CVE-2024-37871

SQL injection vulnerability in login.php in Itsourcecode Online Discussion Forum Project in PHP with Source Code 1.0 allows remote attackers to execute arbitrary SQL commands via the email parameter...

CVE-2024-37871: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in login.php in Itsourcecode Online Discussion Forum Project in PHP with Source Code 1.0 allows remote attackers to execute arbitrary SQL commands via the email parameter...

CVE-2024-39695

creationtimestamp| type| source ---|---|--- 2024-07-08 18:40:32+00:00| seen| https://t.me/cvedetector/189 2025-12-29 21:01:14+00:00| seen| https://github.blog/security/vulnerability-research/bugs-that-survive-the-heat-of-continuous-fuzzing/...

CVE-2024-37157

Discourse is an open-source discussion platform. Prior to version 3.2.3 on the stable branch and version 3.3.0.beta4 on the beta and tests-passed branches, a malicious actor could get the FastImage library to redirect requests to an internal Discourse IP. This issue is patched in version 3.2.3 on...

CVE-2024-35234

Discourse is an open-source discussion platform. Prior to version 3.2.3 on the stable branch and version 3.3.0.beta3 on the tests-passed branch, an attacker can execute arbitrary JavaScript on users’ browsers by posting a specific URL containing maliciously crafted meta tags. This issue only...

CVE-2024-36122

Discourse vulnerability CVE-2024-36122 affects the open-source forum platform: moderators reviewing users in the review queue could see a user’s email address when the setting to “Allow moderators to view email addresses” is disabled. The issue affects versions prior to 3.2.3 on the stable branch...

CVE-2024-36122 Discourse doesn't limit reviewable user serializer payload

Discourse is an open-source discussion platform. Prior to version 3.2.3 on the stable branch and version 3.3.0.beta4 on the beta and tests-passed branches, moderators using the review queue to review users may see a users email address even when the Allow moderators to view email addresses settin...

CVE-2024-36122 Discourse doesn't limit reviewable user serializer payload

Discourse is an open-source discussion platform. Prior to version 3.2.3 on the stable branch and version 3.3.0.beta4 on the beta and tests-passed branches, moderators using the review queue to review users may see a users email address even when the Allow moderators to view email addresses settin...

CVE-2024-35234 Discourse vulnerable to stored-dom XSS via Facebook Oneboxes

Discourse is an open-source discussion platform. Prior to version 3.2.3 on the stable branch and version 3.3.0.beta3 on the tests-passed branch, an attacker can execute arbitrary JavaScript on users’ browsers by posting a specific URL containing maliciously crafted meta tags. This issue only...

CVE-2024-4498

A Path Traversal and Remote File Inclusion RFI vulnerability exists in the parisneo/lollms-webui application, affecting versions v9.7 to the latest. The vulnerability arises from insufficient input validation in the /applysettings function, allowing an attacker to manipulate the discussiondbname...

LoLLMs Path Traversal Vulnerability

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A path traversal vulnerability exists in LoLLMs versions prior to 9.7, which stems from insufficient input validation in the /applysettings function, allowing an attacker to traverse the file...

PT-2024-31343

Name of the Vulnerable Software and Affected Versions parisneo/lollms-webui versions v9.7 through the latest Description A Path Traversal and Remote File Inclusion RFI issue exists due to insufficient input validation in the /apply settings function, allowing an attacker to manipulate the...

GHSA-9GXX-58Q6-42P7 Lightning Network Daemon (LND)'s onion processing logic leads to a denial of service

Impact A parsing vulnerability in lnd's onion processing logic led to a DoS vector due to excessive memory allocation. Patches The issue was patched in lnd v0.17.0. Users should update to a version = v0.17.0 to be protected. References Detailed blog post:...

socket.io has an unhandled 'error' event

Impact A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. node:events:502 throw err; // Unhandled 'error' event ^ Error ERRUNHANDLEDERROR: Unhandled error. undefined at new NodeError node:internal/errors:405:5 at...

Security and Human Behavior (SHB) 2024

This week, I hosted the seventeenth Workshop on Security and Human Behavior at the Harvard Kennedy School. This is the first workshop since our co-founder, Ross Anderson, died unexpectedly. SHB is a small, annual, invitational workshop of people studying various aspects of the human side of...

CVE-2024-5734

A vulnerability classified as critical has been found in itsourcecode Online Discussion Forum 1.0. Affected is an unknown function of the file /members/poster.php. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has be...

CVE-2024-5734

CVE-2024-5734 affects itsourcecode Online Discussion Forum 1.0. Affected is an unknown function in /members/poster.php; manipulation of the image parameter enables unrestricted file upload, enabling remote attack. Exploit has been disclosed publicly. Documented CVSS metrics vary by source (e.g., ...

CVE-2024-5734 itsourcecode Online Discussion Forum poster.php unrestricted upload

A vulnerability classified as critical has been found in itsourcecode Online Discussion Forum 1.0. Affected is an unknown function of the file /members/poster.php. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has be...

CVE-2024-5733

CVE-2024-5733 affects itsourcecode Online Discussion Forum 1.0. The vulnerability arises from unknown processing in register_me.php where the eaddress parameter is manipulated to cause SQL injection. Impact is stated as remote exploitation with potential for high impact on confidentiality, integr...

CVE-2024-5733 itsourcecode Online Discussion Forum register_me.php sql injection

A vulnerability was found in itsourcecode Online Discussion Forum 1.0. It has been rated as critical. This issue affects some unknown processing of the file registerme.php. The manipulation of the argument eaddress leads to sql injection. The attack may be initiated remotely. The exploit has been...