Execution via Unprotected Query Methodlaravel · pulse · CWE-94 RCE	High8.7	—	29.5%	Dec 13, 2024
28Monitor	CVE-2024-55890Proof of concept	D-Tale allows Remote Code Execution through the Custom Filter Inputman-group · dtale · CWE-79 pre-auth RCE XSS	Medium6.9	—	2.4%	Dec 13, 2024
97Now	CVE-2024-55956Weaponized	In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitcleo · harmony · CWE-77 pre-auth RCE Command injection	Critical9.8	KEV	93.9%	Dec 13, 2024
29Monitor	CVE-2024-9698Proof of concept	Crafthemes Demo Import <= 3.3 - Authenticated (Admin+) Arbitrary File Upload in process_uploaded_filesaruphash · crafthemes demo import · CWE-434 RCE File upload	High7.2	—	1.7%	Dec 14, 2024
38Monitor	CVE-2024-53376Proof of concept	CyberPanel before 2.3.8 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the phpSelection field tcyberpanel · cyberpanel · CWE-78 RCE Command injection	High8.8	—	10.8%	Dec 16, 2024
21Monitor	CVE-2024-5333Proof of concept	The Events Calendar < 6.8.2.1 - Unauthenticated Password Protected Event Disclosurestellarwp · the events calendar · CWE-639 Pre-auth Broken access control (IDOR)	Medium5.3	—	1.1%	Dec 16, 2024
38Monitor	CVE-2024-12641Proof of concept	Chunghwa Telecom TenderDocTransfer - Reflected Cross-site Scripting to RCEcht · tenderdoctransfer · CWE-79 pre-auth RCE XSS CSRF	Critical9.6	—	1.4%	Dec 16, 2024
40Plan	CVE-2024-54363Proof of concept	WordPress Wp NssUser Register plugin <= 1.0.0 - Privilege Escalation vulnerabilitysaiful.total · wp nssuser register · CWE-266 Pre-auth	Critical9.8	—	1.9%	Dec 16, 2024
36Monitor	CVE-2024-54369Proof of concept	WordPress Zita Site Builder plugin <= 1.0.2 - Arbitrary Plugin Installation and Activation vulnerabilitythemehunk · zita site builder · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.1	—	1.6%	Dec 16, 2024
30Monitor	CVE-2024-54374Proof of concept	WordPress Sogrid plugin <= 1.5.6 - Local File Inclusion vulnerabilitysabri · sogrid · CWE-22 Pre-auth Path traversal	High7.5	—	1.2%	Dec 16, 2024
35Monitor	CVE-2024-54378Proof of concept	WordPress Quietly Insights plugin <= 1.2.2 - Arbitrary Option Update to Privilege Escalation vulnerabilityquietly · quietly insights · CWE-862 Broken access control (IDOR)	High8.8	—	0.7%	Dec 16, 2024
35Monitor	CVE-2024-54379Proof of concept	WordPress Minterpress plugin <= 1.0.5 - Arbitrary Option Update to Privilege Escalation vulnerabilityblokhauswp · minterpress · CWE-862 Broken access control (IDOR)	High8.8	—	0.7%	Dec 16, 2024
30Monitor	CVE-2024-54385Proof of concept	WordPress Radio Player plugin <= 2.0.83 - Server Side Request Forgery (SSRF) vulnerabilityprinceahmed · radio player · CWE-918 Pre-auth SSRF	High7.2	—	5.5%	Dec 16, 2024
37Monitor	CVE-2024-55972Proof of concept	WordPress eTemplates plugin <= 0.2.1 - SQL Injection vulnerabilitychriscarvache · etemplates · CWE-89 Pre-auth SQL injection	Critical9.3	—	1.2%	Dec 16, 2024
37Monitor	CVE-2024-55976Proof of concept	WordPress Critical Site Intel plugin <= 1.0 - SQL Injection vulnerabilitymikeleembruggen · critical site intel · CWE-89 Pre-auth SQL injection	Critical9.3	—	1.2%	Dec 16, 2024
37Monitor	CVE-2024-55978Proof of concept	WordPress Code Generator Pro plugin <= 1.2 - SQL Injection vulnerabilitywalletstation · code generator pro · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.7%	Dec 16, 2024
