CVE-2024-5792

The Houzez CRM plugin for WordPress is vulnerable to time-based SQL Injection via the notes ‘belongto’ parameter in all versions up to, and including, 1.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

OSV-2024-1427 Heap-buffer-overflow in extract_mediaip

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=391975654 Crash type: Heap-buffer-overflow READ 1 Crash state: extractmediaip parsesdpsession parsemixedcontent...

PT-2025-5652 · Git +1 · Kamailio

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ 1 crash has been reported. The crash involves the functions extract mediaip, parse sdp session, and parse mixed content. No...

OSV-2024-1424 Heap-buffer-overflow in extract_candidate

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=391689728 Crash type: Heap-buffer-overflow READ 8 Crash state: extractcandidate parsesdpsession parsemixedcontent...

PT-2025-5651 · Git +1 · Kamailio

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ 8 crash has been reported. The crash occurs in the following functions: extract candidate, parse sdp session, and parse mixed...

CVE-2024-13230: Improper Neutralization of Special Elements used in an SQL Command

The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to Limited SQL Injection via the ‘SuperSocializerKey’ parameter in all versions up to, and including, 7.14 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2024-12032: Improper Neutralization of Special Elements used in an SQL Command

The Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking plugin for WordPress is vulnerable to SQL Injection via the 'enquiryid' parameter of the 'tfenquiryreplyemailcallback' function in all versions up to, and including, 2.15.3 due to...

CVE-2024-11722: Improper Neutralization of Special Elements used in an SQL Command

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.25.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

WordPress plugin استخراج محصولات ووکامرس برای آیسی 跨站脚本漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation.WordPress is a suite of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...

CVE-2024-11291: Exposure of Sensitive Information to an Unauthorized Actor

The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.13.4 via the WordPress core search feature. This makes it possible for unauthenticated...

The vulnerability of the UPDATES_ExtractFile function in the Visteon Infotainment automotive application platform allows a hacker to execute arbitrary code.

The vulnerability of the UPDATESExtractFile function in Visteon Infotainment’s automotive application platform exists due to the lack of measures to neutralize specific elements. Exploiting this vulnerability allows an attacker to execute arbitrary code in the basic operating system...

SUSE CVE-2024-47546

GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in extractccfromdata function within qtdemux.c. In the FOURCCc708 case, the subtraction atomlength - 8 may result in an underflow if atomlength is less than 8. When that subtraction...

CVE-2024-55587: Improper Limitation of a Pathname to a Restricted Directory

python-libarchive through 4.2.1 allows directory traversal to create files in extract in zip.py for ZipFile.extractall and ZipFile.extract...

CVE-2024-55587

python-libarchive through 4.2.1 allows directory traversal to create files in extract in zip.py for ZipFile.extractall and ZipFile.extract...

EUVD-2024-3441

python-libarchive through 4.2.1 allows directory traversal to create files in extract in zip.py for ZipFile.extractall and ZipFile.extract...

CVE-2024-55587

python-libarchive through 4.2.1 allows directory traversal to create files in extract in zip.py for ZipFile.extractall and ZipFile.extract...

CVE-2024-12270: Improper Neutralization of Special Elements used in an SQL Command

The Beautiful taxonomy filters plugin for WordPress is vulnerable to SQL Injection via the 'selects0term' parameter in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2024-11732: Improper Neutralization of Special Elements used in an SQL Command

The BP Profile Shortcodes Extra plugin for WordPress is vulnerable to time-based SQL Injection via the ‘tab’ parameter in all versions up to, and including, 2.6.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes i...

Allegra 路径遍历漏洞

Allegra is a project management software for mid-sized organizations from Allegra. Allegra suffers from a path traversal vulnerability that stems from the extarctZippedFile feature containing a directory traversal remote code execution vulnerability...

Visteon Infotainment 操作系统命令注入漏洞

Visteon Infotainment is an automotive infotainment system from Visteon Corporation. Visteon Infotainment suffers from an operating system command injection vulnerability that stems from an improper system call to the REFLASHDDUExtractFile function when handling a specially crafted software update...