CVE-2024-3116 Remote Code Execution Vulnerability through the validate binary path API in pgAdmin 4

pgAdmin = 8.4 is affected by a Remote Code Execution RCE vulnerability through the validate binary path API. This vulnerability allows attackers to execute arbitrary code on the server hosting PGAdmin, posing a severe risk to the database management system's integrity and the security of the...

XML Injection

verapdf is vulnerable to Remote Code Execution RCE. The vulnerability is caused by executing policy checks using custom schematron files, which invokes an XSL transformation that could lead to code execution...

CVE-2024-2692 SiYuan 3.0.3 - RCE via Server Side XSS

SiYuan version 3.0.3 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to Server Side XSS...

CVE-2024-2692 SiYuan 3.0.3 - RCE via Server Side XSS

SiYuan version 3.0.3 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to Server Side XSS...

CVE-2024-29387

CVE-2024-29387 affects Projeqtor up to version 11.2.0 with a remote code execution (RCE) vulnerability reported via the /view/print.php component. Multiple sources (NVD, Red Hat) describe RCE risk; one source (CNNVD) reports an SQL injection variant in the same component, indicating potential inc...

CVE-2024-30328

Foxit PDF Reader/Editor (various Mac/Windows versions) is affected by CVE-2024-30328: an Use-After-Free in AcroForms Doc objects leading to remote code execution. Exploitation requires user interaction (visiting a malicious page or opening a crafted file). The issue stems from not validating obje...

CVE-2024-24707 WordPress Cwicly plugin <= 1.4.0.2 - Auth. Remote Code Execution (RCE) vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in Cwicly Builder, SL. Cwicly allows Code Injection.This issue affects Cwicly: from n/a through 1.4.0.2...

CVE-2024-25918 WordPress InstaWP Connect plugin <= 0.1.0.8 - Remote Code Execution vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through = 0.1.0.8...

CVE-2024-27191 WordPress Slivery Extender plugin <= 1.0.2 - Remote Code Execution (RCE) vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in inpersttion Slivery Extender slivery-extender allows Remote Code Inclusion.This issue affects Slivery Extender: from n/a through = 1.0.2...

CVE-2024-27951 WordPress Multiple Page Generator Plugin <= 3.4.0 - Auth. Remote Code Execution (RCE) vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Themeisle Multiple Page Generator Plugin – MPG allows Upload a Web Shell to a Web Server.This issue affects Multiple Page Generator Plugin – MPG: from n/a through 3.4.0...

CVE-2024-27972 WordPress WP Fusion Lite plugin <= 3.41.24 - Remote Code Execution (RCE) vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in Jack Arturo WP Fusion Lite wp-fusion-lite.This issue affects WP Fusion Lite: from n/a through = 3.41.24...

CVE-2024-31380 WordPress Oxygen plugin <= 4.9 - Authenticated Remote Code Execution (RCE) vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in Soflyy Oxygen Builder allows Code Injection. Vendor is ignoring report, refuses to patch the issue.This issue affects Oxygen Builder: from n/a through 4.9...

CVE-2024-31390 WordPress Breakdance plugin <= 1.7.2 - Authenticated Remote Code Execution (RCE) vulnerability

: Improper Control of Generation of Code 'Code Injection' vulnerability in Soflyy Breakdance allows : Code Injection.This issue affects Breakdance: from n/a through 1.7.2...

CVE-2024-31390 WordPress Breakdance plugin <= 1.7.2 - Authenticated Remote Code Execution (RCE) vulnerability

: Improper Control of Generation of Code 'Code Injection' vulnerability in Soflyy Breakdance allows : Code Injection.This issue affects Breakdance: from n/a through 1.7.2...

Backdoor.Win32.Agent.ju (PSYRAT) MVID-2024-0677 Bypass / Command Execution

Discovery / credits: Malvuln John Page aka hyp3rlinx c 2024 Original source: https://malvuln.com/advisory/0e6e40aad3e8d46e3c0c26ccc6ab94b3.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Agent.ju PSYRAT Vulnerability: Authentication Bypass RCE Family: PSYRAT Typ...

LeptonCMS 7.0.0 - Remote Code Execution (RCE) (Authenticated)

Exploit Title: LeptonCMS 7.0.0 - Remote Code Execution RCE Authenticated Date: 2024-1-19 Exploit Author: tmrswrr Category: Webapps Vendor Homepage: https://www.lepton-cms.com/ Version : 7.0.0 1 Login with admin cred https://127.0.0.1/LEPTON/backend/login/index.php 2 Go to Languages place...

CVE-2024-1179

The CVE-2024-1179 issue affects TP-Link Omada ER605 routers, specifically the DHCPv6 Client Options handling. The root cause is improper validation of the length of user-supplied data before copying to a fixed-length stack buffer, enabling a stack-based buffer overflow that allows Remote Code Exe...

CVE-2023-51572

Voltronic Power ViewPower Pro is affected by CVE-2023-51572 due to an OS command injection in getMacAddressByIP. The flaw stems from insufficient validation of a user-supplied string before it is used to execute a system call, enabling remote code execution with SYSTEM privileges without authenti...

BIT-MLFLOW-2024-27132 Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe.

Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe. This issue leads to a client-side RCE when running an untrusted recipe in Jupyter Notebook. The vulnerability stems from lack of sanitization over template variables...

BIT-MLFLOW-2024-27133 Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset.

Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset. This issue leads to a client-side RCE when running the recipe in Jupyter Notebook. The vulnerability stems from lack of sanitization over dataset table fields...