CVE-2024-10138

A vulnerability classified as critical has been found in code-projects Pharmacy Management System 1.0. Affected is an unknown function of the file /addnewpurchase.php?action=issupplier. The manipulation of the argument name leads to sql injection. It is possible to launch the attack remotely. The...

CVE-2024-10131 Remote Code Execution in infiniflow/ragflow

The addllm function in llmapp.py in infiniflow/ragflow version 0.11.0 contains a remote code execution RCE vulnerability. The function uses user-supplied input req'llmfactory' and req'llmname' to dynamically instantiate classes from various model dictionaries. This approach allows an attacker to...

Pharmacy Management System SQL注入漏洞

Pharmacy Management System MPMS is a multilingual pharmacy management system by Mayuri K. Individual developer. A SQL injection vulnerability exists in Pharmacy Management System version 1.0, which originates from an SQL injection vulnerability contained in the name parameter of the...

RAGFlow 命令注入漏洞

RAGFlow is an open source RAG engine based on deep document understanding from InfiniFlow Open Source. A command injection vulnerability exists in RAGFlow version 0.11.0, which stems from a lack of comprehensive input validation or cleanup, causing the addllm function in llmapp.py to contain a...

Code-Projects Pharmacy Management System SQL注入漏洞

Code-Projects Pharmacy Management System is a Code-Projects open source pharmacy management system. A SQL injection vulnerability exists in Code-Projects Pharmacy Management System version 1.0, which originates from the name parameter of the /addnewpurchase.php?action=issupplier page contains a S...

CVE-2024-49239

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Nikhil Vaghela Add Categories Post Footer allows Reflected XSS.This issue affects Add Categories Post Footer: from n/a through 2.2.2...

CVE-2024-49239

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in nikhilvaghela Add Categories Post Footer add-categories-post-footer allows Reflected XSS.This issue affects Add Categories Post Footer: from n/a through = 2.2.2...

CVE-2024-49239

CVE-2024-49239 affects the WordPress plugin Add Categories Post Footer (versions

CVE-2024-49239 WordPress Add Categories Post Footer plugin <= 2.2.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in nikhilvaghela Add Categories Post Footer add-categories-post-footer allows Reflected XSS.This issue affects Add Categories Post Footer: from n/a through = 2.2.2...

CVE-2024-9206

The MAS Companies For WP Job Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.0.13. This makes it possible for unauthenticated attackers to inject arbitrary we...

CVE-2024-8740

The GetResponse Forms by Optin Cat plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.5.6. This makes it possible for unauthenticated attackers to inject arbitrary web...

PT-2024-39498 · WordPress · Wordpress Social Share Buttons

Name of the Vulnerable Software and Affected Versions: WordPress Social Share Buttons plugin versions up to, and including, 1.19 Description: The WordPress Social Share Buttons plugin is vulnerable to Reflected Cross-Site Scripting due to the use of add query arg without appropriate escaping on t...

WordPress plugin MAS Companies For WP Job Manager 跨站脚本漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exis...

PT-2024-16051 · Infiniflow · Ragflow

Name of the Vulnerable Software and Affected Versions: infiniflow/ragflow version 0.11.0 Description: The issue concerns a remote code execution vulnerability in the add llm function, located in llm app.py. This function utilizes user-supplied input, specifically req'llm factory' and req'llm name...

CVE-2024-49296

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in JC Custom Add to Cart Button Label and Link woo-custom-cart-button allows Stored XSS.This issue affects Custom Add to Cart Button Label and Link: from n/a through = 1.6.1...

CVE-2024-49296

CVE-2024-49296 is a stored XSS vulnerability in the WordPress plugin “Custom Add to Cart Button Label and Link” (affected: versions up to 1.6.1). The issue arises from improper neutralization of input during web page generation, enabling stored cross-site scripting. Public exploit details are not...

CVE-2024-49296 WordPress Custom Add to Cart Button Label and Link plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Coder426 Custom Add to Cart Button Label and Link allows Stored XSS.This issue affects Custom Add to Cart Button Label and Link: from n/a through 1.6.1...

CVE-2024-49296 WordPress Custom Add to Cart Button Label and Link plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in JC Custom Add to Cart Button Label and Link woo-custom-cart-button allows Stored XSS.This issue affects Custom Add to Cart Button Label and Link: from n/a through = 1.6.1...

WordPress Add Widget After Content plugin <= 2.4.6 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by ghsinfosec in WordPress Plugin Add Widget After Content versions = 2.4.6...

CVE-2024-48021 WordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Scott Paterson Contact Form 7 – PayPal & Stripe Add-on allows Reflected XSS.This issue affects Contact Form 7 – PayPal & Stripe Add-on: from n/a through 2.3...