CISA Adds Two N-able N-central Flaws to Known Exploited Vulnerabilities Catalog

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Wednesday added two security flaws impacting N-able N-central to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation. N-able N-central is a Remote Monitoring and Management RMM platform designed...

CVE-2025-24290

CVE-2025-24290 affects UISP Application versions 2.4.206 and earlier. The dashboards and related components are vulnerable to multiple authenticated SQL Injection flaws that could enable a low-privilege user to escalate privileges. Exploitation status is not detailed in the provided documents. Ro...

CVE-2024-54996

MonicaHQ v4.1.2 was discovered to contain multiple authenticated Client-Side Injection vulnerabilities via the title and description parameters at /people/ID/reminders/create...

CVE-2021-24131

Unvalidated input in the Anti-Spam by CleanTalk WordPress plugin, versions before 5.149, lead to multiple authenticated SQL injection vulnerabilities, however, it requires high privilege user admin+...

Drupal Advanced File Destination module * - Authenticated Multiple Vulnerabilities vulnerability

Authenticated Multiple Vulnerabilities vulnerability discovered by Conrad Lara cmlara in WordPress Module Advanced File Destination versions...

CVE-2019-5122

SQL injection vulnerabilities exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with Parameter name in /objects/pluginSwitch.json.php...

CVE-2024-25611

Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system...

WordPress ProfilePress Plugin < 4.15.0 Multiple Vulnerabilities

The WordPress plugin SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:properfraction:profilepress"; if description...

CVE-2024-54996

MonicaHQ v4.1.2 is susceptible to multiple authenticated Client-Side Injection vulnerabilities. The root cause is the improper neutralization of input within the title and description parameters at the /people/ID/reminders/create API endpoint. An authenticated user can exploit these parameters to...

CVE-2024-54996

MonicaHQ v4.1.2 was discovered to contain multiple authenticated Client-Side Injection vulnerabilities via the title and description parameters at /people/ID/reminders/create...

CVE-2024-11907 Skyword API Plugin <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Skyword API Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'skywordiframe' shortcode in all versions up to, and including, 2.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

Drupal Diff module < 1.8.0,2.0.0-2.0.0-beta2 - Authenticated Multiple Vulnerabilities

Authenticated Multiple Vulnerabilities discovered by Matthias Vogel in WordPress Module Diff versions 1.8.0,2.0.0-2.0.0-beta2...

Drupal Open Social module < 12.3.8,12.4.0-12.4.4,13.0.0-13.0.0-alpha10 - Authenticated Multiple Vulnerabilities

Authenticated Multiple Vulnerabilities discovered by Thiago Régis in WordPress Module Open Social versions 12.3.8,12.4.0-12.4.4,13.0.0-13.0.0-alpha10...

Drupal Paragraphs table module < 1.23.0,2.0.0-2.0.1 - Authenticated Multiple Vulnerabilities

Authenticated Multiple Vulnerabilities discovered by James Williams in WordPress Module Paragraphs table versions 1.23.0,2.0.0-2.0.1...

CVE-2023-30508 Authenticated Remote Path Traversal in Aruba EdgeConnect Enterprise Command Line Interface

Multiple authenticated path traversal vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface. Successful exploitation of these vulnerabilities result in the ability to read arbitrary files on the underlying operating system, including sensitive system files...

CVE-2023-30507 Authenticated Remote Path Traversal in Aruba EdgeConnect Enterprise Command Line Interface

Multiple authenticated path traversal vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface. Successful exploitation of these vulnerabilities result in the ability to read arbitrary files on the underlying operating system, including sensitive system files...

CVE-2023-22789 Authenticated Remote Command Execution in Aruba InstantOS or ArubaOS 10 Command Line Interface

Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system...

CVE-2023-22769 Authenticated Remote Command Execution in the ArubaOS Command Line Interface

Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system...

CVE-2023-22767 Authenticated Remote Command Execution in the ArubaOS Command Line Interface

Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system...

CVE-2023-22763 Authenticated Remote Command Execution in the ArubaOS Command Line Interface

Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system...