CVE-2024-1000 to CVE-2024-1999

218 CVEs with public proof-of-concept exploits.

• CVE-2024-10001 PoCTotolink N200RE cstecgi.cgi setTracerouteCfg stack-based overflow
• CVE-2024-10011 PoCTotolink N200RE cstecgi.cgi main stack-based overflow
• CVE-2024-10021 PoCTotolink N200RE cstecgi.cgi setIpPortFilterRules stack-based overflow
• CVE-2024-10031 PoCTotolink N200RE cstecgi.cgi setLanguageCfg stack-based overflow
• CVE-2024-10041 PoCTotolink N200RE cstecgi.cgi loginAuth stack-based overflow
• CVE-2024-10071 PoCSourceCodester Employee Management System edit_profile.php sql injection
• CVE-2024-10081 PoCSourceCodester Employee Management System Profile Page edit-photo.php unrestricted upload
• CVE-2024-10091 PoCSourceCodester Employee Management System login.php sql injection
• CVE-2024-10101 PoCSourceCodester Employee Management System edit-profile.php cross site scripting
• CVE-2024-10111 PoCSourceCodester Employee Management System Leave delete-leave.php access control
• CVE-2024-10121 PoCWanhu ezOFFICE wf_printnum.jsp sql injection
• CVE-2024-10141 PoCUncontrolled resource consumption vulnerability in SE-elektronic GmbH E-DDC3.3
• CVE-2024-10161 PoCSolar FTP Server PASV Command denial of service
• CVE-2024-10172 PoCsGabriels FTP Server denial of service
• CVE-2024-10181 PoCPbootCMS cross site scripting
• CVE-2024-10211 PoCRebuild HTTP Request readRawText server-side request forgery
• CVE-2024-10221 PoCCodeAstro Simple Student Result Management System Add Class Page add_classes.php cross site scripting
• CVE-2024-10311 PoCCodeAstro Expense Management System Add Expenses Page 5-Add-Expenses.php cross site scripting
• CVE-2024-10613 PoCsThe 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injection vulnerability in the 'id'…
• CVE-2024-10651 PoCMali GPU Kernel Driver allows improper GPU memory processing operations
• CVE-2024-10681 PoC404 Solution < 2.35.8 - Admin+ SQL Injection
• CVE-2024-107113 PoCsThe Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is…
• CVE-2024-10761 PoCSSL Zen <= 4.5.3 - Unauthenticated Private Keys Access
• CVE-2024-10853 PoCsUse-after-free in Linux kernel's netfilter: nf_tables component
• CVE-2024-108617 PoCsKEVUse-after-free in Linux kernel's netfilter: nf_tables component
• CVE-2024-11031 PoCCodeAstro Real Estate Management System Feedback Form profile.php cross site scripting
• CVE-2024-11061 PoCShariff Wrapper < 4.6.10 - Admin+ Stored XSS
• CVE-2024-11121 PoCBuffer Overflow Vulnerability in Resource Hacker
• CVE-2024-11631 PoCPath traversal vulnerability in mapshaper
• CVE-2024-11831 PoCSSRF Vulnerability in gradio-app/gradio
• CVE-2024-11841 PoCNsasoft Network Sleuth Registration denial of service
• CVE-2024-11851 PoCNsasoft NBMonitor Network Bandwidth Monitor Registration denial of service
• CVE-2024-11862 PoCsMunsoft Easy Archive Recovery Registration Key denial of service
• CVE-2024-11871 PoCMunsoft Easy Outlook Express Recovery Registration Key denial of service
• CVE-2024-11881 PoCRizone Soft Notepad3 Encryption Passphrase denial of service
• CVE-2024-11891 PoCAMPPS Encryption Passphrase denial of service
• CVE-2024-11901 PoCGlobal Scape CuteFTP denial of service
• CVE-2024-11911 PoCHyper CdCatalog HCF File denial of service
• CVE-2024-11921 PoCSouth River WebDrive New Secure WebDAV denial of service
• CVE-2024-11931 PoCNavicat MySQL Conecction denial of service
• CVE-2024-11941 PoCArmcode AlienIP Locate Host denial of service
• CVE-2024-11991 PoCCodeAstro Employee Task Management System attendance-info.php denial of service
• CVE-2024-12001 PoCJspxcms information disclosure
• CVE-2024-12041 PoCMeta Box < 5.9.4 - Contributor+ Arbitrary Posts' Custom Field Disclosure
• CVE-2024-12083 PoCsLearnDash LMS <= 4.10.2 - Sensitive Information Exposure via API
• CVE-2024-12092 PoCsLearnDash LMS <= 4.10.1 - Sensitive Information Exposure via assignments