37Monitor	CVE-2024-55980Proof of concept	WordPress Wr Age Verification plugin <= 2.0.0 - SQL Injection vulnerabilityrobindkumar · wr age verification · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.7%	Dec 16, 2024
37Monitor	CVE-2024-55981Proof of concept	WordPress Nabz Image Gallery plugin <= v1.00 - SQL Injection vulnerabilitynabajit roy · nabz image gallery · CWE-89 Pre-auth SQL injection	Critical9.3	—	1.0%	Dec 16, 2024
38Monitor	CVE-2024-55982Proof of concept	WordPress Share Buttons – Social Media plugin <= 1.0.2 - SQL Injection vulnerabilityrichteam · share buttons – social media · CWE-89 Pre-auth SQL injection	Critical9.3	—	1.7%	Dec 16, 2024
37Monitor	CVE-2024-55988Proof of concept	WordPress Navayan CSV Export Plugin <= 1.0.9 - SQL Injection vulnerabilityamol nirmala waman · navayan csv export · CWE-89 Pre-auth SQL injection	Critical9.3	—	1.1%	Dec 16, 2024
39Monitor	CVE-2024-55557Proof of concept	ui/pref/ProxyPrefView.java in weasis-core in Weasis 4.5.1 has a hardcoded key for symmetric encryption of proxy credentials.CWE-798 Pre-auth Hard-coded credentials	Critical9.8	—	1.3%	Dec 16, 2024
46Plan	CVE-2024-29671Proof of concept	Buffer Overflow vulnerability in NEXTU FLATA AX1500 Router v.1.0.2 allows a remote attacker to execute arbitrary code via the POST request hCWE-120 pre-auth RCE Memory safety	Critical9.8	—	24.5%	Dec 16, 2024

CVE-2024-20137
30Monitor
In wlan driver, there is a possible client disconnection due to improper handling of exceptional conditions.
HighCVSS 7.5Proof of conceptEPSS 1%
- Pre-auth
- Denial of service
mediatek, inc. · mt6890, mt7622, mt7915, mt7916, mt7981, mt7986Dec 2, 2024
CVE-2024-53104
62This week
media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
HighCVSS 7.8KEVWeaponizedEPSS 3%
- Memory safety
linux · linux kernelDec 2, 2024
CVE-2024-46906
47Plan
WhatsUp Gold GetSqlWhereClause SQL Injection Privilege Escalation Vulnerability
HighCVSS 8.8No exploitEPSS 40%
- SQL injection
progress · whatsup goldDec 2, 2024
CVE-2024-46909
54Plan
WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability
CriticalCVSS 9.8No exploitEPSS 48%
- pre-auth RCE
- Path traversal
progress · whatsup goldDec 2, 2024
CVE-2024-52806
33Monitor
SimpleSAMLphp SAML2 has an XXE in parsing SAML messages
HighCVSS 8.3Proof of conceptEPSS 0%
- Pre-auth
- XXE
simplesamlphp · saml2Dec 2, 2024
CVE-2024-53259
26Monitor
quic-go affected by an ICMP Packet Too Large Injection Attack on Linux
MediumCVSS 6.5Proof of conceptEPSS 0%
- Pre-auth
- Denial of service
quic-go · quic-goDec 2, 2024
CVE-2024-53617
19Monitor
A Cross Site Scripting vulnerability in LibrePhotos before commit 32237 allows attackers to takeover any account via uploading an HTML file
MediumCVSS 4.8Proof of conceptEPSS 0%
- Broken access control (IDOR)
- XSS
Dec 2, 2024
CVE-2024-53900
37Monitor
Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.
CriticalCVSS 9.1Proof of conceptEPSS 3%
- Pre-auth
- SQL injection
mongoosejs · mongooseDec 2, 2024
CVE-2024-53375
45Plan
An Authenticated Remote Code Execution (RCE) vulnerability affects the TP-Link Archer router series.
