CVE-2024-50715

An issue in smarts-srl.com Smart Agent v.1.1.0 allows a remote attacker to obtain sensitive information via command injection through a vulnerable unsanitized parameter defined in the /youtubeInfo.php component...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to the lack of proper sanitization of the $msg parameter in the Error function. An attacker who can inject a script into parameter that is passed out in the text of an error message - such as a font name - c...

CVE-2024-50715

An issue in smarts-srl.com Smart Agent v.1.1.0 allows a remote attacker to obtain sensitive information via command injection through a vulnerable unsanitized parameter defined in the /youtubeInfo.php component...

PT-2024-34398 · Unknown · Smart Agent

Name of the Vulnerable Software and Affected Versions: Smart Agent version 1.1.0 Description: An issue in Smart Agent allows a remote attacker to obtain sensitive information via command injection through a vulnerable unsanitized parameter defined in the "/youtubeInfo.php" component...

CVE-2024-10499

The AI Engine WordPress plugin is vulnerable to SQL injection in RESP API handling. Until version 2.6.5, an input parameter is not sanitized/escaped before use in SQL, enabling admins to perform SQL injection via the API. Affected: AI Engine (WordPress plugin) prior to 2.6.5. Root cause: unsaniti...

CVE-2024-28138

Summary of CVE-2024-28138 : An unauthenticated attacker with network access to the affected device’s web interface can execute arbitrary system commands via the image processing script (msg_events.php / msg events.php) because the HTTP GET parameter data is not properly sanitized. This allows com...

U.S. Dept Of Defense: XSS vulnerability found in javascript code of https://███.mil

The XSS vulnerability was found in the JavaScript code of the website https://███.mil. The parameter "code" was not sufficiently sanitized, allowing the injection of malicious code. This vulnerability could have been exploited to execute arbitrary scripts in the context of the affected website...

The vulnerability in the ap_mode.cgi script of NETGEAR’s router microprogramming devices R8500, XR300, R7000P, and R6400 v2 allows a hacker to execute arbitrary commands.

The vulnerability of the apmode.cgi script in NETGEAR’s router microprogramming devices such as R8500, XR300, R7000P, and R6400 v2 lies in the lack of measures to neutralize special elements used in the operating system’s commands when processing the apmodegateway parameter. Exploiting this...

CVE-2023-40819

ID4Portais in version V.2022.837.002a returns message parameter unsanitized in the response, resulting in a HTML Injection vulnerability...

PT-2024-12913 · Unknown · Id4Portais

Name of the Vulnerable Software and Affected Versions: ID4Portais versions prior to V.2022.837.002a Description: The issue results in a HTML Injection vulnerability due to the message parameter being returned unsanitized in the response. Recommendations: For versions prior to V.2022.837.002a,...

CVE-2024-6076

The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

PT-2024-37367 · WordPress · Wp-Cart-For-Digital-Products

Name of the Vulnerable Software and Affected Versions: wp-cart-for-digital-products versions prior to 8.5.5 Description: The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before being outputted back in the page. This could be...

CVE-2024-5286

The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-5282

The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-2870

The socialdriver-framework WordPress plugin before 2024.04.30 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-5730

The Pagerank tools WordPress plugin through 1.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-4860

The 'WordPress RSS Aggregator' WordPress Plugin, versions 4.23.9 are affected by a Cross-Site Scripting XSS vulnerability due to the lack of sanitization of the 'noticeid' GET parameter...

CVE-2024-3060

The ENL Newsletter WordPress plugin through 1.0.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admin+ to perform SQL injection attacks...

CVE-2024-0399

The WooCommerce Customers Manager WordPress plugin before 29.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by Subscriber+ role...

CVE-2024-0365

The Fancy Product Designer WordPress plugin before 6.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by adminstrators...