CVE-2024-28025

Three OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router 2.10.5. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these...

CVE-2024-28027

Three OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router 2.10.5. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these...

CVE-2024-28026

Three OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router 2.10.5. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these...

CVE-2024-11388

The Dino Game – Embed Google Chrome Dinosaur Game in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dino-game' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attribute...

CVE-2024-10898

The Contact Form 7 Email Add on plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9 via the cf7emailaddonaddadmintemplate function. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute...

PT-2024-16541 · WordPress · The Theme Builder For Elementor

Name of the Vulnerable Software and Affected Versions: The Theme Builder For Elementor plugin for WordPress versions up to, and including, 1.2.2 Description: The issue allows authenticated attackers with Contributor-level access and above to extract data from private or draft posts created by...

PT-2024-22220 · Unknown · Mc Lr Router

Name of the Vulnerable Software and Affected Versions: MC LR Router version 2.10.5 Description: The issue concerns OS command injection vulnerabilities in the web interface I/O configuration functionality. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can...

PT-2024-19054 · Unknown · Mc Lr Router

Name of the Vulnerable Software and Affected Versions: MC LR Router version 2.10.5 Description: An OS command injection vulnerability exists in the web interface configuration upload functionality. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an...

WordPress Grid View Gallery plugin <= 1.0 - Authenticated (Editor+) PHP Object Injection vulnerability

Authenticated Editor+ PHP Object Injection vulnerability discovered by Francesco Carlucci in WordPress Plugin Grid View Gallery versions = 1.0...

WordPress SuevaFree Essential Kit plugin <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zakaria in WordPress Plugin SuevaFree Essential Kit versions = 1.1.3...

WordPress Include Mastodon Feed plugin <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin Include Mastodon Feed versions = 1.9.5...

CVE-2024-10126

Local File Inclusion vulnerability in M-Files Server in versions before 24.11 excluding 24.8 SR1, 24.2 SR3 and 23.8 SR7 allows an authenticated user to read server local files of a limited set of filetypes via document preview...

PT-2024-16594 · WordPress · Sirv

Name of the Vulnerable Software and Affected Versions: The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress versions up to, and including, 7.3.0 Description: The issue is related to insufficient validation on the filename parameter of the sirv upload file by chunks function, allowing...

PT-2024-22850 · Kasda · Kasda Linksmart Router Kw6512

Name of the Vulnerable Software and Affected Versions: Kasda LinkSmart Router KW6512 versions = v1.3 Description: The issue is related to Multiple OS Command Injection vulnerabilities. An authenticated remote attacker can execute arbitrary OS commands via various cgi parameters. Recommendations:...

PT-2024-16091 · WordPress · Beds24 Online Booking

Name of the Vulnerable Software and Affected Versions: Beds24 Online Booking plugin for WordPress versions up to, and including, 2.0.26 Description: The issue is related to Stored Cross-Site Scripting via the plugin's beds24-link shortcode due to insufficient input sanitization and output escapin...

Drupal core 8.0.0-10.2.10,10.3.0-10.3.8,11.0.0-11.0.7 - Authenticated Broken Access Control vulnerability

Authenticated Broken Access Control vulnerability discovered by Wayne Eaker in WordPress Core Drupal versions 8.0.0-10.2.10,10.3.0-10.3.8,11.0.0-11.0.7...

PT-2024-16799 · M Files · M-Files Aino

Name of the Vulnerable Software and Affected Versions: M-Files Aino versions prior to 24.10 Description: The issue is related to improper access control, allowing an authenticated user to access object information due to an incorrect calculation of effective permissions. Recommendations: For...

WordPress Parallax Image plugin <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via position Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via position Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Parallax Image versions = 1.9...

IBM Concert 安全漏洞

IBM Concert is a new tool from International Business Machines IBM, Inc. that uses generative AI to help manage complex cloud-native applications. A security vulnerability exists in versions prior to IBM Concert 1.0.3, which stems from allowing authenticated users to access sensitive information...

PT-2024-35493 · Veritas · Veritas Enterprise Vault

Name of the Vulnerable Software and Affected Versions: Veritas Enterprise Vault versions prior to 15.1 UPD882911 Description: An issue allows an authenticated remote attacker to inject a parameter into an HTTP request, enabling Cross-Site Scripting XSS while viewing archived content. This could...