HighCVSS 8.0Proof of conceptEPSS 42%
- RCE
- Command injection
Dec 2, 2024
CVE-2024-29404
31Monitor
An issue in Razer Synapse 3 v.3.9.131.20813 and Synapse 3 App v.20240213 allows a local attacker to execute arbitrary code via the export pa
HighCVSS 7.8Proof of conceptEPSS 0%
- RCE
- Command injection
Dec 3, 2024
CVE-2024-42455
37Monitor
A vulnerability in Veeam Backup & Replication allows a low-privileged user to connect to remoting services and exploit insecure deserializat
HighCVSS 8.1No exploitEPSS 15%
- Auth bypass
- Deserialization
veeam · veeam backup \& replicationDec 3, 2024
CVE-2024-11643
35Monitor
Accessibility by AllAccessible <= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Update
HighCVSS 8.8Proof of conceptEPSS 0%
- Broken access control (IDOR)
allaccessible · accessibility by allaccessibleDec 4, 2024
CVE-2024-48839
38Monitor
Remote Code Execution, RCE
CriticalCVSS 9.3Proof of conceptEPSS 2%
- pre-auth RCE
abb · aspect-ent-2 firmwareDec 5, 2024
CVE-2024-48840
38Monitor
Unauthorized Access vulnerabilities allow Remote Code Execution.
CriticalCVSS 9.3Proof of conceptEPSS 2%
- pre-auth RCE
abb · aspect-ent-2 firmwareDec 5, 2024
CVE-2024-48844
28Monitor
Denial of Service, DoS
HighCVSS 7.2Proof of conceptEPSS 0%
- Denial of service
abb · aspect-ent-2 firmwareDec 5, 2024
CVE-2024-48845
38Monitor
Weak Password Rules/Strength
CriticalCVSS 9.3Proof of conceptEPSS 1%
- Pre-auth
abb · aspect-ent-2 firmwareDec 5, 2024
CVE-2024-48846
28Monitor
Cross Side Request Forgery, CSRF
HighCVSS 7.1Proof of conceptEPSS 0%
- CSRF
abb · aspect-ent-2 firmwareDec 5, 2024
CVE-2024-51544
39Monitor
Service Control vulnerabilities allow access to service restart requests and vm configuration settings.
HighCVSS 8.8No exploitEPSS 13%
- Pre-auth
abb · aspect-ent-12 firmwareDec 5, 2024
CVE-2024-51546
34Monitor
Credentails Disclosure
HighCVSS 8.7Proof of conceptEPSS 1%
- Pre-auth
abb · aspect-ent-12 firmwareDec 5, 2024
CVE-2024-51550
38Monitor
Data Validation / Sanitization
CriticalCVSS 9.3Proof of conceptEPSS 1%
- Pre-auth
abb · aspect-ent-12 firmwareDec 5, 2024
CVE-2024-6516
37Monitor
Cross Site Scripting XSS
CriticalCVSS 9.3Proof of conceptEPSS 1%
- Pre-auth
- XSS
abb · aspect-ent-2 firmwareDec 5, 2024
CVE-2024-12227
27Monitor
MSI Dragon Center IOCTL NTIOLib_X64.sys MmUnMapIoSpace null pointer dereference
MediumCVSS 6.8Proof of conceptEPSS 0%
msi · dragon centerDec 5, 2024
CVE-2024-53703
36Monitor
A vulnerability in the SonicWall SMA100 SSLVPN firmware 10.2.1.13-72sv and earlier versions mod_httprp library loaded by the Apache web serv
HighCVSS 8.1Proof of conceptEPSS 12%
- Pre-auth
- Memory safety
sonicwall · sma 200 firmwareDec 5, 2024
CVE-2024-54679
26Monitor
CyberPanel (aka Cyber Panel) before 6778ad1 does not require the FilemanagerAdmin capability for restartMySQL actions.
