CVE-2024-42627

FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/?/snippet/delete/3...

CVE-2024-6691

The Easy Digital Downloads – Sell Digital Files & Subscriptions eCommerce Store + Payments Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the currency value in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. Thi...

CVE-2024-22121

A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application...

CVE-2024-22121 Zabbix Agent MSI Installer Allows Non-Admin User to Access Change Option via msiexec.exe

A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application...

PT-2024-37657 · WordPress · Search & Filter Pro

Name of the Vulnerable Software and Affected Versions: Search & Filter Pro WordPress plugin versions prior to 2.5.18 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for...

CVE-2024-6498

The Chatbot for WordPress by Collect.chat ⚡️ WordPress plugin before 2.4.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

PT-2024-28550 · Elecom · Elecom Wireless Lan Routers

Name of the Vulnerable Software and Affected Versions: ELECOM wireless LAN routers affected versions not specified Description: A specially crafted request may be sent to the affected product by a logged-in user with administrative privilege to execute an arbitrary OS command. This issue exists i...

PT-2024-37071

Name of the Vulnerable Software and Affected Versions Zohocorp ManageEngine Applications Manager versions 17.0900 and below Description The issue concerns an authenticated admin-only SQL Injection in the Create Monitor feature. Recommendations For versions 17.0900 and below, update to a version...

CVE-2024-7340 W&B Weave server remote arbitrary file leak and privilege escalation

The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin...

CVE-2024-6165

The WANotifier WordPress plugin before 2.6.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

PT-2024-38274

Name of the Vulnerable Software and Affected Versions Weave server affected versions not specified Description The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In...

CVE-2024-41916

CVE-2024-41916 affects ClearPass Policy Manager. The vulnerability allows an attacker with administrative privileges to access sensitive information in cleartext, enabling retrieval of data that could be used to gain further access to network services supported by ClearPass Policy Manager. Connec...

PT-2024-37686 · Fluent Forms · Contact Form Plugin By Fluent Forms

Name of the Vulnerable Software and Affected Versions: The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress versions up to, and including, 5.1.19 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input...

Solar-Log 1000 安全漏洞

Solar-Log 1000 is a solar photovoltaic data logger from the German company Solar-Log. A security vulnerability exists in Solar-Log 1000 prior to version 2.8.2 Build 52, which stems from the presence of a False Privilege Modification vulnerability that could allow an attacker to gain administrativ...

VulnCheck KEV: CVE-2024-6695

it's possible for an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions. This is due to improper logic flow on the user registration process...

Server-Side Template Injection (SSTI)

opencart/opencart is vulnerable to Server-Side Template Injection SSTI.The vulnerability is due to the edit theme function allowing attackers with admin access to execute arbitrary code via template payloads...

CVE-2024-23465

The SolarWinds Access Rights Manager was found to be susceptible to an authentication bypass vulnerability. This vulnerability allows an unauthenticated user to gain domain admin access within the Active Directory environment...

CVE-2024-23465

CVE-2024-23465 concerns SolarWinds Access Rights Manager (ARM). The vulnerability is an authentication bypass that could let an unauthenticated user gain domain administrator access within Active Directory. Several sources corroborate the issue and its impact (high severity, AR attack vector). Pu...

CVE-2024-23465 SolarWinds Access Rights Manager (ARM) ChangeHumster Exposed Dangerous Method Authentication Bypass Vulnerability

The SolarWinds Access Rights Manager was found to be susceptible to an authentication bypass vulnerability. This vulnerability allows an unauthenticated user to gain domain admin access within the Active Directory environment...

CVE-2024-6660

The BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the bookingpressimportdatacontinueprocessfunc function in all...