CVE-2024-7879

The WP ULike WordPress plugin before 4.7.5 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2024-9934

The Wp-ImageZoom WordPress plugin through 1.1.0 does not sanitise and escape some parameters before outputting them back in a page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-9934

Summary: CVE-2024-9934 affects the WordPress plugin Wp-ImageZoom ≤ 1.1.0. The issue is a Reflected Cross-Site Scripting caused by not sanitising/escaping certain parameters before echoing them in a page, potentially exploitable against high-privilege users (e.g., admin). Root cause: insufficient ...

CVE-2024-9934 Wp-ImageZoom <= 1.1.0 - Reflected XSS

The Wp-ImageZoom WordPress plugin through 1.1.0 does not sanitise and escape some parameters before outputting them back in a page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-7879

The CVE-2024-7879 entries concern the WP ULike WordPress plugin (versions before 4.7.5) where certain settings are not properly sanitised/escaped. The Red Hat, NVD, and CVE lists describe this as a stored XSS vector that could be triggered by high-privilege users (e.g., editors) even when unfilte...

PT-2024-8001 · Glpi +1 · Glpi +1

Name of the Vulnerable Software and Affected Versions: GLPI versions 9.1.0 through 10.0.16 Description: The issue is related to incorrect access control in the GLPI system, which can allow a remote attacker to exploit the vulnerability and potentially disclose confidential information. A technici...

CVE-2024-5578

The Table of Contents Plus WordPress plugin through 2408 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2024-9883 Pods < 3.2.7.1 - Admin+ Stored XSS

The Pods WordPress plugin before 3.2.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-9883 Pods < 3.2.7.1 - Admin+ Stored XSS

The Pods WordPress plugin before 3.2.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-9883

The CVE-2024-9883 entry concerns the Pods WordPress plugin, prior to version 3.2.7.1, where certain settings were not properly sanitized or escaped. This can allow high-privilege users (e.g., administrators) to perform Stored Cross-Site Scripting (Stored XSS), even when unfiltered_html is disallo...

PT-2024-38655 · WordPress · Wp Ulike

Name of the Vulnerable Software and Affected Versions: WP ULike WordPress plugin versions prior to 4.7.5 Description: The issue is related to the WP ULike WordPress plugin, which does not properly sanitise and escape some of its settings. This could allow high-privilege users, such as editors, to...

CVE-2024-42028

A Local privilege escalation vulnerability found in a Self-Hosted UniFi Network Server with UniFi Network Application Version 8.4.62 and earlier allows a malicious actor with a local operational system user to execute high privilege actions on UniFi Network Server...

CVE-2024-21125

...

CVE-2024-21207

...

CVE-2024-21259

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 7.0.22 and prior to 7.1.2. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox...

CVE-2024-21259

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 7.0.22 and prior to 7.1.2. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox...

PT-2024-31750 · Centreon · Centreon Bi Server

Name of the Vulnerable Software and Affected Versions: Centreon BI Server versions 24.04.x through 24.04.2 Centreon BI Server versions 23.10.x through 23.10.7 Centreon BI Server versions 23.04.x through 23.04.10 Centreon BI Server versions 22.10.x through 22.10.10 Description: An issue was...

PT-2024-39613 · WordPress +1 · Custom-Registration-Form-Builder-With-Submission-Manager +1

Name of the Vulnerable Software and Affected Versions: RegistrationMagic WordPress plugin versions prior to 6.0.2.1 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for...

CVE-2024-8983

Custom Twitter Feeds WordPress plugin before 2.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-8983 Custom Twitter Feeds < 2.2.3 - Admin+ Stored XSS

Custom Twitter Feeds WordPress plugin before 2.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...