Web Application Detections—August 2024

In August, Qualys released QIDs targeting vulnerabilities in several widely-used software products, including JetBrains TeamCity, WordPress, LiteLLM, phpMyBackupPro, Apache OFBiz, Apache Superset, Automation Anywhere Automation 360, Microsoft IIS, Zabbix, nuxt/icon, Laravel, Jenkins, Nginx, SolarWinds Web Help Desk and OpenSSL.

The following table lists the new QIDs. 

QID Title
150929 WordPress Form Vibes Plugin: SQL Injection Vulnerability (CVE-2024-5325)
150951 WordPress ERP Plugin: SQL Injection Vulnerability (CVE-2024-6666)
152002 WordPress Popup Builder Plugin: Unauthorized Modification and Loss of Data Vulnerability (CVE-2024-2544)
152028 WordPress UsersWP Plugin: Unauthenticated SQL Injection Vulnerability (CVE-2024-6265)
152031 WordPress InstaWP Connect Plugin: Authentication Bypass Vulnerability (CVE-2024-6397)
152032 WordPress Quiz Maker Plugin: Time-Based SQL Injection Vulnerability (CVE-2024-6028)
152039 WordPress Profile-Builder Plugin: Privilege Escalation Vulnerability (CVE-2024-6695)
152053 WordPress IQ Testimonials Plugin: Unauthenticated Arbitrary File Upload Vulnerability (CVE-2024-6314)
152054 WordPress SEOPress Plugin: Unauthenticated Object Injection Vulnerability (CVE-2024-5488)
152058 WordPress Brizy Page Builder Plugin: Arbitrary File Uploads Vulnerability(CVE-2024-3242)
152059 WordPress Nested Pages Plugin: Cross-Site Request Forgery(CVE-2024-5943)
152063 WordPress ContentLock Plugin: Cross-Site Request Forgery Vulnerability (CVE-2024-6024)
152065 WordPress Flipbox Builder Plugin: PHP Object Injection Vulnerability(CVE-2024-6152)
152066 WordPress Media. net Ads Manager Plugin: Arbitrary File Upload Vulnerability(CVE-2024-6431)
152067 WordPress IMGspider Plugin: Arbitrary File Upload Vulnerability (CVE-2024-6319)
152068 WordPress Unlimited Elements For Elementor Plugin: Time-based SQL Injection Vulnerability (CVE-2024-6166)
152069 WordPress Squirrly SEO Plugin: Stored Cross-Site Scripting Vulnerability (CVE-2024-6497)
152070 litellm Server-Side Request Forgery Vulnerability (CVE-2024-38514)
152071 phpMyBackupPro v2.3 Multiple Cross-Site Scripting Vulnerabilities
152072 Apache OFBiz Incorrect Authorization Vulnerability (CVE-2024-38856)
152073 Apache Superset Arbitrary File Read Vulnerability (CVE-2024-34693)
152074 Automation Anywhere Automation 360 Server-Side Request Forgery (SSRF) Vulnerability (CVE-2024-6922)
152075 WordPress Advanced File Manager Plugin: Sensitive Information Exposure Vulnerability (CVE-2024-5598)
152076 WordPress Cookie Consent Plugin: Stored Cross-Site Scripting Vulnerability (CVE-2024-4869)
152077 WordPress Tournamatch Plugin: Stored Cross-Site Scripting Vulnerability (CVE-2024-5644)
152078 WordPress WooCommerce Social Login Plugin: Unauthorized Modification of Data Vulnerability (CVE-2024-6636)
152079 WordPress Laposta Plugin: Unauthenticated Full Path Disclosure Vulnerability (CVE-2024-6574)
152080 WordPress WooCommerce Social Login Plugin: Authentication Bypass Vulnerability (CVE-2024-6635)
152081 WordPress WooCommerce Social Login Plugin: Unauthenticated Privilege Escalation Vulnerability (CVE-2024-6637)
152082 Apache Superset SQL Injection Vulnerability (CVE-2024-39887)
152083 WordPress Gutenberg Forms Plugin: Arbitrary File Upload Vulnerability (CVE-2024-6313)
152084 WordPress aThemes Starter Sites Plugin: Stored Cross-Site Scripting Vulnerability (CVE-2024-6897)
152085 WordPress Happy Addons for Elementor Plugin: Stored Cross-Site Scripting Vulnerability (CVE-2024-6627)
152086 WordPress WooCommerce Product Table Lite Plugin: Unauthorized Post Title Modification Vulnerability (CVE-2024-6458)
152087 WordPress WPBakery Visual Composer Plugin: Local File Inclusion Vulnerability (CVE-2024-5709)
152089 WordPress Master Currency Plugin: Stored Cross-Site Scripting Vulnerability (CVE-2024-6634)
152090 WordPress CRM Perks Forms Plugin: Arbitrary File Upload Vulnerability (CVE-2024-7484)
