PT-2024-27516 · Unknown · Cym1102 Nginxwebui

Name of the Vulnerable Software and Affected Versions: cym1102 nginxWebUI versions up to 3.9.9 Description: A critical vulnerability was found in the cym1102 nginxWebUI, affecting unknown code of the file /adminPage/main/upload. The manipulation of the argument file leads to os command injection...

Remote Code Execution (RCE)

aim is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper user access restriction to the RunView object, allowing for the execution of arbitrary code via a crafted query parameter to the /api/runs/search/run/ endpoint...

PT-2024-13205 · Cobham · Cobham Sailor Vsat Ku

Name of the Vulnerable Software and Affected Versions: Cobham SAILOR VSAT Ku version 164B019 Description: A Cross Site Scripting XSS issue allows a remote attacker to execute arbitrary code via a crafted script to the rstat, sender, and recipients parameters of the sub 21D24 function in the acu w...

PT-2024-3155 · WordPress · Forminator

Name of the Vulnerable Software and Affected Versions: Forminator versions prior to 1.29.3 Description: The issue is related to a SQL injection vulnerability due to a lack of protection measures for the SQL query structure. This vulnerability can be exploited by a remote attacker to modify...

PT-2024-27180 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7.112-UTF8 Description: A critical issue was found in DedeCMS, affecting an unknown function of the file stepselect main.php. The manipulation of the ids argument leads to SQL injection. This issue can be exploited remotely...

PT-2024-22677 · Xibo · Xibo

Name of the Vulnerable Software and Affected Versions: Xibo versions prior to 3.3.10 Xibo versions prior to 4.0.9 Xibo version 1.8 Xibo version 2.3 Description: Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. Session tokens...

PT-2024-22929 · Unknown · Summernote

Name of the Vulnerable Software and Affected Versions: Summernote versions 0.8.18 and earlier Description: The issue allows a remote attacker to execute arbitrary code via a crafted payload to the codeview parameter. This enables the attacker to perform actions such as executing arbitrary code on...

PT-2024-18641 · Unknown · Mudler/Localai

Name of the Vulnerable Software and Affected Versions: mudler/localai versions prior to v2.10.0 Description: A command injection issue exists in the TranscriptEndpoint of mudler/localai, specifically within the audioToWav function used for converting audio files to WAV format for transcription. T...

PT-2024-5058

Name of the Vulnerable Software and Affected Versions: aimhubio/aim versions = 3.0.0 Description: A critical Remote Code Execution RCE vulnerability was identified in the aimhubio/aim project, specifically within the "/api/runs/search/run/" endpoint. The vulnerability resides in the run search ap...

PT-2024-21827 · WordPress · Bold Page Builder

Name of the Vulnerable Software and Affected Versions: The Bold Page Builder plugin for WordPress versions up to, and including, 4.8.8 Description: The issue is related to Stored Cross-Site Scripting via the plugin's "Separator" element due to insufficient input sanitization and output escaping o...

PT-2024-24256 · Apache · Apache Zeppelin

Name of the Vulnerable Software and Affected Versions: Apache Zeppelin versions 0.8.2 through 0.11.0 Description: The issue is related to improper encoding or escaping of output, allowing attackers to modify helium.json and perform cross-site scripting attacks on normal users. Recommendations: Fo...

PT-2024-20494 · Zoom · Zoom Desktop Client For Windows

Name of the Vulnerable Software and Affected Versions: Zoom Desktop Client for Windows versions prior to 5.17.10 Description: The issue is related to improper privilege management in the installer, which may allow an authenticated user to conduct an escalation of privilege via local access...

PT-2024-25883 · Sourcecodester · Sourcecodester Prison Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Prison Management System version 1.0 Description: A problematic vulnerability was found in the SourceCodester Prison Management System. This issue affects the file /Employee/apply leave.php, where the manipulation of the txtsta...

PT-2024-11657 · Abrhilsoft · Abrhilsoft Employee'S Portal

Name of the Vulnerable Software and Affected Versions: AbrhilSoft Employee's Portal versions prior to 5.6.2 Description: The issue is related to a SQL injection vulnerability found in the login page. This vulnerability can potentially be exploited to extract or modify sensitive data from the...

PT-2024-3290 · WordPress · Herd Effects

Name of the Vulnerable Software and Affected Versions: Herd Effects WordPress plugin versions prior to 5.2.7 Description: The issue is related to a lack of CSRF checks in some bulk actions of the Herd Effects WordPress plugin, which could allow attackers to make logged-in admins perform unwanted...

PT-2024-25782 · Eyoucms · Eyoucms

Name of the Vulnerable Software and Affected Versions: EyouCMS version 1.6.5 Description: A critical issue affects the Backend component of EyouCMS, specifically the file /login.php?m=admin&c=Field&a=channel edit. The manipulation of the channel id argument leads to deserialization. This issue ca...

PT-2024-25788 · Unknown · Puneethreddyhc Event Management

Name of the Vulnerable Software and Affected Versions: PuneethReddyHC Event Management version 1.0 Description: A critical issue affects the processing of the file /backend/register.php, where the manipulation of the arguments event id, full name, email, mobile, college, or branch leads to sql...

PT-2024-23631 · Unknown · Sourcecodester Complete E-Commerce Site

Name of the Vulnerable Software and Affected Versions: Sourcecodester Complete E-Commerce Site version 1.0 Description: The issue allows remote attackers to execute arbitrary code via the filename parameter in the "admin/products photo.php" endpoint. This is an arbitrary file upload vulnerability...

PT-2024-24087

Name of the Vulnerable Software and Affected Versions PsiTransfer versions prior to 2.2.0 Description The issue arises from the absence of restrictions on the "POST /files" endpoint, which allows users to create a path for uploading a file in a file distribution. This enables an attacker to add...

UC Software – Improper Access Control

A vulnerability was discovered in the firmware builds after 8.0.2.3267 and prior to 8.1.3.1301 in CCX devices. A flaw in the firmware build process did not properly restrict access to a resource from an unauthorized actor. The recommendation is to update an impacted device to the latest firmware...