PT-2024-25441 · Extend Themes · Extend Themes Colibri Wp +6

Name of the Vulnerable Software and Affected Versions: Extend Themes Pathway versions 1.0.15 and earlier Extend Themes Hugo WP versions 1.0.8 and earlier Extend Themes Althea WP versions 1.0.13 and earlier Extend Themes Elevate WP versions 1.0.15 and earlier Extend Themes Brite versions 1.0.11 an...

PT-2024-25307 · Themegrill · Themegrill Colornews

Name of the Vulnerable Software and Affected Versions: ThemeGrill ColorNews versions 1.2.6 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

PT-2024-25330 · 8Theme · 8Theme Xstore

Name of the Vulnerable Software and Affected Versions: 8theme XStore versions through 9.3.5 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This can be exploited by an attacker to...

PT-2024-13926 · Qnap · Qnap Qts +1

Name of the Vulnerable Software and Affected Versions: QNAP QTS versions prior to 5.1.6.2722 build 20240402 QNAP QuTS hero versions prior to h5.1.6.2734 build 20240414 Description: An incorrect authorization issue has been reported, affecting several QNAP operating system versions. If exploited,...

PT-2024-25432 · Unknown · Contact Form 7 Extension For Mailchimp

Name of the Vulnerable Software and Affected Versions: Contact Form 7 Extension For Mailchimp versions 0.5.70 and earlier Description: A Cross-Site Request Forgery CSRF issue has been identified. This issue allows an attacker to perform actions on behalf of a user without their knowledge or...

PT-2024-15909 · WordPress · Fancy Product Designer

Name of the Vulnerable Software and Affected Versions: The Fancy Product Designer WordPress plugin versions prior to 6.1.8 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back...

PT-2024-25439 · WordPress · Wp Republic Hide Dashboard Notifications

Name of the Vulnerable Software and Affected Versions: WP Republic Hide Dashboard Notifications versions 1.2.3 and earlier Description: A Cross-Site Request Forgery CSRF issue affects WP Republic Hide Dashboard Notifications. This allows an attacker to perform unintended actions on a user's...

PT-2024-25361 · Unknown · Softlab Radio Player

Name of the Vulnerable Software and Affected Versions: SoftLab Radio Player versions 2.0.73 and earlier Description: The issue is a Server-Side Request Forgery SSRF vulnerability. This means that an attacker could potentially force the server to make requests to arbitrary domains, which could lea...

PT-2024-6663 · Ivanti · Ivanti Workspace Control

Name of the Vulnerable Software and Affected Versions: Ivanti Workspace Control versions 10.18.0.0 and below Description: The issue is related to an authentication bypass weakness in the message broker service, allowing a local authenticated attacker to escalate their privileges. This is due to t...

PT-2024-24806 · Elementor · Elementor

Name of the Vulnerable Software and Affected Versions: The Pack Elementor versions through 2.0.8.2 Description: A Server-Side Request Forgery SSRF issue has been identified. This allows an attacker to trick the server into making requests to arbitrary domains, potentially leading to unauthorized...

PT-2024-24794 · Ghozylab · Ghozylab Image Slider Widget

Name of the Vulnerable Software and Affected Versions: GhozyLab Image Slider Widget versions 1.1.125 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. Recommendation...

PT-2024-12261 · Elementor · Unlimited Elements For Elementor

Name of the Vulnerable Software and Affected Versions: Unlimited Elements For Elementor Free Widgets, Addons, Templates versions 1.5.60 and earlier Description: The issue allows for the unrestricted upload of files with dangerous types, potentially enabling an attacker to upload a web shell to a...

PT-2024-24877 · Woocommerce · Superfaktura Woocommerce

Name of the Vulnerable Software and Affected Versions: SuperFaktura WooCommerce versions 1.40.3 and earlier Description: A Server-Side Request Forgery SSRF issue has been identified. This allows an attacker to trick the server into making requests to arbitrary domains, potentially leading to...

PT-2024-24995 · Repute Infosystems · Armember

Name of the Vulnerable Software and Affected Versions: Repute Infosystems ARMember versions 4.0.28 and earlier Description: The issue is related to a Missing Authorization vulnerability. There is no information provided about the estimated number of potentially affected devices worldwide or...

FreeRDP < 3.5.1 Multiple Vulnerabilities

FreeRDP is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:freerdpproject:freerdp";...

PT-2024-13553 · Quickjs +2 · Quickjs +2

Name of the Vulnerable Software and Affected Versions: QuickJS versions prior to c4cdd61 Description: The issue is caused by a NULL pointer dereference due to an erroneous lexical scope of this with eval, leading to a build for in iterator error. Recommendations: For versions prior to c4cdd61,...

PT-2024-7005

Name of the Vulnerable Software and Affected Versions Grafana versions prior to v11.0.6+security-01 Grafana versions prior to v11.1.7+security-01 Grafana versions prior to v11.2.2+security-01 Description The SQL Expressions experimental feature of Grafana allows for the evaluation of duckdb queri...

FreeRDP < 2.11.6, 3.x < 3.5.0 Multiple Vulnerabilities

FreeRDP is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:freerdpproject:freerdp";...

PT-2024-19588 · Unknown · Axe Credit Portal

Name of the Vulnerable Software and Affected Versions: Axe Credit Portal versions 3.0 and later Description: The issue allows authenticated attackers to execute unintended queries and disclose sensitive information from database tables via crafted requests, specifically through the Save Favorite...

PT-2024-24552 · Inducer · Inducer

Name of the Vulnerable Software and Affected Versions: inducer versions prior to 2024.1 Description: The issue allows a remote attacker to execute arbitrary code via a crafted payload to the Page Sandbox feature. Recommendations: For versions prior to 2024.1, update to version 2024.1 or later to...