152091 WordPress Ebook Store Plugin: Full Path Disclosure Vulnerability (CVE-2024-6567)
152092 WordPress Sync Post With Other Site Plugin: Unauthorized Modification of Data Vulnerability (CVE-2024-6709)
152093 WordPress Email Subscribers Plugin: SQL Injection Vulnerability (CVE-2024-5756)
152094 WordPress wpDiscuz Plugin: HTML Injection Vulnerability (CVE-2024-6704)
152095 WordPress Forminator Plugin: Sensitive Information Exposure Vulnerability (CVE-2024-7389)
152096 WordPress UsersWP Plugin: Sensitive Information Exposure Vulnerability (CVE-2024-6477)
152097 WordPress JetFormBuilder Plugin: Privilege Escalation Vulnerability (CVE-2024-7291)
152098 Microsoft IIS Tilde Character Information Disclosure Vulnerability
152099 WordPress Filester Plugin: Unauthorized Modification of Data Vulnerability (CVE-2024-7031)
152101 WordPress Business Directory Plugin: CSV Injection Vulnerability (CVE-2023-5527)
152106 WordPress Chatbot by Collect.chat Plugin: Cross-Site Scripting Vulnerability (CVE-2024-6498)
152107 WordPress Traffic Manager Plugin: Stored Cross-Site Scripting Vulnerability (CVE-2024-7485)
152108 WordPress YayExtra Plugin: Arbitrary File Upload Vulnerability (CVE-2024-7257)
152109 WordPress Slider By 10Web Plugin: Time-based SQL Injection Vulnerability (CVE-2024-7150)
152110 WordPress WooCommerce Social Login Plugin: Authentication Bypass Vulnerability (CVE-2024-7503)
152111 WordPress LearnPress Plugin: Time-based SQL Injection Vulnerability (CVE-2024-7548)
152112 WordPress JS Help Desk Plugin: PHP Code Injection Vulnerability (CVE-2024-7094)
152113 WordPress Christmasify! Plugin: Cross-Site Request Forgery Vulnerability (CVE-2024-7574)
152114 WordPress InPost for WooCommerce Plugin: Unauthorized Access Vulnerability (CVE-2024-6500)
152115 WordPress PDF Builder for WPForms Plugin: Full Path Disclosure Vulnerability (CVE-2024-7414)
152116 Zabbix Improper Authorization Vulnerability (CVE-2024-22114)
152117 Zabbix Remote Code Execution Vulnerability (CVE-2024-22116)
152118 Zabbix Improper Authorization Vulnerability (CVE-2024-22121)
152119 Zabbix Untrusted Pointer Dereference Vulnerability (CVE-2024-36461)
152120 WordPress LiteSpeed Cache Plugin: Incorrect Privilege Assignment Vulnerability (CVE-2024-28000)
152121 nuxt/icon Server-Side Request Forgery Vulnerability (CVE-2024-42352)
152122 Laravel Environment Configuration File Detected
152123 WordPress Horizontal Scrolling Announcements Plugin: SQL Injection Vulnerability (CVE-2023-5000)
152124 Jenkins Arbitrary File Read Vulnerability (CVE-2024-43044)
152125 Jenkins Improper Authorization Vulnerability (CVE-2024-43045)
152126 WordPress Reveal Template Plugin: Full Path Disclosure Vulnerability (CVE-2024-7416)
152127 WordPress affiliate-toolkit Plugin: Full Path Disclosure Vulnerability (CVE-2024-6562)
152128 WordPress Zephyr Project Manager Plugin: Stored Cross-Site Scripting Vulnerability (CVE-2024-7356)
152131 JetBrains TeamCity Cross-Site Scripting (XSS) Vulnerabilities (CVE-2024-43807,CVE-2024-43808,CVE-2024-43809,CVE-2024-43810)
152132 JetBrains TeamCity Cross-Site Scripting (XSS) Vulnerabilities (CVE-2024-43807,CVE-2024-43808,CVE-2024-43809,CVE-2024-43810)
152133 WordPress Cost Calculator Builder Plugin: SQL Injection Vulnerability (CVE-2024-43144)
152135 WordPress Opti Marketing Plugin: SQL Injection Vulnerability (CVE-2024-6928)
152136 WordPress Viral Signup Plugin: SQL Injection Vulnerability (CVE-2024-6926)
152137 WordPress GeoDirectory Plugin: SQL Injection Vulnerability (CVE-2024-43145)
152138 WordPress BerqWP Plugin: Arbitrary File Upload Vulnerability (CVE-2024-43160)
152160 SolarWinds Web Help Desk Java Deserialization Remote Code Execution (RCE) Vulnerability (CVE-2024-28986)
152161 SolarWinds Web Help Desk Hardcoded Credential Vulnerability (CVE-2024-28987)
520027 Nginx HTTP/3 QUIC Multiple Vulnerabilities
520028 Open Secure Sockets Layer (OpenSSL) Buffer Overread Vulnerability (CVE-2024-5535)

Qualys Notification Link: Web Application Detections Published in August 2024