CVE-2024-35737

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Loopus WP Visitors Tracker allows Reflected XSS.This issue affects WP Visitors Tracker: from n/a through 2.3...

PT-2024-37138 · Netentsec · Netentsec Ns-Asg Application Security Gateway

Name of the Vulnerable Software and Affected Versions: Netentsec NS-ASG Application Security Gateway version 6.3 Description: A critical issue has been found in the processing of the file /protocol/iscuser/deleteiscuser.php. The manipulation of the messagecontent argument leads to SQL injection...

WordPress The Moneytizer plugin <= 9.6.3 - Missing Authorization via multiple AJAX actions vulnerability

Missing Authorization via multiple AJAX actions vulnerability discovered by Francesco Carlucci in WordPress Plugin The Moneytizer versions = 9.6.3...

LoLLMs Operating System Command Injection Vulnerability

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. An operating system command injection vulnerability exists in LoLLMs version 9.3 that stems from improper neutralization of special elements used in operating system commands, which could allow...

WordPress Insert or Embed Articulate Content into WordPress plugin <= 4.3000000024 - Iframe Injection vulnerability

Iframe Injection vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Insert or Embed Articulate Content into WordPress versions = 4.3000000024...

SUSE CVE-2020-14315

A memory corruption vulnerability is present in bspatch as shipped in Colin Percival's bsdiff tools version 4.3. Insufficient checks when handling external inputs allows an attacker to bypass the sanity checks in place and write out of a dynamically allocated buffer boundaries...

WordPress Advanced Custom Fields plugin < 6.3 - Auth. Custom Field Access

Auth. Custom Field Access vulnerability discovered by Scott Kingsley Clark in WordPress Plugin Advanced Custom Fields versions 6.3...

PT-2024-15798 · WordPress · Insert/Embed Articulate Content

Name of the Vulnerable Software and Affected Versions: Insert or Embed Articulate Content into WordPress plugin through 4.3000000023 Description: The issue arises from the plugin not properly filtering which file extensions are allowed to be imported on the server. This allows the uploading of...

Moodle Security Breach

Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment. A security vulnerability exists in Moodle versions 4.3 through 4.3.3. An attacker exploited the vulnerability to perform a cross-site...

CVE-2024-35356

A vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts an unidentified code within the file /classes/Master.php?f=saveitem. Manipulating the argument id can result in SQL injection...

Dino Physics School Assistant SQL Injection Vulnerability

Dino Physics School Assistant is an application. A SQL injection vulnerability exists in Dino Physics School Assistant version 2.3, which stems from unrecognized code in /classes/Master.php that causes SQL injection via the parameter id...

Dino Physics School Assistant Cross-Site Scripting Vulnerability

Dino Physics School Assistant is an application. A cross-site scripting vulnerability exists in Dino Physics School Assistant version 2.3, which stems from unrecognized code in /classes/Users.php that leads to a cross-site scripting attack via the parameter id...

O2OA 安全漏洞

O2OA is an enterprise application development platform from O2OA open source. A security vulnerability exists in O2OA v8.3.8, which stems from the presence of an arbitrary file upload vulnerability that allows an attacker to execute arbitrary code by uploading a crafted PDF file...

pcp: exposure of the redis server backend allows remote command execution via pmproxy

A flaw was found in PCP. The default pmproxy configuration exposes the Redis server backend to the local network, allowing remote command execution with the privileges of the Redis user. This issue can only be exploited when pmproxy is running. By default, pmproxy is not running and needs to be...

CVE-2024-34952

taurusxin ncmdump v1.3.2 was discovered to contain a segmentation violation via the NeteaseCrypt::FixMetadata function at /src/ncmcrypt.cpp. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted .ncm file...

WordPress ChaosTheory theme <= 1.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Rafie Muhammad Patchstack in WordPress Theme ChaosTheory versions = 1.3...

PT-2024-12725 · Unknown · Averta Phlox Portfolio

Name of the Vulnerable Software and Affected Versions: Averta Phlox Portfolio versions prior to 2.3.1 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal', which allows PHP Local File Inclusion. This means that an...

WordPress month name translation benaceur plugin < 2.3.8 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin month name translation benaceur versions 2.3.8...

CVE-2024-35108

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/homeProdeal.php?mudi=del&dataType=&dataTypeCN...

PT-2024-21778 · Ibm · Vios +1

Name of the Vulnerable Software and Affected Versions: IBM AIX versions 7.2 through 7.3 VIOS versions 3.1 through 4.1 Description: A vulnerability in the invscout command allows a non-privileged local user to execute arbitrary commands. This issue poses a high risk and could be exploited by...