• CVE-2024-12102 PoCsLearnDash LMS <= 4.10.1 - Sensitive Information Exposure via API
• CVE-2024-12111 PoCCross-Site Request Forgery (CSRF) in GitLab
• CVE-2024-12127 PoCsKEVLoadMaster Pre-Authenticated OS Command Injection
• CVE-2024-12151 PoCSourceCodester CRUD without Page Reload fetch_data.php cross site scripting
• CVE-2024-12191 PoCEasy Social Feed < 6.5.6 - Contributor+ Stored XSS
• CVE-2024-12311 PoCCM Download and File Manager < 2.9.0 - Download Unpublish via CSRF
• CVE-2024-12321 PoCCM Download Manager < 2.9.0 - Download Deletion via CSRF
• CVE-2024-123418 PoCsExclusive Addons for Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• CVE-2024-12431 PoCRemote code execution and local privilege escalation in Wazuh Windows agent via NetNTLMv2 hash theft
• CVE-2024-12471 PoCConcrete CMS version 9 before 9.2.5 vulnerable to stored XSS via the Role Name field
• CVE-2024-12511 PoCTongda OA 2017 delete.php sql injection
• CVE-2024-12521 PoCTongda OA 2017 delete.php sql injection
• CVE-2024-12531 PoCByzoro Smart S40 Management Platform Import web.php unrestricted upload
• CVE-2024-12541 PoCByzoro Smart S20 Management Platform sysmanageajax.php sql injection
• CVE-2024-12561 PoCJspxcms filter_text.do cross site scripting
• CVE-2024-12571 PoCJspxcms find_text.do cross site scripting
• CVE-2024-12651 PoCCodeAstro University Management System Attendance Management att_add.php cross site scripting
• CVE-2024-12661 PoCCodeAstro University Management System Student Registration Form st_reg.php cross site scripting
• CVE-2024-12671 PoCCodeAstro Restaurant POS System create_account.php cross site scripting
• CVE-2024-12681 PoCCodeAstro Restaurant POS System update_product.php unrestricted upload
• CVE-2024-12692 PoCsSourceCodester Product Management System supplier.php cross site scripting
• CVE-2024-12731 PoCStarbox < 3.5.0 - Contributor+ Stored XSS
• CVE-2024-12741 PoCMy Calendar < 3.4.24 - Authenticated Stored XSS
• CVE-2024-12791 PoCPaid Memberships Pro < 2.12.9 - Contributor+ Arbitrary User Custom Field Disclosure
• CVE-2024-12861 PoCPaid Memberships Pro - Membership Maps Add On < 0.7 - Contributor+ Sensitive Information Disclosure
• CVE-2024-12871 PoCPaid Memberships Pro - Member Directory Add On < 1.2.6 - Contributor+ Sensitive Information Disclosure via SQLi
• CVE-2024-12901 PoCFormidable Registration < 2.12 - Contributor+ Arbitrary User Password Reset To Account Takeover
• CVE-2024-12921 PoCWPB Show Core < 2.6 - Reflected XSS
• CVE-2024-12951 PoCThe Events Calendar (Free < 6.4.0.1, Pro < 6.4.0.1) - Contributor+ Arbitrary Events Access
• CVE-2024-12991 PoCPrivilege Chaining in GitLab
• CVE-2024-13011 PoCMultiple Vulnerabilities in Badger Meter's Monitool
• CVE-2024-13021 PoCMultiple Vulnerabilities in Badger Meter's Monitool
• CVE-2024-13031 PoCMultiple Vulnerabilities in Badger Meter's Monitool
• CVE-2024-13041 PoCMultiple Vulnerabilities in Badger Meter's Monitool
• CVE-2024-13061 PoCSmart Forms < 2.6.94 - Edit Entries via CSRF
• CVE-2024-13071 PoCSmart Forms < 2.6.94 - Subscriber+ Edit Entries via Broken Access Control
• CVE-2024-13101 PoCWooCommerce < 8.6 - Contributor+ Private/Draft Products Access
• CVE-2024-13161 PoCEvent Tickets and Registration < 5.8.1 - Contributor+ Arbitrary Events Access
• CVE-2024-13191 PoCEvent Tickets Plus < 5.9.1 - Contributor+ Attendees Lists Disclosure
• CVE-2024-13301 PoCKadence Blocks Pro < 2.3.8 - Contributor+ Arbitrary Option Access
• CVE-2024-13311 PoCTeam Members < 5.3.2 - Author+ Stored XSS
• CVE-2024-13331 PoCResponsive Pricing Table < 5.1.11 - Author+ Stored XSS
• CVE-2024-13461 PoCWeak MySQL database root password in LaborOfficeFree
• CVE-2024-13471 PoCAuthentication Bypass by Spoofing in GitLab
