Theinnovs maintains a focused portfolio of web-based enterprise applications, including ELEForms and its HR platform, that handle business-critical data and user authentication. Vulnerabilities affecting the vendor skew toward serious outcomes, with an elevated tendency toward critical-severity findings concentrated in authorization, CSRF, and cross-site scripting weakness classes that are characteristic of web application input handling and access control. Current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Theinnovs over time
Signals from CVEs in this vendor scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-38748CRITICAL Access Control vulnerability in TheInnovs EleForms allows .
This issue affects EleForms: from n/a through 2.9.9.9. | Nov 1, 2024 | 9.8 | 29 | NO | NO |
CVE-2024-0858HIGH The Innovs HR WordPress plugin through 1.0.3.4 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attac | Mar 18, 2024 | 8.8 | 24 | NO | NO |
CVE-2024-2082MEDIUM The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to | May 2, 2024 | 6.1 | 20 | NO | NO |
CVE-2023-49171MEDIUM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TheInnovs Innovs HR – Complete Human Resource Management System for Your Busin | Dec 14, 2023 | 6.1 | 18 | NO | NO |
CVE-2024-6626MEDIUM The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on several | Nov 6, 2024 | 5.3 | 17 | NO | NO |
CVE-2024-2043MEDIUM The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when downl | May 2, 2024 | 5.3 | 17 | NO | NO |
CVE-2024-6628MEDIUM The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.9.9.9 | Nov 16, 2024 | 4.3 | 15 | NO | NO |
Signals from CVEs in this vendor scope (7 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Theinnovs.
Media articles that mention a CVE ID that affects a product developed by Theinnovs — matched by CVE ID, not by vendor name.