The vulnerability of the ‘c_only_fields’ parameter in the REST API endpoint /wp-json/learnpress/v1/courses of the LearnPress plugin for the WordPress content management system allows a hacker to execute arbitrary SQL code.

The vulnerability of the ‘conlyfields’ parameter in the REST API endpoint /wp-json/learnpress/v1/courses of the LearnPress plugin for the WordPress content management system is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability could allow a...

CVE-2024-29192

gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to Cross-Site Request Forgery. The /api/config endpoint allows one to modify the existing configuration with user-supplied values. While the API is only allowing localhost to interact without authentication, an...

PT-2025-4740

Name of the Vulnerable Software and Affected Versions RE11S version 1.11 Description RE11S version 1.11 contains a command injection issue through the command parameter at the ''/goform/mp'' API endpoint. This allows for potential unauthorized command execution. Recommendations RE11S version 1.11...

CVE-2024-10044

CVE-2024-10044 describes a Server-Side Request Forgery (SSRF) in the lm-sys/fastchat Controller API Server, affecting the POST /worker_generate_stream endpoint. The vulnerability allows an attacker to misuse the controller API server’s credentials to perform unauthorized web actions or access res...

CVE-2024-11275 WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin <= 1.0.27 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Deletion

The WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the /wp-json/timetics/v1/customers/ REST API endpoint in all versions up to, and including, 1.0.27. This makes...

PT-2023-26695 · Tenda · Tenda Fh1202 +3

Name of the Vulnerable Software and Affected Versions: Tenda F1202 version 1.2.0.9 PA202 version 1.1.2.5 PW201A version 1.1.2.5 FH1202 version 1.2.0.9 Description: A stack overflow issue was discovered via the page parameter at the "/L7Im" API endpoint. This issue affects several Tenda devices...

CVE-2023-28345

An issue was discovered in Faronics Insight 10.0.19045 on Windows. The Insight Teacher Console application exposes the teacher's Console password in cleartext via an API endpoint accessible from localhost. Attackers with physical access to the Teacher Console can open a web browser, navigate to t...

CVE-2022-46383

CVE-2022-46383 affects RackN Digital Rebar up to versions 4.10.8. The vulnerability stems from Incorrect Access Control: a public API endpoint exposes a privileged token that an attacker can use to escalate privileges and gain full administrative access. Exploitation details are not provided in t...

PT-2022-23459 · Unknown · Edoc-Doctor-Appointment-System

Name of the Vulnerable Software and Affected Versions: Edoc-doctor-appointment-system version 1.0.1 Description: The issue is related to a reflected cross-site scripting XSS vulnerability. This vulnerability is located at the "/patient/index.php" API endpoint and allows attackers to execute...