• CVE-2024-13802 PoCsRelevanssi – A Better Search <= 4.22.0 (Free) and <= 2.25.0 (Premium) - Missing Authorization to Unauthenticated Query Log Export
• CVE-2024-14011 PoCProfile Box Shortcode And Widget < 1.2.1 Admin+ Stored XSS
• CVE-2024-14031 PoCAuthentication Bypass in OpenEdge Authentication Gateway and AdminServer
• CVE-2024-14041 PoCLinksys WRT54GL Web Management Interface SysInfo.htm information disclosure
• CVE-2024-14051 PoCLinksys WRT54GL Web Management Interface wlaninfo.htm information disclosure
• CVE-2024-14061 PoCLinksys WRT54GL Web Management Interface SysInfo1.htm information disclosure
• CVE-2024-14301 PoCNetgear R7000 Web Management Interface currentsetting.htm information disclosure
• CVE-2024-14311 PoCNetgear R7000 Web Management Interface debuginfo.htm information disclosure
• CVE-2024-14321 PoCDeepFaceLab main.py apply_xseg deserialization
• CVE-2024-14411 PoCLibvirt: off-by-one error in udevlistinterfacesbystatus()
• CVE-2024-14431 PoCMSI Afterburner v4.6.5.16370 - Denial of Service
• CVE-2024-14511 PoCImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
• CVE-2024-14602 PoCsMSI Afterburner v4.6.5.16370 - Kernel Memory Leak
• CVE-2024-14831 PoCPath Traversal Vulnerability in mlflow/mlflow
• CVE-2024-14871 PoCPhotos and Files Contest Gallery < 21.3.1 - Author+ Stored Cross Site Scripting
• CVE-2024-14931 PoCUncontrolled Resource Consumption in GitLab
• CVE-2024-14951 PoCUncontrolled Resource Consumption in GitLab
• CVE-2024-15122 PoCsMasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.5 - Unauthenticated SQL Injection
• CVE-2024-15261 PoCHubbub Lite < 1.33.1 - Unauthenticated Password Protected Posts Access
• CVE-2024-15301 PoCECshop view_sendlist.php sql injection
• CVE-2024-15391 PoCMissing Authorization in GitLab
• CVE-2024-15511 PoCSet-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an attacker could control the Content-Type…
• CVE-2024-15541 PoCThe `fetch()` API and navigation incorrectly shared the same cache, as the cache key did not include the optional headers `fetch()` may…
• CVE-2024-15613 PoCsArbitrary Local File Read via Component Method Invocation in gradio-app/gradio
• CVE-2024-15641 PoCSchema Pro < 2.7.16 - Contributor+ Custom Field Access
• CVE-2024-15881 PoCSendPress Newsletters <= 1.23.11.6 - Admin+ Stored XSS via Settings
• CVE-2024-15891 PoCSendPress Newsletters <= 1.23.11.6 - Admin+ Stored XSS via Form Settings
• CVE-2024-16381 PoCBluetooth characteristic LESC security requirement not enforced without additional flags
• CVE-2024-16513 PoCsTorrentpier 2.4.1 - RCE
• CVE-2024-16551 PoCASUS WiFi Router - OS Command Injection
• CVE-2024-16581 PoCGrid Shortcodes < 1.1.1 - Contributor+ Stored XSS
• CVE-2024-16601 PoCTop Bar < 3.0.5 - Admin+ Stored XSS
• CVE-2024-16611 PoCTotolink X6000R shadow hard-coded credentials
• CVE-2024-16631 PoCUltimate Noindex Nofollow Tool II < 1.3.6 - Admin+ Stored XSS
• CVE-2024-16641 PoCResponsive Gallery Grid < 2.3.11 - Admin+ Stored XSS
• CVE-2024-16691 PoCOut of bounds memory access in Blink in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to perform out of bounds memory…
• CVE-2024-16701 PoCUse after free in Mojo in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to potentially exploit heap corruption via a…
• CVE-2024-16721 PoCInappropriate implementation in Content Security Policy in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass…
• CVE-2024-16751 PoCInsufficient policy enforcement in Download in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass filesystem…
• CVE-2024-16761 PoCInappropriate implementation in Navigation in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to spoof security UI via a…
• CVE-2024-16941 PoCInappropriate implementation in Google Updator prior to 1.3.36.351 in Google Chrome allowed a local attacker to bypass discretionary…
