Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Settings
Sign in
🔥 Daily Hot!
💪🏽 CPE Enhanced Advisories
🕶 Shadow Exploits
🕵🏼 Vulners CPE
🔐 Security news
💻 Exploit updates
📑 Blogs review
🐧 Linux vulnerabilities
🐞 Bugbounty
🤖 AI High Score
📰 CVE Feed
show all

3012 matches found

RedhatCVE
RedhatCVE•added 2025/02/21 8:35 a.m.•17 views

CVE-2024-13719

The PeproDev Ultimate Invoice plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.9 via the invoicing viewer due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view invoices for...

5.3CVSS7.2AI score0.00468EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE•added 2025/02/21 8:35 a.m.•19 views

CVE-2024-13854

The Education Addon for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.1 via the naeduelementortemplate shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, wit...

4.3CVSS6.5AI score0.0034EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies•added 2025/02/21 12:00 a.m.•10 views

PT-2025-7554 · Ragflow · Ragflow

Name of the Vulnerable Software and Affected Versions: RAGFlow versions /user/list" and "POST //user". Recommendations: For RAGFlow versions /user/list" and "POST //user", to minimize the risk of exploitation...

8.1CVSS8.1AI score0.00468EPSS
SaveExploits1References9
NVD
NVD•added 2025/02/20 10:15 a.m.•13 views

CVE-2024-13855

The Prime Addons for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.1 via the paeglobalblock shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

4.3CVSS0.00322EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment•added 2025/02/20 9:21 a.m.•6 views

CVE-2024-13855 Prime Addons for Elementor <= 2.0.1 - Authenticated (Contributor+) Insecure Direct Object Reference via pae_global_block Shortcode

The Prime Addons for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.1 via the paeglobalblock shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

4.3CVSS4.4AI score0.00322EPSS
SaveExploits0References2
CVE
CVE•added 2025/02/20 9:21 a.m.•61 views

CVE-2024-13855

CVE-2024-13855 affects Prime Addons for Elementor (WordPress) via Insecure Direct Object Reference in pae_global_block. From Wordfence data: all versions up to 2.0.1 are vulnerable; exploitation requires authenticated access at Contributor level or higher to extract information from non-public po...

4.3CVSS4.4AI score0.00322EPSS
SaveExploits0References3Affected Software1
Cvelist
Cvelist•added 2025/02/20 9:21 a.m.•25 views

CVE-2024-13855 Prime Addons for Elementor <= 2.0.1 - Authenticated (Contributor+) Insecure Direct Object Reference via pae_global_block Shortcode

The Prime Addons for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.1 via the paeglobalblock shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

4.3CVSS0.00322EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE•added 2025/02/20 2:32 a.m.•18 views

CVE-2024-13740

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.9.4.2 via the pmmessengershowmessages function due to missing validation on a user controlled key. This makes it possible for...

4.3CVSS6.4AI score0.00279EPSS
SaveExploits0References1
Patchstack
Patchstack•added 2025/02/19 11:07 p.m.•6 views

WordPress Prime Addons for Elementor plugin <= 2.0.1 - Authenticated (Contributor+) Insecure Direct Object Reference via pae_global_block Shortcode vulnerability

Authenticated Contributor+ Insecure Direct Object Reference via paeglobalblock Shortcode vulnerability discovered by Francesco Carlucci in WordPress Plugin Prime Addons for Elementor versions = 2.0.1...

4.3CVSS7AI score0.00322EPSS
SaveExploits0References1Affected Software1
NVD
NVD•added 2025/02/19 8:15 a.m.•28 views

CVE-2024-13854

The Education Addon for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.1 via the naeduelementortemplate shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, wit...

4.3CVSS0.0034EPSS
SaveExploits0References2
NVD
NVD•added 2025/02/19 8:15 a.m.•30 views

CVE-2024-13719

The PeproDev Ultimate Invoice plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.9 via the invoicing viewer due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view invoices for...

5.3CVSS0.00468EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment•added 2025/02/19 7:32 a.m.•9 views

CVE-2024-13854 Education Addon for Elementor <= 1.3.1 - Authenticated (Contributor+) Insecure Direct Object Reference via naedu_elementor_template Shortcode

The Education Addon for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.1 via the naeduelementortemplate shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, wit...

4.3CVSS4.4AI score0.0034EPSS
SaveExploits0References2
CVE
CVE•added 2025/02/19 7:32 a.m.•51 views

CVE-2024-13854

CVE-2024-13854 affects Education Addon for Elementor (WordPress) up to version 1.3.1 and is caused by insecure direct object reference via the naedu_elementor_template shortcode due to missing validation on a user-controlled key. This allows authenticated attackers with Contributor+ privileges to...

4.3CVSS4.4AI score0.0034EPSS
SaveExploits0References2Affected Software1
Cvelist
Cvelist•added 2025/02/19 7:32 a.m.•31 views

CVE-2024-13854 Education Addon for Elementor <= 1.3.1 - Authenticated (Contributor+) Insecure Direct Object Reference via naedu_elementor_template Shortcode

The Education Addon for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.1 via the naeduelementortemplate shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, wit...

4.3CVSS0.0034EPSS
SaveExploits0References2
Cvelist
Cvelist•added 2025/02/19 7:32 a.m.•40 views

CVE-2024-13719 PeproDev Ultimate Invoice <= 2.0.9 - Insecure Direct Object Reference to Unauthenticated Order Information Exposure

The PeproDev Ultimate Invoice plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.9 via the invoicing viewer due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view invoices for...

5.3CVSS0.00468EPSS
SaveExploits0References3
CVE
CVE•added 2025/02/19 7:32 a.m.•46 views

CVE-2024-13719

CVE-2024-13719 relates to the PeproDev Ultimate Invoice plugin for WordPress. The vulnerability is an insecure direct object reference in the invoicing viewer that arises from missing validation of a user controlled key, allowing unauthenticated attackers to view invoices for completed orders and...

5.3CVSS7.3AI score0.00468EPSS
SaveExploits0References3Affected Software1
Vulnrichment
Vulnrichment•added 2025/02/19 7:32 a.m.•6 views

CVE-2024-13719 PeproDev Ultimate Invoice <= 2.0.9 - Insecure Direct Object Reference to Unauthenticated Order Information Exposure

The PeproDev Ultimate Invoice plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.9 via the invoicing viewer due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view invoices for...

5.3CVSS7.2AI score0.00468EPSS
SaveExploits0References3
Patchstack
Patchstack•added 2025/02/18 11:24 p.m.•11 views

WordPress Education Addon for Elementor plugin <= 1.3.1 - Authenticated (Contributor+) Insecure Direct Object Reference via naedu_elementor_template Shortcode vulnerability

Authenticated Contributor+ Insecure Direct Object Reference via naeduelementortemplate Shortcode vulnerability discovered by Francesco Carlucci in WordPress Plugin Education Addon for Elementor versions = 1.3.1...

4.3CVSS7AI score0.0034EPSS
SaveExploits0References1Affected Software1
OSV
OSV•added 2025/02/18 3:15 a.m.•8 views

CVE-2024-13740

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.9.4.2 via the pmmessengershowmessages function due to missing validation on a user controlled key. This makes it possible for...

4.3CVSS7.3AI score0.00279EPSS
SaveExploits0References2
NVD
NVD•added 2025/02/18 3:15 a.m.•18 views

CVE-2024-13740

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.9.4.2 via the pmmessengershowmessages function due to missing validation on a user controlled key. This makes it possible for...

4.3CVSS0.00279EPSS
SaveExploits0References2
Rows per page
Query Builder