MediumCVSS 6.5Proof of conceptEPSS 0%
- Broken access control (IDOR)
- Denial of service
cyberpanel · cyberpanelDec 5, 2024
CVE-2024-53457
35Monitor
A stored cross-site scripting (XSS) vulnerability in the Device Settings section of LibreNMS v24.9.0 to v24.10.0 allows attackers to execute
MediumCVSS 5.4No exploitEPSS 46%
- RCE
- XSS
librenms · librenmsDec 5, 2024
CVE-2024-10578
35Monitor
Pubnews <= 1.0.7 - Authenticated (Subscriber+) Arbitrary Plugin Installation
HighCVSS 8.8Proof of conceptEPSS 1%
- File upload
blazethemes · pubnewsDec 6, 2024
CVE-2024-11201
25Monitor
myCred – Loyalty Points and Rewards plugin <= 2.7.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_send Shortcode
MediumCVSS 6.4Proof of conceptEPSS 0%
- XSS
saadiqbal · points management system for gamification, ranks, badges, and loyalty rewards program – mycredDec 6, 2024
CVE-2024-11728
34Monitor
KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Unauthenticated SQL Injection
HighCVSS 7.5Proof of conceptEPSS 13%
- Pre-auth
- SQL injection
iqonic · kivicareDec 6, 2024
CVE-2024-10516
34Monitor
Swift Performance Lite <= 2.3.7.1 - Unauthenticated Local PHP File Inclusion via 'ajaxify'
HighCVSS 8.1Proof of conceptEPSS 6%
- pre-auth RCE
- Path traversal
swte · swift performance liteDec 6, 2024
CVE-2024-50677
24Monitor
A cross-site scripting (XSS) vulnerability in OroPlatform CMS v5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted p
MediumCVSS 6.1Proof of conceptEPSS 0%
- pre-auth RCE
- XSS
oroinc · oroplatformDec 6, 2024
CVE-2024-50404
27Monitor
A link following vulnerability has been reported to affect Qsync Central.
MediumCVSS 6.8Proof of conceptEPSS 1%
qnap · qsync centralDec 6, 2024
CVE-2024-53691
41Plan
A link following vulnerability has been reported to affect several QNAP operating system versions.
HighCVSS 8.7Proof of conceptEPSS 23%
qnap · qtsDec 6, 2024
CVE-2024-12270
31Monitor
Beautiful Taxonomy Filters <= 2.4.3 - Unauthenticated SQL Injection
HighCVSS 7.5Proof of conceptEPSS 3%
- Pre-auth
- SQL injection
jonathandejong · beautiful taxonomy filtersDec 7, 2024
CVE-2024-12209
46Plan
WP Umbrella: Update Backup Restore & Monitoring <= 2.17.0 - Unauthenticated Local File Inclusion
CriticalCVSS 9.8Proof of conceptEPSS 23%
- pre-auth RCE
wphealth · wp umbrella: update backup restore & monitoringDec 8, 2024
CVE-2024-12342
31Monitor
TP-Link VN020 F3v(T) Incomplete SOAP Request WANIPConnection denial of service
HighCVSS 7.1Proof of conceptEPSS 9%
- Pre-auth
tp-link · vn020 f3v(t)Dec 8, 2024
CVE-2024-12344
22Monitor
TP-Link VN020 F3v(T) FTP USER Command memory corruption
MediumCVSS 5.3Proof of conceptEPSS 1%
- Memory safety
tp-link · vn020 f3v firmwareDec 8, 2024
CVE-2023-30486
17Monitor
WordPress Square theme <= 2.0.0 - Broken Access Control
MediumCVSS 4.3Proof of conceptEPSS 0%
- Broken access control (IDOR)
hashthemes · squareDec 9, 2024
CVE-2023-32117
41Plan
WordPress Integrate Google Drive plugin <= 1.1.99 - Unauthenticated Broken Access Control vulnerability
CriticalCVSS 9.8Proof of conceptEPSS 7%
- Pre-auth
- Broken access control (IDOR)
softlab · integrate google driveDec 9, 2024
CVE-2024-21542
26Monitor
Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) due to improper destinat
MediumCVSS 6.6Proof of conceptEPSS 1%
- Pre-auth
Dec 10, 2024
CVE-2024-10708
20Monitor
System Dashboard < 2.8.15 - Admin+ Path Traversal
MediumCVSS 4.9Proof of conceptEPSS 2%
- Path traversal
bowo · system dashboardDec 10, 2024
CVE-2024-11868
21Monitor
LearnPress – WordPress LMS Plugin <= 4.2.7.3 - Course Material Sensitive Information Exposure via REST API
MediumCVSS 5.3Proof of conceptEPSS 1%
- Pre-auth
- Broken access control (IDOR)
thimpress · learnpressDec 10, 2024
CVE-2024-54152
38Monitor
Angular Expressions - Remote Code Execution when using locals
CriticalCVSS 9.3Proof of conceptEPSS 2%
- pre-auth RCE
peerigon · angular-expressionsDec 10, 2024
CVE-2024-55544
38Monitor
Authenticated Command Injection
HighCVSS 8.7No exploitEPSS 12%
- RCE
- Command injection
oringnet · iap-420 firmwareDec 10, 2024
CVE-2024-55547
42Plan
Remote Command Execution via SNMP
CriticalCVSS 9.3No exploitEPSS 17%
- pre-auth RCE
- Command injection
oringnet · iap-420 firmwareDec 10, 2024
CVE-2024-11773
35Monitor
SQL injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges to ru
HighCVSS 7.2No exploitEPSS 23%
- SQL injection
ivanti · cloud services applianceDec 10, 2024
CVE-2024-55550
51Plan
Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insu
LowCVSS 2.7KEVWeaponizedEPSS 38%
- Path traversal
mitel · micollabDec 10, 2024
CVE-2024-10511
25Monitor
CWE-287: Improper Authentication vulnerability exists that could cause Denial of access to the web interface when someone on the local netwo
MediumCVSS 6.3Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
schneider electric · powerchute serial shutdownDec 11, 2024
CVE-2024-53677
59Plan
Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks
CriticalCVSS 9.5Proof of conceptEPSS 70%
- pre-auth RCE
- File upload
apache · strutsDec 11, 2024
CVE-2024-12381
36Monitor
Type Confusion in V8 in Google Chrome prior to 131.0.6778.139 allowed a remote attacker to potentially exploit heap corruption via a crafted
HighCVSS 8.8Proof of conceptEPSS 4%
- Pre-auth
google · chromeDec 11, 2024
CVE-2024-12483
26Monitor
Dromara UJCMS User ID id authorization
MediumCVSS 6.3Proof of conceptEPSS 3%
- Pre-auth
- Broken access control (IDOR)
ujcms · ujcmsDec 11, 2024
CVE-2024-12484
27Monitor
Codezips Technical Discussion Forum signuppost.php sql injection
MediumCVSS 6.9Proof of conceptEPSS 0%
- Pre-auth
- SQL injection
codezips · technical discussion forumDec 11, 2024
CVE-2024-42448
45Plan
From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform Rem
CriticalCVSS 9.9Proof of conceptEPSS 19%
- RCE
veeam · service provider consoleDec 11, 2024
CVE-2024-45337
37Monitor
Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto
CriticalCVSS 9.1Proof of conceptEPSS 3%
- Pre-auth
golang.org/x/crypto · golang.org/x/crypto/sshDec 11, 2024
CVE-2024-49112
61This week
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
CriticalCVSS 9.8Proof of conceptEPSS 71%
- pre-auth RCE
- Memory safety
microsoft · windows 10 1507Dec 11, 2024
CVE-2024-49113
55Plan
Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability
HighCVSS 7.5Proof of conceptEPSS 83%
