CVE-2024-20676

CVE-2024-20676 – Azure Storage Mover Remote Code Execution is documented with a CVSSv3 base score of 8.0 (HIGH) and a network attack vector requiring high complexity and high privileges, with no user interaction. The vulnerability affects Azure Storage Mover components and can lead to arbitrary c...

CVE-2023-39336

An unspecified SQL Injection vulnerability in Ivanti Endpoint Manager released prior to 2022 SU 5 allows an attacker with access to the internal network to execute arbitrary SQL queries and retrieve output without the need for authentication. Under specific circumstances, this may also lead to RC...

CVE-2023-39336

An unspecified SQL Injection vulnerability in Ivanti Endpoint Manager released prior to 2022 SU 5 allows an attacker with access to the internal network to execute arbitrary SQL queries and retrieve output without the need for authentication. Under specific circumstances, this may also lead to RC...

CVE-2024-21663

CVE-2024-21663 affects the Discord-Recon bot. The affected component is the bot’s ability to execute shell commands via the server without requiring admin privileges, constituting a remote code execution (RCE) vulnerability. The issue is documented as fixed in version 0.0.8; versions prior to 0.0...

CVE-2023-6528

The Slider Revolution WordPress plugin before 6.6.19 does not prevent users with at least the Author role from unserializing arbitrary content when importing sliders, potentially leading to Remote Code Execution...

CVE-2018-25095 Duplicator < 1.3.0 - Unauthenticated RCE

The Duplicator WordPress plugin before 1.3.0 does not properly escape values when its installer script replaces values in WordPress configuration files. If this installer script is left on the site after use, it could be use to run arbitrary code on the server...

CVE-2023-5957 Ni Purchase Order(PO) For WooCommerce <= 1.2.1 - Admin+ File Upload to Remote Code Execution

The Ni Purchase OrderPO For WooCommerce WordPress plugin through 1.2.1 does not validate logo and signature image files uploaded in the settings, allowing high privileged user to upload arbitrary files to the web server, triggering an RCE vulnerability by uploading a web shell...

CVE-2023-5957

CVE-2023-5957 affects the Ni Purchase Order (PO) for WooCommerce WordPress plugin up to version 1.2.1. The vulnerability arises because the plugin does not validate logo and signature image files uploaded in the settings, allowing a high-privilege user to upload arbitrary files to the web server ...

CVE-2024-21650

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is vulnerable to a remote code execution RCE attack through its user registration feature. This issue allows an attacker to execute arbitrary code by crafting malicious payloads in the...

CVE-2024-21650 XWiki Remote Code Execution vulnerability via user registration

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is vulnerable to a remote code execution RCE attack through its user registration feature. This issue allows an attacker to execute arbitrary code by crafting malicious payloads in the...

CVE-2024-21650

XWiki Platform is affected by an RCE via the user registration feature. The vulnerability allows arbitrary code execution by crafting payloads in the first name or last name fields during guest user registration. Root cause cited in multiple sources is improper input handling (SSTI-like behavior)...

Exploit for Code Injection in Provectus Ui

CVE-2023-52251-POC There is a Remote Code Execution vulnerabi...

Alert: Ivanti Releases Patch for Critical Vulnerability in Endpoint Manager Solution

Ivanti has released security updates to address a critical flaw impacting its Endpoint Manager EPM solution that, if successfully exploited, could result in remote code execution RCE on susceptible servers. Tracked as CVE-2023-39336, the vulnerability has been rated 9.6 out of 10 on the CVSS...

WordPress Booking Calendar, Appointment Booking System Plugin < 3.2.2 File Upload Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wpdevart:bookingcalendar"; if description...

Job Manager & Career – Manage job board listings, and recruitments < 1.4.5 - Cross-Site Request Forgery to PHP Object Injection

Description The Job Manager & Career – Manage job board listings, and recruitments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.4. This is due to missing or incorrect nonce validation on the savepluginsettings function. This makes it...

CVE-2023-51812

Tenda AX3 v16.03.12.11 was discovered to contain a remote code execution RCE vulnerability via the list parameter at /goform/SetNetControlList...

CVE-2023-51812

Tenda AX3 v16.03.12.11 was discovered to contain a remote code execution RCE vulnerability via the list parameter at /goform/SetNetControlList...

CVE-2023-51812

The CVE-2023-51812 vulnerability affects Tenda AX3 v16.03.12.11, exploitable via the list parameter in /goform/SetNetControlList. The root cause is failure to properly filter elements in the constructed code segment, enabling remote code execution with network access and no user interaction. CVSS...

CMSMS 2.2.19 Arbitrary File Upload

Title: cmsms-2.2.19 - File Upload - RCE Author: nu11secur1ty Date: 12/29/2023 Vendor: https://www.cmsmadesimple.org/ Software: https://www.cmsmadesimple.org/downloads-header/cmsms/ Reference: https://portswigger.net/web-security/file-upload,...

CVE-2023-39157 WordPress JetElements For Elementor Plugin <= 2.6.10 is vulnerable to Remote Code Execution (RCE)

Improper Control of Generation of Code 'Code Injection' vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.10...