PT-2024-13404 · Rptc · Rptc

Name of the Vulnerable Software and Affected Versions: RPTC version 0x3b08c Description: The issue is related to the lack of status checks on the tradingOpen parameter, which can be exploited by attackers to conduct unauthorized transfer operations. Recommendations: For RPTC version 0x3b08c,...

PT-2024-15795 · Mldong · Mldong

Name of the Vulnerable Software and Affected Versions: mldong version 1.0 Description: A critical issue has been found in mldong, affecting the ExpressionEngine function of the file com/mldong/modules/wf/engine/model/DecisionModel.java. This issue leads to code injection and can be initiated...

PT-2024-4053

Name of the Vulnerable Software and Affected Versions: FortiWebManager versions 6.0.2, 6.2.3 through 6.2.4, 6.3.0, 7.0.0 through 7.0.4, and 7.2.0 Description: The issue is related to improper authorization in FortiWebManager, which can allow an attacker to execute unauthorized code or commands vi...

PT-2024-15787 · Unknown · Project Worlds Online Time Table Generator

Name of the Vulnerable Software and Affected Versions: Project Worlds Online Time Table Generator version 1.0 Description: A critical issue was found in the file course ajax.php, where the manipulation of the id argument leads to sql injection. This can be initiated remotely. The issue has been...

PT-2024-14329

Name of the Vulnerable Software and Affected Versions YonBIP version 3 23.05 Description An arbitrary file upload vulnerability in the doAction method of nccloud.web.arcp.taskmonitor.action.ArcpUploadAction allows attackers to execute arbitrary code via uploading a crafted file. Recommendations F...

PT-2024-19594 · Strangebee · Thehive

Name of the Vulnerable Software and Affected Versions: StrangeBee TheHive versions 5.1.0 through 5.1.9 StrangeBee TheHive versions 5.2.0 through 5.2.8 Description: The issue concerns a Cross Site Scripting XSS vulnerability in the case attachment functionality. This allows an attacker to upload a...

PT-2024-15788 · Unknown · Pcman Ftp Server

Name of the Vulnerable Software and Affected Versions: PCMan FTP Server version 2.0.7 Description: A vulnerability has been found in the component PUT Command Handler, which can lead to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may b...

Display custom fields in the frontend – Post and User Profile Fields < 1.3.0 - Authenticated (Contributor+) Code Injection

Description The Display custom fields in the frontend – Post and User Profile Fields plugin for WordPress is vulnerable to Code Injection via the plugin's vgdisplaydata shortcode in all versions up to, and including, 1.2.1 due to insufficient input validation and restriction on access to that...

PT-2024-19577 · Flycms · Flycms

Name of the Vulnerable Software and Affected Versions: FlyCms version 1.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. It occurs via the /system/email/email templets update API endpoint. This allows for potentially malicious requests to be made without the user's...

PT-2024-13948 · Ebyte · Ebyte E880-Ir01-V1.1

Name of the Vulnerable Software and Affected Versions: EBYTE E880-IR01-V1.1 Description: An issue discovered in the software allows an attacker to obtain sensitive information via a crafted POST request to the "/cgi-bin/luci" API endpoint. The POST request is used to exploit this issue, but...

PT-2024-19488 · Flycms · Flycms

Name of the Vulnerable Software and Affected Versions: FlyCms version 1.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. It can be exploited via the "/system/score/del" API endpoint. Recommendations: For FlyCms version 1.0, as a temporary workaround, consider restricti...

PT-2024-19505 · Unknown · Complete Supplier Management System

Name of the Vulnerable Software and Affected Versions: Complete Supplier Management System version 1.0 Description: The issue is related to SQL Injection via the "/Supply Management System/admin/edit retailer.php" endpoint, specifically the id parameter. This allows for potential exploitation. No...

PT-2024-19448 · Beetl-Bbs · Beetl-Bbs

Name of the Vulnerable Software and Affected Versions: beetl-bbs version 2.0 Description: A Stored Cross Site Scripting XSS vulnerability allows attackers to run arbitrary code via the "post/save" content parameter. This issue enables attackers to execute code on the affected system...

PT-2024-19402 · Avo · Avo

Name of the Vulnerable Software and Affected Versions: Avo versions prior to 2.47.0 Avo versions prior to 3.3.0 Description: Avo is a framework to create admin panels for Ruby on Rails apps. In Avo, any HTML inside text that is passed to error or succeed in an Avo::BaseAction subclass will be...

PT-2024-12549 · Webkul · Webkul Qloapps

Name of the Vulnerable Software and Affected Versions: webkul qloapps versions prior to 1.6.0 Description: An issue in webkul qloapps allows an attacker to obtain sensitive information via the id order parameter. Recommendations: For versions prior to 1.6.0, update to version 1.6.0 or later to...

PT-2024-15214 · WordPress · Product Enquiry For Woocommerce

Name of the Vulnerable Software and Affected Versions: The Product Enquiry for WooCommerce WordPress plugin versions prior to 3.2 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the page parameter is not properly sanitised and escaped before being...

PT-2024-1191 · Oracle · Oracle Webcenter Content

Name of the Vulnerable Software and Affected Versions: Oracle WebCenter Content version 12.2.1.4.0 Description: The issue is related to insufficient input validation in the Content Server component of Oracle WebCenter Content, allowing an unauthenticated attacker with network access via HTTP to...

PT-2024-15064 · Supsystic · The Ultimate Maps

Name of the Vulnerable Software and Affected Versions: The Ultimate Maps by Supsystic WordPress plugin versions prior to 1.2.16 Description: The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks even when unfiltered html is disallowed, due to the plugin no...

PT-2024-15639 · Unknown · Cxbsoft Url-Shorting

Name of the Vulnerable Software and Affected Versions: CXBSoft Url-shorting versions up to 1.3.1 Description: A critical issue was found in the HTTP POST Request Handler component, specifically in the file /pages/short to long.php. The manipulation of the shorturl argument leads to SQL injection...

PT-2024-1269 · Hitachi · Hitachi Device Manager

Name of the Vulnerable Software and Affected Versions: Hitachi Device Manager versions prior to 8.8.5-04 Description: The issue is related to insufficient protection of password input fields in the Device Manager Agent component of the Hitachi Device Manager system. This could allow a remote...