- Pre-auth
- Memory safety
- Denial of service
microsoft · windows 10 1507Dec 11, 2024
CVE-2024-49116
35Monitor
Windows Remote Desktop Services Remote Code Execution Vulnerability
HighCVSS 8.1No exploitEPSS 10%
- pre-auth RCE
- Memory safety
microsoft · windows server 2016Dec 11, 2024
CVE-2024-49117
35Monitor
Windows Hyper-V Remote Code Execution Vulnerability
HighCVSS 8.8Proof of conceptEPSS 1%
- RCE
microsoft · windows 11 22h2Dec 11, 2024
CVE-2024-49122
38Monitor
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
HighCVSS 8.1No exploitEPSS 20%
- pre-auth RCE
- Memory safety
microsoft · windows 10 1507Dec 11, 2024
CVE-2024-49138
69This week
Windows Common Log File System Driver Elevation of Privilege Vulnerability
HighCVSS 7.8KEVWeaponizedEPSS 26%
- Local privilege escalation
- Memory safety
microsoft · windows 10 1507Dec 11, 2024
CVE-2024-50339
43Plan
GLPI vulnerable to unauthenticated session hijacking
CriticalCVSS 9.3No exploitEPSS 18%
- Pre-auth
- XSS
glpi-project · glpiDec 11, 2024
CVE-2024-55587
36Monitor
python-libarchive through 4.2.1 allows directory traversal (to create files) in extract in zip.py for ZipFile.extractall and ZipFile.extract
HighCVSS 8.8Proof of conceptEPSS 2%
- Path traversal
Dec 11, 2024
CVE-2024-54498
35Monitor
A path handling issue was addressed with improved validation.
HighCVSS 8.8Proof of conceptEPSS 1%
apple · macosDec 11, 2024
CVE-2024-54502
31Monitor
The issue was addressed with improved checks.
MediumCVSS 6.5No exploitEPSS 17%
- Pre-auth
- Memory safety
- Denial of service
apple · safariDec 11, 2024
CVE-2024-54515
31Monitor
A logic issue was addressed with improved restrictions.
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
apple · macosDec 11, 2024
CVE-2024-55659
34Monitor
SiYuan has an arbitrary file write in the host via /api/asset/upload
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
- XSS
b3log · siyuanDec 11, 2024
CVE-2024-10124
49Plan
Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce <= 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation
CriticalCVSS 9.8Proof of conceptEPSS 32%
- pre-auth RCE
- Broken access control (IDOR)
themehunk · vayu blocks – website builder for the block editorDec 12, 2024
CVE-2024-12172
30Monitor
WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses <= 3.2.21 - Missing Authorization to Authenticated (Subscriber+)
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
hookandhook · wp courses lms – online courses builder, elearning courses, courses solution, education coursesDec 12, 2024
CVE-2024-55099
39Monitor
A SQL Injection vulnerability was found in /admin/index.php in phpgurukul Online Nurse Hiring System v1.0, which allows remote attackers to
CriticalCVSS 9.8Proof of conceptEPSS 1%
- pre-auth RCE
- SQL injection
phpgurukul · online nurse hiring systemDec 12, 2024
CVE-2024-55875
40Plan
http4k has a potential XXE (XML External Entity Injection) vulnerability
CriticalCVSS 9.8Proof of conceptEPSS 1%
- Pre-auth
- SSRF
- XXE
http4k · http4kDec 12, 2024
CVE-2024-12603
39Monitor
A logic vulnerability in the the mobile application (com.transsion.applock) can lead to bypassing the application password.
