CVE-2024-50707

Unauthenticated remote code execution vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary code via the X-Forwarded-For header in an HTTP GET request...

CVE-2024-50704

Unauthenticated remote code execution vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary code via a specially crafted HTTP POST request...

CVE-2024-50707

CVE-2024-50707 is an unauthenticated remote code‑execution in Uniguest Tripleplay prior to version 24.2.1. The issue can be triggered by sending a crafted HTTP GET containing an X-Forwarded-For header, allowing an attacker to execute arbitrary code on affected systems. The CVSS v3.1 base score is...

WordPress GiveWP plugin <= 3.19.4 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by dream hard in WordPress Plugin GiveWP versions = 3.19.4...

Rancher allows an unauthenticated stack overflow in /v3-public/authproviders API

Impact An unauthenticated stack overflow crash, leading to a denial of service DoS, was identified in Rancher’s /v3-public/authproviders public API endpoint. A malicious user could submit data to the API which would cause the Rancher server to crash, but no malicious or incorrect data would...

GHSA-XR9Q-H9C7-XW8Q Rancher allows an unauthenticated stack overflow in /v3-public/authproviders API

Impact An unauthenticated stack overflow crash, leading to a denial of service DoS, was identified in Rancher’s /v3-public/authproviders public API endpoint. A malicious user could submit data to the API which would cause the Rancher server to crash, but no malicious or incorrect data would...

WordPress YaySMTP plugin <= 1.3.1 - Unauthenticated Stored Cross-Site Scripting via Email Logs vulnerability

Unauthenticated Stored Cross-Site Scripting via Email Logs vulnerability discovered by Cristian Bejan cbejan in WordPress Plugin SMTP for SendGrid – YaySMTP versions = 1.3.1...

RaspberryMatic 3.73.9.20240130 Remote Code Execution Exploit

RaspberryMatic / OCCU contains a unauthenticated remote code execution vulnerability, caused by multiple issues within the Java based HMIPServer.jar component. The webui allows for Firmware uploads which can be reached through the URL /pages/jpages/system/DeviceFirmware/addFirmware. This allows a...

RaspberryMatic 3.73.9.20240130 Remote Code Execution

RaspberryMatic / OCCU contains a unauthenticated remote code execution vulnerability, caused by multiple issues within the Java based HMIPServer.jar component. The webui allows for Firmware uploads which can be reached through the URL /pages/jpages/system/DeviceFirmware/addFirmware. This allows a...

CVE-2024-13476 LTL Freight Quotes – GlobalTranz Edition <= 2.3.11 - Unauthenticated SQL Injection

The LTL Freight Quotes – GlobalTranz Edition plugin for WordPress is vulnerable to SQL Injection via the 'engtzwdsavedropship' AJAX endpoint in all versions up to, and including, 2.3.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing...

CVE-2024-13483 LTL Freight Quotes – SAIA Edition <= 2.2.10 - Unauthenticated SQL Injection

The LTL Freight Quotes – SAIA Edition plugin for WordPress is vulnerable to SQL Injection via the 'editid' and 'dropshipeditid' parameters in all versions up to, and including, 2.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQ...

WordPress Rapid Cache plugin <= 1.2.3 - Unauthenticated Cache Poisoning vulnerability

Unauthenticated Cache Poisoning vulnerability discovered by Joshua Provoste in WordPress Plugin Rapid Cache versions = 1.2.3...

WordPress Actionwear products sync plugin <= 2.3.0 - Unauthenticated Full Patch Disclosure vulnerability

Unauthenticated Full Patch Disclosure vulnerability discovered by stealthcopter in WordPress Plugin Actionwear products sync versions = 2.3.0...

WordPress Themes Coder plugin < 1.4.0 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Project Black in WordPress Plugin Themes Coder versions 1.4.0...

WordPress K Elements plugin < 5.4.0 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin K Elements versions 5.4.0...

CVE-2025-0109 PAN-OS: Unauthenticated File Deletion Vulnerability on the Management Web Interface

An unauthenticated file deletion vulnerability in the Palo Alto Networks PAN-OS management web interface enables an unauthenticated attacker with network access to the management web interface to delete certain files as the “nobody” user; this includes limited logs and configuration files but doe...

Drupal SpamSpan filter module < 3.2.1 - Unauthenticated Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS vulnerability discovered by Pierre Rudloff prudloff in WordPress Module SpamSpan filter versions 3.2.1...

WordPress WPForms Contact Form Plugin <= 1.8.7.2 Unauthenticated Data Manipulation Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wpforms:contactform"; ifdescription...

CVE-2025-22217

Avi Load Balancer contains an unauthenticated blind SQL Injection vulnerability which was privately reported to VMware. Patches are available to remediate this vulnerability in affected VMware products. A malicious user with network access may be able to use specially crafted SQL queries to gain...

CVE-2022-47444

Unauth. Reflected Cross-Site Scripting XSS vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin = 4.5.3 versions...