CVE-2024-6789

A path traversal issue in API endpoint in M-Files Server before version 24.8.13981.0 and LTS 24.2.13421.15 SR2 and LTS 23.8.12892.0 SR6 allows authenticated user to read files...

WordPress Image Hotspot by DevVN plugin <= 1.2.5 - Authenticated (Author+) PHP Object Injection vulnerability

Authenticated Author+ PHP Object Injection vulnerability discovered by Lucio Sá in WordPress Plugin Image Hotspot by DevVN versions = 1.2.5...

WordPress RT Easy Builder – Advanced addons for Elementor plugin <= 2.2 - Authenticated (Contributor+) Stored Cross-site Scripting vulnerability

Authenticated Contributor+ Stored Cross-site Scripting vulnerability discovered by Francesco Carlucci in WordPress Plugin RT Easy Builder – Advanced addons for Elementor versions = 2.2...

WordPress Custom Permalinks plugin <= 2.6.0 - Authenticated(Editor+) Stored Cross-Site Scripting vulnerability

AuthenticatedEditor+ Stored Cross-Site Scripting vulnerability discovered by Ram in WordPress Plugin Custom Permalinks versions = 2.6.0...

CVE-2024-5556

Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in reports module...

WordPress Piotnet Addons For Elementor plugin <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Multiple Widgets vulnerability discovered by Webbernaut in WordPress Plugin Piotnet Addons For Elementor versions = 2.4.30...

WordPress File Manager Pro plugin <= 8.3.7 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by siunam in WordPress Plugin File Manager Pro versions = 8.3.7...

PT-2024-27045 · Zohocorp · Zoho Manageengine Adaudit Plus

Name of the Vulnerable Software and Affected Versions: Zohocorp ManageEngine ADAudit Plus versions below 8000 Description: The issue concerns an authenticated SQL injection vulnerability in the alerts module. This vulnerability affects versions of Zohocorp ManageEngine ADAudit Plus below 8000...

PT-2024-27042 · Zohocorp · Zoho Manageengine Adaudit Plus

Name of the Vulnerable Software and Affected Versions: Zohocorp ManageEngine ADAudit Plus versions below 8000 Description: The issue concerns an authenticated SQL injection vulnerability in the file summary option. This vulnerability affects Zohocorp ManageEngine ADAudit Plus. Recommendations:...

CVE-2024-35151

IBM OpenPages with Watson 8.3 and 9.0 could allow authenticated users access to sensitive information through improper authorization controls on APIs...

CVE-2024-5583

The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the carouseldirection parameter of testimonials widget in all versions up to, and including, 5.6.2 due to insufficient input...

PT-2024-36587 · Allegra · Allegra

Name of the Vulnerable Software and Affected Versions: Allegra affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Allegra. Authentication is required to exploit this issue. The specific flaw exists within the...

WordPress WPML Multilingual CMS plugin <= 4.6.12 - Authenticated (Contributor+) Remote Code Execution via Twig Server-Side Template Injection vulnerability

Authenticated Contributor+ Remote Code Execution via Twig Server-Side Template Injection vulnerability discovered by stealthcopter in WordPress Plugin Multilingual CMS versions = 4.6.12...

PT-2024-29716 · Retool · Retool

Name of the Vulnerable Software and Affected Versions: Retool self-hosted enterprise versions 3.18.1 through 3.40.0 Description: The issue allows an authenticated attacker to discover credentials for users with "Use" permissions via the "/api/resources" endpoint. This is due to the insertion of...

Improper Access Control

Overview Affected versions of this package are vulnerable to Improper Access Control due to missing authorization requirements. An authenticated attacker can access unintended endpoints by exploiting the vulnerability. Remediation Upgrade Umbraco.Cms.Api.Management to version 14.1.2 or higher...

CVE-2024-6864 WP Last Modified Info <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via lmt-post-modified-info Shortcode

The WP Last Modified Info plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘template’ attribute of the lmt-post-modified-info shortcode in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping. This makes it possible for...

WordPress Popup Maker plugin <= 1.19.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zer0gh0st in WordPress Plugin Popup Maker versions = 1.19.0...

WordPress BitForm plugin 2.0 - 2.13.9 - Authenticated (Administrator+) SQL Injection via getLogHistory Function vulnerability

WordPress BitForm plugin 2.0 - 2.13.9 - Authenticated Administrator+ SQL Injection via getLogHistory Function vulnerability discovered by siunam in WordPress Plugin Bit Form versions 2.0 - 2.13.9...

WordPress The Plus Addons for Elementor plugin <= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Video Widget vulnerability discovered by João Pedro Soares de Alcântara in WordPress Plugin The Plus Addons for Elementor Page Builder Lite versions = 5.6.2...

CVE-2023-5505

The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.0.1 via the job-specific backup folder. This allows authenticated attackers to store backups in arbitrary folders on the server provided they can be written to by the server. Additionally,...