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
tecno · com.transsion.applockDec 12, 2024
CVE-2024-10783
33Monitor
MainWP Child <= 5.3.3 - Missing Authorization to Unauthenticated Privilege Escalation
HighCVSS 8.1Proof of conceptEPSS 2%
- Pre-auth
- Broken access control (IDOR)
mainwp · mainwp child – securely connects to the mainwp dashboard to manage multiple sitesDec 13, 2024
CVE-2024-9290
40Plan
Super Backup & Clone - Migrate for WordPress <= 2.3.3 - Unauthenticated Arbitrary File Upload
CriticalCVSS 9.8Proof of conceptEPSS 3%
- pre-auth RCE
- File upload
azzaroco · super backup & clone - migrate for wordpressDec 13, 2024
CVE-2024-55889
29Monitor
phpMyFAQ Vulnerable to Unintended File Download Triggered by Embedded Frames
HighCVSS 7.2Proof of conceptEPSS 2%
phpmyfaq · phpmyfaqDec 13, 2024
CVE-2023-36531
17Monitor
WordPress LiquidPoll plugin <= 3.3.68 - Broken Access Control vulnerability
MediumCVSS 4.3Proof of conceptEPSS 1%
- Broken access control (IDOR)
liquidpoll · liquidpoll – advanced polls for creators and brandsDec 13, 2024
CVE-2024-54239
39Monitor
WordPress Eyewear prescription form plugin <= 4.0.18 - Arbitrary Option Update to Privilege Escalation vulnerability
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
dugudlabs · eyewear prescription formDec 13, 2024
CVE-2024-54262
39Monitor
WordPress Import Export For WooCommerce plugin <= 1.6.2 - Arbitrary File Upload vulnerability
CriticalCVSS 9.9Proof of conceptEPSS 1%
- File upload
sidngr · import export for woocommerceDec 13, 2024
CVE-2024-54292
37Monitor
WordPress Appsplate plugin <= 2.1.3 - SQL Injection vulnerability
CriticalCVSS 9.3Proof of conceptEPSS 0%
- Pre-auth
- SQL injection
appsplate · appsplateDec 13, 2024
CVE-2024-54330
28Monitor
WordPress Hurrakify plugin <= 2.4 - Server Side Request Forgery (SSRF) vulnerability
HighCVSS 7.2Proof of conceptEPSS 1%
- Pre-auth
- SSRF
hurraki · hurrakifyDec 13, 2024
CVE-2024-55661
43Plan
Laravel Pulse Allows Remote Code Execution via Unprotected Query Method
HighCVSS 8.7Proof of conceptEPSS 29%
- RCE
laravel · pulseDec 13, 2024
CVE-2024-55890
28Monitor
D-Tale allows Remote Code Execution through the Custom Filter Input
MediumCVSS 6.9Proof of conceptEPSS 2%
- pre-auth RCE
- XSS
man-group · dtaleDec 13, 2024
CVE-2024-55956
97Now
In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbit
CriticalCVSS 9.8KEVWeaponizedEPSS 93%
- pre-auth RCE
- Command injection
cleo · harmonyDec 13, 2024
CVE-2024-9698
29Monitor
Crafthemes Demo Import <= 3.3 - Authenticated (Admin+) Arbitrary File Upload in process_uploaded_files
HighCVSS 7.2Proof of conceptEPSS 1%
- RCE
- File upload
aruphash · crafthemes demo importDec 14, 2024
CVE-2024-53376
38Monitor
CyberPanel before 2.3.8 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the phpSelection field t
HighCVSS 8.8Proof of conceptEPSS 10%
- RCE
- Command injection
cyberpanel · cyberpanelDec 16, 2024
CVE-2024-5333
21Monitor
The Events Calendar < 6.8.2.1 - Unauthenticated Password Protected Event Disclosure
MediumCVSS 5.3Proof of conceptEPSS 1%
- Pre-auth
- Broken access control (IDOR)
stellarwp · the events calendarDec 16, 2024
CVE-2024-12641
38Monitor
Chunghwa Telecom TenderDocTransfer - Reflected Cross-site Scripting to RCE
CriticalCVSS 9.6Proof of conceptEPSS 1%
- pre-auth RCE
- XSS
- CSRF
cht · tenderdoctransferDec 16, 2024
