Vulnerabilities > High

DATE CVE VULNERABILITY TITLE RISK
2024-11-20 CVE-2024-10913 The Clone plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.4.6 via deserialization of untrusted input in the 'recursive_unserialized_replace' function.
network
low complexity
CWE-502
8.8
8.8
2024-11-20 CVE-2024-11494 **UNSUPPORTED WHEN ASSIGNED** The improper authentication vulnerability in the Zyxel P-6101C ADSL modem firmware version P-6101CSA6AP_20140331 could allow an unauthenticated attacker to read some device information via a crafted HTTP HEAD method.
network
low complexity
CWE-287
7.5
7.5
2024-11-20 CVE-2024-10855 The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to insufficient validation on the filename parameter of the sirv_upload_file_by_chunks() function and lack of in all versions up to, and including, 7.3.0.
network
low complexity
CWE-639
8.1
8.1
2024-11-20 CVE-2024-10899 The The WooCommerce Product Table Lite plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.8.6.
network
low complexity
CWE-94
7.3
7.3
2024-11-19 CVE-2024-52360 IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 is vulnerable to SQL injection.
network
low complexity
 7.6
7.6
2024-11-19 CVE-2024-11194 The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a misconfigured check on the 'rtcl_import_settings' function in all versions up to, and including, 3.1.15.1.
network
low complexity
 8.8
8.8
2024-11-19 CVE-2024-11036 The The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via gamipress_get_user_earnings AJAX action in all versions up to, and including, 7.1.5.
network
low complexity
CWE-94
7.3
7.3
2024-11-19 CVE-2024-11038 The The WPB Popup for Contact Form 7 – Showing The Contact Form 7 Popup on Button Click – CF7 Popup plugin for WordPress is vulnerable to arbitrary shortcode execution via wpb_pcf_fire_contact_form AJAX action in all versions up to, and including, 1.7.5.
network
low complexity
CWE-94
7.3
7.3
2024-11-19 CVE-2024-10388 The WordPress GDPR plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr_firstname' and 'gdpr_lastname' parameters in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping.
network
low complexity
CWE-79
7.2
7.2
2024-11-18 CVE-2024-21287 Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension).
network
low complexity
 7.5
7.5