PT-2024-36565 · WordPress · Popup Maker

Name of the Vulnerable Software and Affected Versions: The Popup Maker WordPress plugin versions prior to 1.19.1 Description: The issue concerns a Stored Cross-Site Scripting flaw in the Popup Maker WordPress plugin. This flaw arises because the plugin does not properly sanitize and escape some o...

PT-2024-39104 · Itsourcecode · Itsourcecode Payroll Management System

Name of the Vulnerable Software and Affected Versions: itsourcecode Payroll Management System version 1.0 Description: A critical issue has been found in the processing of the file "/ajax.php?action=delete deductions". The manipulation of the id argument leads to SQL injection. The attack may be...

PT-2024-39100 · Sourcecodester · Sourcecodester Php Crud

Name of the Vulnerable Software and Affected Versions: SourceCodester PHP CRUD version 1.0 Description: A vulnerability was found in the software, classified as problematic. It affects the file /endpoint/update.php, where the manipulation of the first name, middle name, and last name arguments...

PT-2024-18158 · WordPress · Ninja Forms - File Uploads

Name of the Vulnerable Software and Affected Versions: Ninja Forms - File Uploads plugin for WordPress versions up to, and including, 3.3.16 Description: The issue is a Stored Cross-Site Scripting vulnerability via an uploaded file, such as an RTX file, due to insufficient input sanitization and...

PT-2024-27283 · Ibm · Ibm Maximo Application Suite

Name of the Vulnerable Software and Affected Versions: IBM Maximo Application Suite - Manage Component versions 8.10 through 9.0 Description: The issue is related to the use of weaker than expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information usi...

PT-2024-35091

Name of the Vulnerable Software and Affected Versions HAPI FHIR versions prior to 6.4.0 Description The XSLT parsing performed by various components in HAPI FHIR is vulnerable to XML external entity injections. This issue can be exploited by submitting a malicious XML file with a DTD tag,...

PT-2024-31761 · Rapidcms · Rapidcms

Name of the Vulnerable Software and Affected Versions: RapidCMS version 1.3.1 Description: A SQL injection issue was discovered in RapidCMS, which occurs via the password parameter at the "/resource/runlogin.php" API endpoint. This allows for potential exploitation of the system. Recommendations:...

PT-2024-31605 · Stripe · Stripe Cli

Name of the Vulnerable Software and Affected Versions: stripe-cli versions 1.11.1 through 1.21.2 Description: A path traversal vulnerability exists in stripe-cli where a plugin package containing a manifest with a malformed plugin shortname installed using the --archive-url or --archive-path flag...

PT-2024-39032 · Unknown · Job Portal

Name of the Vulnerable Software and Affected Versions: JobPortal affected versions not specified Description: The issue is related to a SQL injection vulnerability. An attacker could send a specially designed query through the user id parameter in the "/jobportal/admin/user/controller.php" endpoi...

PT-2024-39029 · Windmill · Windmill

Name of the Vulnerable Software and Affected Versions: Windmill version 1.380.0 Description: A vulnerability exists in the HTTP Request Handler component, affecting an unknown function of the file backend/windmill-api/src/users.rs. This issue leads to improper restriction of excessive...

PT-2024-38064 · Semtek · Sempos

Name of the Vulnerable Software and Affected Versions: Semtek Sempos versions through 31072024 Description: The issue is related to an Improper Neutralization of Special Elements used in an SQL Command, also known as a SQL Injection vulnerability. This allows unauthorized database access...

PT-2024-31461 · Za Internet · C-Mor

Name of the Vulnerable Software and Affected Versions: za-internet C-MOR Video Surveillance versions 5.2401 through 6.00PL01 Description: The issue is related to improper input validation in the C-MOR web interface, making it vulnerable to persistent cross-site scripting XSS attacks. This allows ...

PT-2024-31404

Name of the Vulnerable Software and Affected Versions Fides versions prior to 2.44.0 Description A timing-based username enumeration vulnerability exists in Fides Webserver authentication, allowing an unauthenticated attacker to determine the existence of valid usernames by analyzing the time it...

PT-2024-31405

Name of the Vulnerable Software and Affected Versions Fides versions 2.19.0 through 2.43.x Description The Email Templating feature in Fides uses Jinja2 without proper input sanitization or rendering environment restrictions, allowing for Server-Side Template Injection that grants Remote Code...

PT-2024-26082 · Samsung · Samsung Assistant

Name of the Vulnerable Software and Affected Versions: Samsung Assistant versions prior to 9.1.00.7 Description: The issue is related to the improper handling of insufficient permissions in Samsung Assistant, allowing remote attackers to access location data. User interaction is required for...

PT-2024-37929 · WordPress · Secure Copy Content Protection/Content Locking

Name of the Vulnerable Software and Affected Versions: Secure Copy Content Protection and Content Locking WordPress plugin versions prior to 4.1.7 Description: The issue is related to the Secure Copy Content Protection and Content Locking WordPress plugin, which does not properly sanitise and...

PT-2024-5899

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 130 Description The issue is related to memory safety bugs present in Firefox, which showed evidence of memory corruption. It is presumed that with enough effort, these bugs could be exploited to run arbitrary code,...

PT-2024-26079 · Unknown · Group Sharing

Name of the Vulnerable Software and Affected Versions: GroupSharing versions prior to 13.6.13.3 Description: The issue allows remote attackers to force victims to join a group, resulting in exposure of sensitive information. This can be achieved by exploiting the vulnerability in GroupSharing...

PT-2024-37323 · WordPress · Sign-Up Sheets

Name of the Vulnerable Software and Affected Versions: Sign-up Sheets WordPress plugin versions prior to 2.2.13 Description: The issue is related to Reflected Cross-Site Scripting. It occurs because the plugin does not properly escape some generated URLs and the $ SERVER'REQUEST URI' parameter...

PT-2024-38813 · WordPress · Wp Extended

Name of the Vulnerable Software and Affected Versions: The Ultimate WordPress Toolkit – WP Extended plugin for WordPress version 3.0.8 and earlier Description: The issue allows authenticated attackers with Subscriber-level access and above to change an admin's username to a username of their...