CVE-2024-8656 WPFactory Helper <= 1.7.0 - Reflected Cross-Site Scripting

The WPFactory Helper plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.7.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in page...

Exploit for Improper Validation of Specified Type of Input in Servicenow

CVE-2024-4879 ServiceNow, a widely used platform for business...

PT-2024-39162 · WordPress · Wp Test Email

Name of the Vulnerable Software and Affected Versions: WP Test Email plugin for WordPress versions up to, and including, 1.1.7 Description: The WP Test Email plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add query arg without appropriate escaping on the UR...

PT-2024-39161 · WordPress · Wp Simple Booking Calendar

Name of the Vulnerable Software and Affected Versions: WP Simple Booking Calendar plugin for WordPress versions up to, and including, 2.0.10 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg and remove query arg without appropriate escaping on the...

PT-2024-39203 · WordPress · Waitlist Woocommerce

Name of the Vulnerable Software and Affected Versions: The Waitlist Woocommerce Back in stock notifier plugin for WordPress versions up to, and including, 2.7.5 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg without appropriate escaping on the...

PT-2024-39210 · WordPress · Cron Jobs

Name of the Vulnerable Software and Affected Versions: Cron Jobs plugin for WordPress versions up to, and including, 1.2.9 Description: The Cron Jobs plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add query arg without appropriate escaping on the URL. This...

CVE-2024-8622

The amCharts: Charts and Maps plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'amchartsjavascript' parameter in all versions up to, and including, 1.4.4 due to the ability to supply arbitrary JavaScript a lack of nonce validation on the preview functionality. This mak...

CVE-2024-8622

The amCharts: Charts and Maps plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'amchartsjavascript' parameter in all versions up to, and including, 1.4.4 due to the ability to supply arbitrary JavaScript a lack of nonce validation on the preview functionality. This mak...

CVE-2024-8529

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'cfields' parameter of the /wp-json/lp/v1/courses/archive-course REST API endpoint in all versions up to, and including, 4.2.7 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2024-8522

LearnPress WordPress LMS Plugin (= 4.2.7.1) or apply vendor-supplied security fixes. Technical details and PoCs are available in multiple connected sources (e.g., nuclei template, Exploit DB, Metasploit module).

CVE-2024-8529

CVE-2024-8529 – LearnPress : The LearnPress WordPress LMS Plugin (versions ≤ 4.2.7) is vulnerable to unauthenticated SQL injection via the c_fields parameter in the /wp-json/lp/v1/courses/archive-course REST API. This is due to insufficient escaping and lack of proper SQL query preparation, allow...

CVE-2024-8622

The CVE-2024-8622 entry concerns the amCharts: Charts and Maps plugin for WordPress. Affected versions are

CVE-2024-8277 WooCommerce Photo Reviews Premium <= 1.3.13.2 - Authentication Bypass to Account Takeover and Privilege Escalation

The WooCommerce Photo Reviews Premium plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.3.13.2. This is due to the plugin not properly validating what user transient is being used in the login function and not properly verifying the user's identit...

CVE-2024-7727

The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions called via the 'h5vpajaxhandler' ajax action in all versions up to, and including, 2.5.32. This makes it possible fo...

CVE-2024-8478

The The Affiliate Super Assistent plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.5.3. This is due to the software allowing users to supply arbitrary shortcodes in comments when the 'Parse comments' option is enabled. This makes it...

CVE-2024-8478

CVE-2024-8478 affects WordPress plugins: Affiliate Super Assistent (

Dell InsightIQ 加密问题漏洞

Dell InsightIQ is a performance monitoring and reporting tool from Dell USA. Dell InsightIQ suffers from a cryptographic issue vulnerability that arises from the use of corrupt or risky encryption algorithms. An unauthenticated remote access attacker could exploit the vulnerability to cause...

SAP NetWeaver Application Server 跨站脚本漏洞

SAP NetWeaver Application Server is an application server from SAP, Germany. A cross-site scripting vulnerability exists in SAP NetWeaver Application Server that originates from insufficient input validation and can be exploited by an unauthenticated attacker to create URL links that can embed...

PT-2024-39120 · Learning Digital · Orca Hcm

Name of the Vulnerable Software and Affected Versions: Orca HCM from LEARNING DIGITAL affected versions not specified Description: The issue is related to a missing authentication vulnerability, allowing an unauthenticated remote attacker to exploit the functionality and create an account with...

CVE-2024-1596

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file e.g. RTX file in all versions up to, and including, 3.3.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...