• CVE-2024-16986 PoCsNotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor <= 2.8.2 - Unauthenticated SQL…
• CVE-2024-17001 PoCkeerti1924 PHP-MYSQL-User-Login-System signup.php cross site scripting
• CVE-2024-17011 PoCkeerti1924 PHP-MYSQL-User-Login-System edit.php access control
• CVE-2024-17021 PoCkeerti1924 PHP-MYSQL-User-Login-System edit.php sql injection
• CVE-2024-17031 PoCZhongBangKeJi CRMEB openfile absolute path traversal
• CVE-2024-17041 PoCZhongBangKeJi CRMEB crud delete path traversal
• CVE-2024-17061 PoCZKTeco ZKBio Access IVS Department Name Search Bar cross site scripting
• CVE-2024-17072 PoCsGARO WALLBOX GLB+ T2EV7 Software Update index.jsp#settings cross site scripting
• CVE-2024-17087 PoCsKEVImproper limitation of a pathname to a restricted directory (“path traversal”)
• CVE-2024-170911 PoCsKEVAuthentication bypass using an alternate path or channel
• CVE-2024-17121 PoCCarousel Slider < 2.2.7 - Editor+ Stored XSS
• CVE-2024-17131 PoCPlv8 Deferred Trigger Privilege Escalation
• CVE-2024-17241 PoCsnapd allows $HOME/bin symlink
• CVE-2024-17281 PoCLocal File Inclusion in gradio-app/gradio
• CVE-2024-17361 PoCUncontrolled Resource Consumption in GitLab
• CVE-2024-17431 PoCWooCommerce Customers Manager < 29.8 - Reflected XSS
• CVE-2024-17451 PoCTestimonial Slider < 2.3.7 - Author+ Settings Update
• CVE-2024-17461 PoCTestimonial Slider < 2.3.8 - Admin+ Stored XSS
• CVE-2024-17471 PoCWooCommerce Customers Manager < 30.2 - Subscriber+ Stored XSS
• CVE-2024-17481 PoCvan_der_Schaar LAB AutoPrognosis Release Note load_model_from_file deserialization
• CVE-2024-17491 PoCBdtask Bhojon Best Restaurant Management Software Message Page message cross site scripting
• CVE-2024-17511 PoCTutor LMS – eLearning and online course solution <= 2.6.1 - Authenticated (Subscriber+) SQL Injection
• CVE-2024-17521 PoCFont Farsi <= 1.6.6 - Admin+ Stored XSS in Settings
• CVE-2024-17531 PoCBuildah: buildah: container escape via improper bind mount validation
• CVE-2024-17541 PoCNPS computy <= 2.7.5 - Admin+ Stored XSS
• CVE-2024-17551 PoCNPS computy <= 2.7.5 - Results Deletion via CSRF
• CVE-2024-17561 PoCWooCommerce Customers Manager < 29.8 - Subscriber+ Email Disclosure
• CVE-2024-17812 PoCsTotolink X6000R AX3000 shttpd cstecgi.cgi setWizardCfg command injection
• CVE-2024-17841 PoCLimbas main_admin.php sql injection
• CVE-2024-17861 PoCD-Link DIR-600M C1 Telnet Service buffer overflow
• CVE-2024-18002 PoCsProgress Telerik Report Server Deserialization
• CVE-2024-18131 PoCSimple Job Board <= 2.11.0 - Unauthenticated PHP Object Injection via Job Application Fields
• CVE-2024-18161 PoCUncontrolled Resource Consumption in GitLab
• CVE-2024-18181 PoCCodeAstro Membership Management System Logo unrestricted upload
• CVE-2024-18191 PoCCodeAstro Membership Management System Add Members Tab unrestricted upload
• CVE-2024-18201 PoCcode-projects Crime Reporting System inchargelogin.php sql injection
• CVE-2024-18211 PoCcode-projects Crime Reporting System police_add.php sql injection
• CVE-2024-18221 PoCPHPGurukul Tourism Management System user-bookings.php cross site scripting
• CVE-2024-18231 PoCCodeAstro Simple Voting System Backend users.php access control
• CVE-2024-18241 PoCCodeAstro House Rental Management System signing.php sql injection
• CVE-2024-18251 PoCCodeAstro House Rental Management System User Registration Page cross site scripting
• CVE-2024-18261 PoCcode-projects Library System login.php sql injection
• CVE-2024-18271 PoCcode-projects Library System login.php sql injection
• CVE-2024-18281 PoCcode-projects Library System registration.php sql injection
• CVE-2024-18291 PoCcode-projects Library System registration.php sql injection
• CVE-2024-18301 PoCcode-projects Library System lost-password.php sql injection
• CVE-2024-18311 PoCSourceCodester Complete File Management System Login Form index.php sql injection
