PT-2024-27329 · WordPress · Givewp

Name of the Vulnerable Software and Affected Versions: GiveWP – Donation Plugin and Fundraising Platform versions up to, and including, 3.10.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'give form' shortcode when used with a legacy form. This is due to...

PT-2024-26508 · WordPress · Wordpress Backup & Migration

Name of the Vulnerable Software and Affected Versions: WordPress Backup & Migration plugin versions up to, and including, 1.4.8 Description: The issue allows authenticated attackers with subscriber access or above to access log files maintained by the plugin due to a missing capability check on t...

PT-2024-3316 · Aruba · Arubaos

Name of the Vulnerable Software and Affected Versions: ArubaOS versions 8.10 through 10.5 Description: The issue is related to a buffer overflow vulnerability in the Utility daemon, which could lead to unauthenticated remote code execution by sending specially crafted packets to the PAPI UDP port...

PT-2024-24091 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7 Description: A problematic issue has been found in DedeCMS, affecting an unknown part of the file /src/dede/makehtml rss action.php. This issue leads to cross-site request forgery and can be initiated remotely. The exploit...

PT-2024-23283 · Supsystic · Supsystic Slider

Name of the Vulnerable Software and Affected Versions: Supsystic Slider by Supsystic versions 1.8.10 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for potential exploitation by...

PT-2024-22906 · Unknown · Campcodes Online Examination System

Name of the Vulnerable Software and Affected Versions: Campcodes Online Examination System version 1.0 Description: A critical issue was found in the system, affecting an unknown function of the file /adminpanel/admin/facebox modal/updateExaminee.php. The manipulation of the id argument leads to...

PT-2024-12130 · Onthegosystems · Onthegosystems Types

Name of the Vulnerable Software and Affected Versions: OnTheGoSystems Types versions 3.4.17 and earlier Description: The issue is related to an Unrestricted Upload of File with Dangerous Type, which affects OnTheGoSystems Types. Recommendations: For versions 3.4.17 and earlier, update to a versio...

PT-2024-21762 · Cigesv2 · Cigesv2

Name of the Vulnerable Software and Affected Versions: CIGESv2 affected versions not specified Description: The issue is related to a SQL injection vulnerability in the CIGESv2 system. This vulnerability can be exploited through the /ajaxSubServicios.php endpoint, specifically in the idServicio...

PT-2024-21771 · Cigesv2 · Cigesv2

Name of the Vulnerable Software and Affected Versions: CIGESv2 affected versions not specified Description: The issue is related to a SQL injection vulnerability in the CIGESv2 system. This vulnerability can be exploited through the /ajaxServiciosAtencion.php endpoint, specifically in the...

PT-2024-22524 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7 Description: A Cross-Site Request Forgery CSRF issue was found in DedeCMS. The vulnerability can be exploited via the /dede/sys cache up.php API endpoint. Recommendations: For DedeCMS version 5.7, as a temporary workaround...

PT-2024-21322 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.2.0 through 7.4.3.37 Liferay DXP versions prior to 7.4 update 38 Liferay DXP versions prior to 7.3 update 11 Liferay DXP versions prior to 7.2 fix pack 20 Description: A cross-site scripting XSS issue in the Frontend...

PT-2024-20816 · Unknown · Barangay Population Monitoring System

Name of the Vulnerable Software and Affected Versions: Barangay Population Monitoring System version 1.0 Description: The system contains a cross-site scripting XSS vulnerability in the Add Resident function at "/barangay-population-monitoring-system/masterlist.php". This issue allows attackers t...

PT-2024-15599 · Taokeyun · Taokeyun

Name of the Vulnerable Software and Affected Versions: Taokeyun versions up to 1.0.5 Description: A critical issue has been found in the HTTP POST Request Handler component, specifically affecting the function index of the file application/index/controller/app/Video.php. The manipulation of the c...

PT-2024-13776 · Billing · Billing

Name of the Vulnerable Software and Affected Versions: Billing Software version 1.0 Description: The issue concerns multiple Unauthenticated SQL Injection vulnerabilities. Specifically, the bank details parameter of the "party submit.php" resource does not validate the characters received, and th...

PT-2024-13982 · Unknown · Travel Website

Name of the Vulnerable Software and Affected Versions: Travel Website version 1.0 Description: The issue concerns multiple Unauthenticated SQL Injection vulnerabilities. Specifically, the city parameter of the "hotelSearch.php" resource does not validate the characters received, and they are sent...

PT-2023-11451 · Bell · Bell Homehub 3000

Name of the Vulnerable Software and Affected Versions: Bell HomeHub 3000 version SG48222070 Description: An issue allows remote authenticated users to retrieve the serial number via the "cgi/json-req" endpoint. This is considered an information leak because the serial number is intended to prove ...

PT-2023-29743 · Gibbon · Gibbon

Name of the Vulnerable Software and Affected Versions: GibbonEdu Gibbon versions through 25.0.0 Description: The issue allows file upload with resultant XSS through the /modules/Planner/resources addQuick ajaxProcess.php file. The imageAsLinks parameter must be set to 'Y' to return HTML code. The...

PT-2023-27332 · Unknown · Demon Image Annotation

Name of the Vulnerable Software and Affected Versions: demon image annotation versions n/a through 5.1 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2023-32138 · Unknown · Shenzhen Reachfar

Name of the Vulnerable Software and Affected Versions: Shenzhen Reachfar version v28 Description: The issue allows a remote attacker to retrieve all the week's logs stored in the 'log2' directory, potentially exposing sensitive information such as remembered wifi networks, sent messages, SOS devi...

PT-2023-29170 · Unknown · Matias'S Shockingly Simple Favicon

Name of the Vulnerable Software and Affected Versions: Matias's Shockingly Simple Favicon plugin versions = 1.8.2 Description: A Cross-Site Request Forgery CSRF issue affects the plugin, allowing unauthorized actions to be performed on behalf of the user. Recommendations: For versions = 1.8.2,...