CVE-2024-36392

The CVE-2024-36392 entry concerns MileSight DeviceHub with a cross-site scripting (CWE-79) weakness caused by improper input neutralization during web page generation. According to the public records, the vulnerability is network-exposed, requires user interaction, and the exploit complexity is l...

CVE-2024-36391

Technical details about CVE-2024-36391 are not publicly available in the provided connected documents; no affected products, versions, impact, or fix details are disclosed here. Monitor for updates.

CVE-2024-36390

Technical details about CVE-2024-36390 (affected components, exploit scenarios, and specific versions) are not publicly available in the provided documents. Monitor for updates.

CVE-2024-36389

The documents identify CVE-2024-36389 as affecting MileSight DeviceHub with CWE-330: Use of Insufficiently Random Values may allow Authentication Bypass. The NVD entry lists a 9.8 CVSS v3.1 score (Network attack, no privileges, high impact on confidentiality, integrity, and availability) and note...

CVE-2024-36388

Technical details (affected product, component, version, root cause, impact, or fix) are not publicly available in the provided documents. Monitor for updates.

CVE-2024-27776

CVE-2024-27776 affects MileSight DeviceHub. The issue is a CWE-22 path traversal vulnerability that may allow unauthenticated remote code execution over the network (no user interaction) with a CVSS v3.1 base score of 9.8 (CRITICAL). Root cause is improper limitation of a pathname to a restricted...

CVE-2024-2178

CVE-2024-2178 affects parisneo/lollms-webui. The path traversal exists in the copy_to_custom_personas endpoint (lollms_personalities_infos.py), allowing crafted values in category and name (e.g., ../ sequences) to read files outside the intended directory. This results in unauthorized access to s...

CVE-2024-5587

CVE-2024-5587 affects Casdoor up to 1.335.0, specifically the Configuration File Handler’s /conf/app.conf. The issue arises from a manipulation of an unknown function in that file, allowing access to files or directories. The vulnerability can be exploited remotely and an exploit has been disclos...

CVE-2024-4344

CVE-2024-4344 concerns the Shield Security – Smart Bot Blocking & Intrusion Prevention Security WordPress plugin. It is vulnerable to Cross-Site Request Forgery in all versions up to and including 19.1.13. The root cause is missing or incorrect nonce validation on the exec function, enabling unau...

CVE-2024-35645

CVE-2024-35645 affects the WordPress plugin Random Banner (versions up to and including 4.2.8). The vulnerability is described as Stored XSS due to Improper Neutralization of Input During Web Page Generation, enabling an attacker with Administrator privileges to inject malicious scripts that coul...

CVE-2024-35646

CVE-2024-35646 refers to a stored XSS vulnerability in the WordPress plugin Smartarget Message Bar. The available sources identify the issue as improper input neutralization during web page generation, allowing stored Cross‑Site Scripting for authenticated users (admin+). Affected versions are li...

CVE-2024-35647

CVE-2024-35647 concerns a Stored XSS in the WordPress Global Notification Bar plugin (vulnerable up to 1.0.1). The vulnerability is triggered via authenticated admin settings, enabling an attacker with Administrator privileges to inject scripts that could execute in contexts accessed by users. Th...

CVE-2024-4148

CVE-2024-4148 affects lunary-ai/lunary version 1.2.10. A ReDoS vulnerability arises when processing crafted regular expressions, leading to high availability impact (response time degradation or crash) as described in NVD/NVD-linked sources. The PT-2024-29418 entry corroborates the affected versi...

CVE-2024-35636

CVE-2024-35636 is a CSRF vulnerability in the Uploadcare File Uploader and Adaptive Delivery (beta) WordPress plugin. Affected versions are up to and including 3.0.11, with mitigation and fix implemented in version 3.1.0. Patch status indicates the issue was addressed in the 3.1.0 release; fixed ...

CVE-2024-3820

wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin (Premium) is affected by an unauthenticated SQL Injection via the id_key parameter of the wdt_delete_table_row AJAX action in versions up to 6.3.1. The root cause is insufficient escaping of the user-supplied parameter and ...

CVE-2024-3200

The CVE-2024-3200 entry concerns the wpForo Forum WordPress plugin. Affected software: wpForo Forum plugin for WordPress, versions up to and including 2.3.3. Root cause: insufficient escaping of the slug parameter in the wpforo shortcode and inadequate SQL query preparation, enabling SQL injectio...

CVE-2024-5348

The Elements For Elementor plugin (WordPress) is affected by CVE-2024-5348: Local File Inclusion in all versions up to 2.1 via multiple widget attributes (beforeafter_layout, eventsgrid_layout, marquee_layout, postgrid_layout, woocart_layout, woogrid_layout). Authenticated attackers with Contribu...

CVE-2024-3821

CVE-2024-3821 concerns the WordPress plugin wpDataTables (Premium) up to version 6.3.2. Root cause: missing capability check in wdt_ajax_actions.php, enabling unauthorized access and data table manipulation by unauthenticated users. A fix is noted in version 6.4 (patched). Provided Connected docu...

CVE-2024-4958

CVE-2024-4958 concerns the WordPress plugin “User Registration – Custom Registration Form, Login Form, and User Profile” up to version 3.2.0.1. The flaw is a missing capability check in the import_form_action function which allows authenticated users with contributor-level permissions and above t...

CVE-2024-2295

The CVE-2024-2295 entry concerns the WordPress plugin Contact Form Manager. Affected versions are all up to and including 1.6.1, where insufficient input sanitization and output escaping on the [xyz-cfm-form] shortcode attributes allows Stored Cross-Site Scripting (XSS). Exploitation requires aut...