• CVE-2024-18321 PoCSourceCodester Complete File Management System Admin Login Form sql injection
• CVE-2024-18331 PoCSourceCodester Employee Management System login.php sql injection
• CVE-2024-18341 PoCSourceCodester Simple Student Attendance System ?page=attendance&class_id=1 cross site scripting
• CVE-2024-18451 PoCVikRentCar Car Rental Management System < 1.3.2 - Cross Site Request Forgery
• CVE-2024-18461 PoCResponsive Tabs < 4.0.7 - Contributor+ Stored XSS
• CVE-2024-18491 PoCWP Customer Reviews < 3.7.1 - Malicious Redirect via HTTP-EQUIV Injection
• CVE-2024-18711 PoCSourceCodester Employee Management System Project Assignment Report assignp.php cross site scripting
• CVE-2024-18744 PoCsCommand injection via array-ish $command parameter of proc_open()
• CVE-2024-18751 PoCSourceCodester Complaint Management System Lodge Complaint Section register-complaint.php unrestricted upload
• CVE-2024-18761 PoCSourceCodester Employee Management System psubmit.php sql injection
• CVE-2024-18771 PoCSourceCodester Employee Management System cancel.php sql injection
• CVE-2024-18781 PoCSourceCodester Employee Management System myprofile.php sql injection
• CVE-2024-18921 PoCReDoS Vulnerability in scrapy/scrapy's XMLFeedSpider
• CVE-2024-18991 PoCShowdownjs Denial of Service
• CVE-2024-19051 PoCSmart Forms < 2.6.96 - Admin+ Stored XSS
• CVE-2024-19181 PoCByzoro Smart S42 Management Platform userattestation.php unrestricted upload
• CVE-2024-19191 PoCSourceCodester Online Job Portal Manage Walkin Page ManageWalkin.php cross site scripting
• CVE-2024-19221 PoCSourceCodester Online Job Portal Manage Job Page ManageJob.php cross site scripting
• CVE-2024-19231 PoCSourceCodester Simple Student Attendance System List of Classes Page ajax-api.php delete_student sql injection
• CVE-2024-19241 PoCCodeAstro Membership Management System get_membership_amount.php sql injection
• CVE-2024-19251 PoCCtcms Upsys.php unrestricted upload
• CVE-2024-19261 PoCSourceCodester Free and Open Source Inventory Management System search_sales_report.php sql injection
• CVE-2024-19271 PoCSourceCodester Web-Based Student Clearance System login.php sql injection
• CVE-2024-19281 PoCSourceCodester Web-Based Student Clearance System Edit User Profile Page edit-admin.php sql injection
• CVE-2024-19291 PoCLocal Root Exploit via Configuration Dictionary
• CVE-2024-19301 PoCNo Limit on Number of Open Sessions / Bad Session Close Behaviour
• CVE-2024-19321 PoCUnrestricted Upload of File with Dangerous Type in freescout-helpdesk/freescout
• CVE-2024-19381 PoCType Confusion in V8 in Google Chrome prior to 122.0.6261.94 allowed a remote attacker to potentially exploit object corruption via a…
• CVE-2024-19392 PoCsType Confusion in V8 in Google Chrome prior to 122.0.6261.94 allowed a remote attacker to potentially exploit heap corruption via a…
• CVE-2024-19471 PoCImproper Handling of Highly Compressed Data (Data Amplification) in GitLab
• CVE-2024-19561 PoCWPB Show Core < 2.7 - Reflected XSS
• CVE-2024-19581 PoCWPB Show Core < 2.7 - Reflected XSS
• CVE-2024-19621 PoCCM Download and File Manager < 2.9.1 - Download Edit via CSRF
• CVE-2024-19631 PoCUncontrolled Resource Consumption in GitLab
• CVE-2024-19701 PoCSourceCodester Online Learning System V2 index.php cross site scripting
• CVE-2024-19711 PoCSurya2Developer Online Shopping System POST Parameter login.php sql injection
• CVE-2024-19721 PoCSourceCodester Online Job Portal EditProfile.php cross site scripting
• CVE-2024-19811 PoCThe Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to SQL Injection via the 'table_prefix' parameter in version…
• CVE-2024-19821 PoCWPvivid Backup and Migration <= 0.9.68 - Missing Authorization
• CVE-2024-19831 PoCSimple Ajax Chat < 20240223 - Unauthenticated Stored XSS