CVE-2024-54363
40Plan
WordPress Wp NssUser Register plugin <= 1.0.0 - Privilege Escalation vulnerability
CriticalCVSS 9.8Proof of conceptEPSS 1%
- Pre-auth
saiful.total · wp nssuser registerDec 16, 2024
CVE-2024-54369
36Monitor
WordPress Zita Site Builder plugin <= 1.0.2 - Arbitrary Plugin Installation and Activation vulnerability
CriticalCVSS 9.1Proof of conceptEPSS 1%
- Pre-auth
- Broken access control (IDOR)
themehunk · zita site builderDec 16, 2024
CVE-2024-54374
30Monitor
WordPress Sogrid plugin <= 1.5.6 - Local File Inclusion vulnerability
HighCVSS 7.5Proof of conceptEPSS 1%
- Pre-auth
- Path traversal
sabri · sogridDec 16, 2024
CVE-2024-54378
35Monitor
WordPress Quietly Insights plugin <= 1.2.2 - Arbitrary Option Update to Privilege Escalation vulnerability
HighCVSS 8.8Proof of conceptEPSS 0%
- Broken access control (IDOR)
quietly · quietly insightsDec 16, 2024
CVE-2024-54379
35Monitor
WordPress Minterpress plugin <= 1.0.5 - Arbitrary Option Update to Privilege Escalation vulnerability
HighCVSS 8.8Proof of conceptEPSS 0%
- Broken access control (IDOR)
blokhauswp · minterpressDec 16, 2024
CVE-2024-54385
30Monitor
WordPress Radio Player plugin <= 2.0.83 - Server Side Request Forgery (SSRF) vulnerability
HighCVSS 7.2Proof of conceptEPSS 5%
- Pre-auth
- SSRF
princeahmed · radio playerDec 16, 2024
CVE-2024-55972
37Monitor
WordPress eTemplates plugin <= 0.2.1 - SQL Injection vulnerability
CriticalCVSS 9.3Proof of conceptEPSS 1%
- Pre-auth
- SQL injection
chriscarvache · etemplatesDec 16, 2024
CVE-2024-55976
37Monitor
WordPress Critical Site Intel plugin <= 1.0 - SQL Injection vulnerability
CriticalCVSS 9.3Proof of conceptEPSS 1%
- Pre-auth
- SQL injection
mikeleembruggen · critical site intelDec 16, 2024
CVE-2024-55978
37Monitor
WordPress Code Generator Pro plugin <= 1.2 - SQL Injection vulnerability
CriticalCVSS 9.3Proof of conceptEPSS 0%
- Pre-auth
- SQL injection
walletstation · code generator proDec 16, 2024
CVE-2024-55980
37Monitor
WordPress Wr Age Verification plugin <= 2.0.0 - SQL Injection vulnerability
CriticalCVSS 9.3Proof of conceptEPSS 0%
- Pre-auth
- SQL injection
robindkumar · wr age verificationDec 16, 2024
CVE-2024-55981
37Monitor
WordPress Nabz Image Gallery plugin <= v1.00 - SQL Injection vulnerability
CriticalCVSS 9.3Proof of conceptEPSS 1%
- Pre-auth
- SQL injection
nabajit roy · nabz image galleryDec 16, 2024
CVE-2024-55982
38Monitor
WordPress Share Buttons – Social Media plugin <= 1.0.2 - SQL Injection vulnerability
CriticalCVSS 9.3Proof of conceptEPSS 1%
- Pre-auth
- SQL injection
richteam · share buttons – social mediaDec 16, 2024
CVE-2024-55988
37Monitor
WordPress Navayan CSV Export Plugin <= 1.0.9 - SQL Injection vulnerability
CriticalCVSS 9.3Proof of conceptEPSS 1%
- Pre-auth
- SQL injection
amol nirmala waman · navayan csv exportDec 16, 2024
CVE-2024-55557
39Monitor
ui/pref/ProxyPrefView.java in weasis-core in Weasis 4.5.1 has a hardcoded key for symmetric encryption of proxy credentials.
CriticalCVSS 9.8Proof of conceptEPSS 1%
- Pre-auth
- Hard-coded credentials
Dec 16, 2024
CVE-2024-29671
46Plan
Buffer Overflow vulnerability in NEXTU FLATA AX1500 Router v.1.0.2 allows a remote attacker to execute arbitrary code via the POST request h
CriticalCVSS 9.8Proof of conceptEPSS 24%
- pre-auth RCE
- Memory safety
Dec 16, 2024