Total
395605 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-58343 | 2026-06-17 | N/A | 4.3 MEDIUM | ||
| Vision Helpdesk before 5.7.0 (patched in 5.6.10) allows attackers to read user profiles via modified serialized cookie data to vis_client_id. | |||||
| CVE-2024-58342 | 1 Xenforo | 1 Xenforo | 2026-06-17 | N/A | 6.3 MEDIUM |
| XenForo before 2.2.17 and 2.3.1 allows open redirect via a specially crafted URL. The getDynamicRedirect() function does not adequately validate the redirect target, allowing attackers to redirect users to arbitrary external sites using crafted URLs containing newlines, user credentials, or host mismatches. | |||||
| CVE-2024-58341 | 1 Opencart | 1 Opencart | 2026-06-17 | N/A | 8.2 HIGH |
| OpenCart Core 4.0.2.3 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'search' parameter. Attackers can send GET requests to the product search endpoint with malicious 'search' values to extract sensitive database information using boolean-based blind or time-based blind SQL injection techniques. | |||||
| CVE-2024-58338 | 1 Ateme | 2 Flamingo Xl, Flamingo Xl Firmware | 2026-06-17 | N/A | 10.0 CRITICAL |
| Anevia Flamingo XL 3.2.9 contains a restricted shell vulnerability that allows remote attackers to escape the sandboxed environment through the traceroute command. Attackers can exploit the traceroute command to inject shell commands and gain full root access to the device by bypassing the restricted login environment. | |||||
| CVE-2024-58337 | 1 Akuvox | 26 C313w-2, C313w-2 Firmware, E16c and 23 more | 2026-06-17 | N/A | 4.3 MEDIUM |
| Akuvox Smart Intercom S539 contains an improper access control vulnerability that allows users with 'User' privileges to modify API access settings and configurations. Attackers can exploit this vulnerability to escalate privileges and gain unauthorized access to administrative functionalities. | |||||
| CVE-2024-58336 | 1 Akuvox | 24 C313w-2, C313w-2 Firmware, Nc-2 and 21 more | 2026-06-17 | N/A | 5.3 MEDIUM |
| Akuvox Smart Intercom S539 contains an unauthenticated vulnerability that allows remote attackers to access live video streams by requesting the video.cgi endpoint on port 8080. Attackers can retrieve video stream data without authentication by directly accessing the specified endpoint on affected Akuvox doorphone and intercom devices. | |||||
| CVE-2024-58335 | 2026-06-17 | N/A | 5.0 MEDIUM | ||
| OpenXRechnungToolbox through 2024-10-05-3.0.0 before 6c50e89 allows XXE because the disallow-doctype-decl feature is not enabled in visualization/VisualizerImpl.java. | |||||
| CVE-2024-58323 | 1 Kentico | 1 Xperience | 2026-06-17 | N/A | 5.4 MEDIUM |
| A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the Checkbox form component. This allows malicious scripts to execute in users' browsers by exploiting HTML support in the form builder. | |||||
| CVE-2024-58322 | 1 Kentico | 1 Xperience | 2026-06-17 | N/A | 5.4 MEDIUM |
| A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious code into shipping options configuration. This could lead to potential theft of sensitive data by executing malicious scripts in users' browsers. | |||||
| CVE-2024-58321 | 1 Kentico | 1 Xperience | 2026-06-17 | N/A | 5.4 MEDIUM |
| A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via form validation rule configuration. Attackers can exploit this vulnerability to execute malicious scripts that will run in users' browsers. | |||||
| CVE-2024-58320 | 1 Kentico | 1 Xperience | 2026-06-17 | N/A | 5.3 MEDIUM |
| An information disclosure vulnerability in Kentico Xperience allows public users to access sensitive administration interface hostname details during authentication. Attackers can retrieve confidential hostname configuration information through a public endpoint, potentially exposing internal network details. | |||||
| CVE-2024-58319 | 1 Kentico | 1 Xperience | 2026-06-17 | N/A | 6.1 MEDIUM |
| A reflected cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the Pages dashboard widget configuration dialog. Attackers can exploit this vulnerability to execute malicious scripts in administrative users' browsers. | |||||
| CVE-2024-58318 | 1 Kentico | 1 Xperience | 2026-06-17 | N/A | 6.1 MEDIUM |
| A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the rich text editor component for page and form builders. Attackers can exploit this vulnerability by entering malicious URIs, potentially allowing malicious scripts to execute in users' browsers. | |||||
| CVE-2024-58317 | 1 Kentico | 1 Xperience | 2026-06-17 | N/A | 5.3 MEDIUM |
| A cookie security configuration vulnerability in Kentico Xperience allows attackers to bypass SSL requirements when setting administration cookies via web.config. The vulnerability affects .NET Framework projects by incorrectly handling the 'requireSSL' attribute, potentially compromising session security and authentication state. | |||||
| CVE-2024-58316 | 1 Puneethreddyhc | 1 Online Shopping System Advanced | 2026-06-17 | N/A | 7.5 HIGH |
| Online Shopping System Advanced 1.0 contains a SQL injection vulnerability in the payment_success.php script that allows attackers to inject malicious SQL through the unfiltered 'cm' parameter. Attackers can exploit the vulnerability by sending crafted SQL queries to retrieve sensitive database information by manipulating the user ID parameter. | |||||
| CVE-2024-58314 | 2026-06-17 | N/A | 8.8 HIGH | ||
| Atcom 100M IP Phones firmware version 2.7.x.x contains an authenticated command injection vulnerability in the web configuration CGI script that allows attackers to execute arbitrary system commands. Attackers can inject shell commands through the 'cmd' parameter in web_cgi_main.cgi, enabling remote code execution with administrative credentials. | |||||
| CVE-2024-58313 | 1 Xbtitfm | 1 Xbtitfm | 2026-06-17 | N/A | 7.2 HIGH |
| xbtitFM 4.1.18 contains an insecure file upload vulnerability that allows authenticated attackers with administrative privileges to upload and execute arbitrary PHP code through the file_hosting feature. Attackers can bypass file type restrictions by modifying the Content-Type header to image/gif, adding GIF89a magic bytes, and using alternate PHP tags to upload web shells that execute system commands. | |||||
| CVE-2024-58312 | 1 Xbtitfm | 1 Xbtitfm | 2026-06-17 | N/A | 7.5 HIGH |
| xbtitFM 4.1.18 contains a path traversal vulnerability that allows unauthenticated attackers to access sensitive system files by manipulating URL parameters. Attackers can exploit directory traversal techniques to read critical system files like using encoded path traversal characters in HTTP requests. | |||||
| CVE-2024-58311 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| Dormakaba Saflok System 6000 contains a predictable key generation algorithm that allows attackers to derive card access keys from a 32-bit unique identifier. Attackers can exploit the deterministic key generation process by calculating valid access keys using a simple mathematical transformation of the card's unique identifier. | |||||
| CVE-2024-58310 | 2026-06-17 | N/A | N/A | ||
| APC Network Management Card 4 contains a path traversal vulnerability that allows unauthenticated attackers to access sensitive system files by manipulating URL parameters. Attackers can exploit directory traversal techniques to read critical system files like /etc/passwd by using encoded path traversal characters in HTTP requests. | |||||