TE Informatics Nova CMS SQL注入漏洞

TE Informatics Nova CMS is a content management system from TE Informatics. A SQL injection vulnerability exists in TE Informatics Nova CMS versions prior to 5.0, which stems from vulnerability to SQL injection attacks...

PT-2024-39672 · WordPress · Userplus

Name of the Vulnerable Software and Affected Versions: UserPlus plugin for WordPress versions up to, and including, 2.0 Description: The issue is related to privilege escalation due to insufficient restriction on the form actions and userplus update user profile functions. This allows...

WordPress Shortcode For Elementor Templates plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by ghsinfosec Patchstack Alliance in WordPress Plugin Shortcode For Elementor Templates versions = 1.0.0...

PT-2024-32571 · Unknown · Cozy Blocks

Name of the Vulnerable Software and Affected Versions: Cozy Blocks versions through 2.0.11 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS, where an attacker can inject malicious...

PT-2024-32691 · Zoho · Zoho Forms

Name of the Vulnerable Software and Affected Versions: Zoho Forms versions prior to 4.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS in Zoho Forms. Recommendations: For versions...

CVE-2024-46261

cutepng v1.05 was discovered to contain a heap buffer overflow via the cpmake32 function at cutepng.h...

WordPress Zoho forms plugin <= 4.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Zoho Forms versions = 4.0...

WordPress Advanced Woo Labels plugin <= 2.01 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Savphill Patchstack Alliance in WordPress Plugin Advanced Woo Labels versions = 2.01...

Eclipse GlassFish 输入验证错误漏洞

Eclipse GlassFish is an open source application server from the Eclipse Foundation. An input validation error vulnerability exists in Eclipse GlassFish versions prior to 7.0.17, which stems from a Host HTTP parameter that may cause a web application to redirect to a specified URL when the request...

ValeApp SQL注入漏洞

ValeApp is a mobile application from Oceanic Software for providing convenient and fast parking services. A SQL injection vulnerability exists in ValeApp prior to version 2.0.0, which stems from the inclusion of a SQL injection issue...

WordPress GF Custom Style plugin <= 2.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by Francesco Carlucci in WordPress Plugin GF Custom Style versions = 2.0...

Dragonfly 安全漏洞

Dragonfly is a framework that allows dynamic processing of any content type. A security vulnerability exists in Dragonfly prior to version 2.0.9 that stems from Dragonfly's use of hard-coded JWT to authenticate users, which could lead to authentication bypass...

PT-2024-39365 · Unknown · Code-Projects Crud Operation System

Name of the Vulnerable Software and Affected Versions: code-projects Crud Operation System version 1.0 Description: A critical issue was found in the code-projects Crud Operation System. The problem lies in an unknown function of the file updata.php, where the manipulation of the sid argument lea...

PT-2024-37600 · Yordam Information Technology · Yordam Information Technology Mobile Library Application

Name of the Vulnerable Software and Affected Versions: Yordam Information Technology Mobile Library Application versions prior to 5.0 Description: The issue allows exposure of sensitive information to an unauthorized actor, enabling the retrieval of embedded confidential information...

CVE-2024-8490

The PropertyHive plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.19. This is due to missing or incorrect nonce validation on the 'saveaccountdetails' function. This makes it possible for unauthenticated attackers to edit the name, email...

Shopkit 安全漏洞

Shopkit is an open source Kirby Cms version 2 integrated commerce solution by Sam Nabi, an individual developer in Canada. A security vulnerability exists in Shopkit version 1.0. An attacker exploited the vulnerability to add a negative number of items to the shopping cart via the qtd parameter i...

CVE-2024-8663

The WP Simple Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 2.0.10. This makes it possible for unauthenticated attackers to inject...

WordPress Email Obfuscate Shortcode plugin <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin Email Obfuscate Shortcode versions = 2.0...

PT-2024-39261 · WordPress · Wp Booking System – Booking Calendar

Name of the Vulnerable Software and Affected Versions: The WP Booking System – Booking Calendar plugin for WordPress versions up to, and including, 2.0.19.8 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg and remove query arg without appropriate...

Reedos aiM-Star 安全漏洞

Reedos aiM-Star is a software product from Reedos for mutual fund distribution. A security vulnerability exists in Reedos aiM-Star version 2.0.1 that originates from the transmission of sensitive information in plain text in certain API endpoints, resulting in the exposure of sensitive informatio...