CVE-2024-10098

LowCVSS 2.7/10Last modified Jun 17, 2026

Description

The ApplyOnline WordPress plugin before 2.6.3 does not protect uploaded files during the application process, allowing unauthenticated users to access them and any private information they contain

Metrics

CVSS 3.1 2.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Affected software

Vendor	Product	Versions
Unknown	ApplyOnline	< 2.6.3

References

https://wpscan.com/vulnerability/242dac1f-9a1f-4fde-b8c7-374bd451071d/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/242dac1f-9a1f-4fde-b8c7-374bd451071d/Exploit, Third Party Advisory

Timeline

Published: May 15, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-100996.1A stored cross-site scripting (XSS) vulnerability exists in comfyanonymous/comfyui version 0.2.2 and possibly earlier. The vulnerability occ CVE-2024-10105.4A vulnerability classified as problematic has been found in SourceCodester Employee Management System 1.0. This affects an unknown part of t CVE-2024-101007.5A path traversal vulnerability exists in binary-husky/gpt_academic version 3.83. The vulnerability is due to improper handling of the file p CVE-2024-101015.4A stored cross-site scripting (XSS) vulnerability exists in binary-husky/gpt_academic version 3.83. The vulnerability occurs at the /file en CVE-2024-101022.7The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its Gallery setti CVE-2024-101036.1In the process of testing the MailPoet WordPress plugin before 5.3.2, a vulnerability was found that allows you to implement Stored XSS on CVE-2024-101045.9The Jobs for WordPress plugin before 2.7.8 does not sanitise and escape some of its Job settings, which could allow high privilege users suc CVE-2024-101055.9The Job Postings WordPress plugin before 2.7.11 does not sanitise and escape some of its settings, which could allow high privilege users su CVE-2024-101063.7A buffer overflow vulnerability in the packet handoff plugin allows an attacker to overwrite memory outside the plugin's buffer.CVE-2024-101074.8The Giveaways and Contests by RafflePress WordPress plugin before 1.12.17 does not sanitise and escape some of its settings, which could al CVE-2024-101087.2The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's adverts_add shortcode CVE-2024-101098.3A vulnerability in the mintplex-labs/anything-llm repository, as of commit 5c40419, allows low privilege users to access the sensitive API e