CVE-2024-5325

The Form Vibes plugin for WordPress is vulnerable to SQL Injection via the ‘fvexportdata’ parameter in all versions up to, and including, 1.4.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

PT-2024-28895 · Seacms · Seacms

Name of the Vulnerable Software and Affected Versions: SeaCMS version 12.9 Description: The issue is caused by the admin smtp.php file directly splicing and writing user input data into weixin.php without processing it. This allows authenticated attackers to execute arbitrary commands and obtain...

WordPress Feeds for YouTube (YouTube video, channel, and gallery plugin) plugin <= 2.2.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ DOM-Based Stored Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Plugin Feeds for YouTube versions = 2.2.1...

WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via sonaaraudioplayer Shortcode vulnerability discovered by wesley wcraft in WordPress Plugin MP3 Audio Player for Music, Radio & Podcast by Sonaar versions = 5.5...

WordPress UltraAddons Elementor Lite plugin <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Multiple Widgets vulnerability discovered by stealthcopter in WordPress Plugin UltraAddons Elementor Lite versions = 1.1.6...

CVE-2024-4866

The UltraAddons – Elementor Addons Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.1.6 due to insufficient input...

PT-2024-37158 · WordPress · Houzez Crm

Name of the Vulnerable Software and Affected Versions: Houzez CRM plugin for WordPress versions up to, and including, 1.4.2 Description: The issue is related to time-based SQL Injection via the notes belong to parameter due to insufficient escaping on the user-supplied parameter and lack of...

PT-2024-15190 · WordPress · Advanced File Manager Shortcodes

Name of the Vulnerable Software and Affected Versions: Advanced File Manager Shortcodes plugin for WordPress versions up to, and including, 2.5.3 Description: The issue allows authenticated attackers with contributor access or above to upload arbitrary files on the affected site's server, which m...

CVE-2024-35154

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote authenticated attacker, who has authorized access to the administrative console, to execute arbitrary code. Using specially crafted input, the attacker could exploit this vulnerability to execute arbitrary code on the system. IBM...

WordPress Comment Images Reloaded plugin <= 2.2.1 - Authenticated (Subscriber+) Arbitrary Media Deletion vulnerability

Authenticated Subscriber+ Arbitrary Media Deletion vulnerability discovered by Lucio Sá in WordPress Plugin Comment Images Reloaded versions = 2.2.1...

CVE-2024-4868

The Extensions for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's EE Events and EE Flipbox widgets in all versions up to, and including, 2.0.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

WordPress Extensions for Elementor plugin <= 2.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via EE Events and EE Flipbox Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via EE Events and EE Flipbox Widget vulnerability discovered by stealthcopter in WordPress Plugin Extensions for Elementor versions = 2.0.32...

WordPress Unlimited Elements For Elementor plugin <= 1.5.112 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'username' vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'username' vulnerability discovered by shaman0x01 in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 1.5.112...

PT-2024-33162 · WordPress · Wpbits Addons For Elementor Page Builder

Name of the Vulnerable Software and Affected Versions: WPBITS Addons For Elementor Page Builder plugin for WordPress versions up to, and including, 1.5 Description: The issue is related to Stored Cross-Site Scripting via several widgets due to insufficient input sanitization and output escaping o...

SAP Enable Now Code Issue Vulnerability

SAP Enable Now is a suite of collaborative content creation, management and sharing platforms from SAP, a German company. The platform is primarily used for online learning and training in SAP and non-SAP systems, among others. SAP Enable Now suffers from a code issue vulnerability that stems fro...

SAP PDCE 安全漏洞

SAP PDCE is a solution from SAP Germany. It is designed to help companies manage and optimize the process of integrating and enriching personal data. SAP PDCE suffers from an authorization issue vulnerability that stems from not performing the necessary authorization checks on authenticated users...

PT-2024-36389 · WordPress · Panda Video

Name of the Vulnerable Software and Affected Versions: Panda Video plugin for WordPress versions up to, and including, 1.4.0 Description: The issue is related to Stored Cross-Site Scripting via the id parameter due to insufficient input sanitization and output escaping. This allows authenticated...

PT-2024-7922 · Siemens · Sinema Remote Connect Server

Name of the Vulnerable Software and Affected Versions: SINEMA Remote Connect Server versions prior to V3.2 SP1 Description: The issue is related to insufficient checking of unusual or exceptional states in the web interface of the SINEMA Remote Connect Server. This can be exploited by a remote...

CVE-2024-31897

IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2, 23.0.1, and 23.0.2 vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the...

PT-2024-28547 · Pdce · Pdce

Name of the Vulnerable Software and Affected Versions: PDCE affected versions not specified Description: The issue is related to missing authorization checks for authenticated users in PDCE, allowing an attacker to escalate privileges and read sensitive information. This results in a high impact ...