CVE-2024-8584

Orca HCM from LEARNING DIGITAL has an Missing Authentication vulnerability, allowing unauthenticated remote attacker to exploit this functionality to create an account with administrator privilege and subsequently use it to log in...

CVE-2024-8584 LEARNING DIGITAL Orca HCM - Missing Authentication

Orca HCM from LEARNING DIGITAL has an Missing Authentication vulnerability, allowing unauthenticated remote attacker to exploit this functionality to create an account with administrator privilege and subsequently use it to log in...

CVE-2024-8584

CVE-2024-8584 affects Orca HCM by LEARNING DIGITAL and is described as a Missing Authentication vulnerability that allows an unauthenticated remote attacker to create an administrator account and log in. CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base score 9.8) indicates a critical imp...

WordPress Popup Maker Plugin < 1.19.1 is vulnerable to Cross Site Scripting (XSS)

Software Popup Maker Type Plugin Vulnerable versions 1.19.1 Fixed in 1.19.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5561 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 28c13e8e0eab Credits Dmitrii Ignatyev Required...

WordPress Ninja Forms Plugin <= 3.8.11 is vulnerable to Cross Site Scripting (XSS)

Software Ninja Forms Type Plugin Vulnerable versions = 3.8.11 Fixed in 3.8.12 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43999 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID f7b73633135b Credits Joel Indra Required privilege...

WordPress Search Filter Pro Plugin < 2.5.18 is vulnerable to Cross Site Scripting (XSS)

Software Search Filter Pro Type Plugin Vulnerable versions 2.5.18 Fixed in 2.5.18 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6481 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 0f5364627440 Credits Felipe Caon Required...

WordPress Ajax Search Lite Plugin < 4.12.1 is vulnerable to Cross Site Scripting (XSS)

Software Ajax Search Lite Type Plugin Vulnerable versions 4.12.1 Fixed in 4.12.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-7084 Patch priority Low CVSS severity Low 5.9 Developer WPdreams PSID 325c5ede1534 Credits Krugov Artyom Required privile...

WordPress CRM Perks Forms Plugin <= 1.1.3 is vulnerable to Arbitrary File Upload

Software CRM Perks Forms Type Plugin Vulnerable versions = 1.1.3 Fixed in 1.1.4 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-7484 Patch priority Low CVSS severity Low 9.1 Developer Claim ownership PSID c7c64ee12633 Credits István Márton Required privilege...

WordPress Pinpoint Booking System Plugin < 2.9.9.4.8 is vulnerable to Cross Site Scripting (XSS)

Software Pinpoint Booking System Type Plugin Vulnerable versions 2.9.9.4.8 Fixed in 2.9.9.4.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3636 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID b3affda44337 Credits cyc707...

WordPress Request a Quote Plugin < 2.4.1 is vulnerable to Cross Site Scripting (XSS)

Software Request a Quote Type Plugin Vulnerable versions 2.4.1 Fixed in 2.4.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6231 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID f268c6d3e880 Credits Bob Matyas Required...

WordPress WP QuickLaTeX Plugin < 3.8.8 is vulnerable to Cross Site Scripting (XSS)

Software WP QuickLaTeX Type Plugin Vulnerable versions 3.8.8 Fixed in 3.8.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5529 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID f0666acc2d5f Credits Bob Matyas Required privileg...

WordPress Realtyna Organic IDX plugin Plugin <= 4.14.13 is vulnerable to Arbitrary File Upload

Software Realtyna Organic IDX plugin Type Plugin Vulnerable versions = 4.14.13 Fixed in 4.14.14 OWASP Top 10 A6: Security Misconfiguration Classification Arbitrary File Upload CVE CVE-2024-38736 Patch priority Low CVSS severity Low 9.1 Developer Claim ownership PSID 7d42084b6471 Credits Peng Zhou...

CVE-2024-6411

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.8.9. This is due to a lack of validation on user-supplied data in the 'pmuploadimage' AJAX action. This makes it possible for authenticated...

WordPress WP Announcement Plugin <=2.0.8 is vulnerable to Cross Site Scripting (XSS)

Software WP Announcement Type Plugin Vulnerable versions =2.0.8 Fixed in 2.0.9 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-38685 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 6b93ac81fa76 Credits Rayhan Ramdhany Hanaputra Required...

WordPress Spiffy Calendar Plugin <= 4.9.11 is vulnerable to SQL Injection

Software Spiffy Calendar Type Plugin Vulnerable versions = 4.9.11 Fixed in 4.9.12 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-38692 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 21e2115ebd60 Credits Nguyễn Trung Kiên anhchangmutrang Required...

WordPress Plugin Notes Plus Plugin <= 1.2.6 is vulnerable to Cross Site Scripting (XSS)

Software Plugin Notes Plus Type Plugin Vulnerable versions = 1.2.6 Fixed in 1.2.7 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37561 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 1f66e01a6482 Credits justakazh Required privilege...

CVE-2024-38330

IBM System Management for i 7.2, 7.3, and 7.4 could allow a local user to gain elevated privileges due to an unqualified library program call. A malicious actor could cause user-controlled code to run with administrator privilege. IBM X-Force ID: 295227...

CVE-2024-38330 IBM i privilege escalation

IBM System Management for i 7.2, 7.3, and 7.4 could allow a local user to gain elevated privileges due to an unqualified library program call. A malicious actor could cause user-controlled code to run with administrator privilege. IBM X-Force ID: 295227...

WordPress WS Contact Form Plugin <= 1.3.7 is vulnerable to Cross Site Scripting (XSS)

Software WS Contact Form Type Plugin Vulnerable versions = 1.3.7 Fixed in 1.3.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37537 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 9166c1a50a0c Credits younsoung kim, SeoHyeon Lee, MyungJu...

CVE-2024-3123 CHANGING Mobile One Time Password - Arbitrary File Upload

CHANGING Mobile One Time Password's uploading function in a hidden page does not filter file type properly. Remote attackers with administrator privilege can exploit this vulnerability to upload and run malicious file to execute system commands...