CVE-2023-6437

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in TP-Link TP-Link EX20v AX1800, Tp-Link Archer C5v AC1200, Tp-Link TD-W9970, Tp-Link TD-W9970v3, TP-Link VX220-G2u, TP-Link VN020-G2u allows authenticated OS Command Injection. This issue affec...

PT-2024-18367 · WordPress · The Lightbox Slider – Responsive Lightbox Gallery

Name of the Vulnerable Software and Affected Versions: The Lightbox slider – Responsive Lightbox Gallery plugin for WordPress versions up to, and including, 1.9.9 Description: The issue is related to PHP Object Injection via deserialization of untrusted input through post meta data. This allows...

PT-2024-3987 · Ivanti · Ivanti Epm +1

Name of the Vulnerable Software and Affected Versions: Ivanti EPM versions 2022 SU5 and prior Description: The issue is related to an unspecified SQL Injection vulnerability in the Core server of Ivanti EPM, allowing an authenticated attacker within the same network to execute arbitrary code. Thi...

PT-2024-4019 · Ivanti · Ivanti Endpoint Manager

Name of the Vulnerable Software and Affected Versions: Ivanti Endpoint Manager versions prior to 2022 SU5 Description: The issue is related to a SQL Injection vulnerability in the GetVulnerabilitiesDataTable method of Ivanti Endpoint Manager, due to a lack of protection for the SQL query structur...

PT-2024-4015 · Ivanti · Ivanti Endpoint Manager

Name of the Vulnerable Software and Affected Versions: Ivanti Endpoint Manager versions prior to 2022 SU5 Description: The issue is related to a SQL Injection vulnerability in the GetRulesetsSQL method of Ivanti Endpoint Manager, which fails to properly protect the SQL query structure. This allow...

PT-2024-19206 · WordPress · The Plus Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Plus Addons for Elementor plugin for WordPress versions up to, and including, 5.4.1 Description: The issue allows authenticated attackers with contributor-level access and above to include and execute arbitrary files on the server via the...

PT-2024-19164 · WordPress · The Plus Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Plus Addons for Elementor plugin for WordPress versions up to, and including, 5.4.1 Description: The issue allows authenticated attackers with contributor-level access and above to include and execute arbitrary files on the server via the...

PT-2024-22933 · Lepton · Lepton

Name of the Vulnerable Software and Affected Versions: lepton version 7.1.0 Description: The issue allows remote authenticated attackers to execute arbitrary code via uploading a crafted PHP file to the "save.php" and "config.php" components. This enables attackers to potentially gain control ove...

CVE-2024-1326

The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML Tag attributes in all versions up to, and including, 2.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and abo...

Easy Property Listings < 3.5.3 - Authenticated(Contributor+) SQL Injection via Shortcode

Description The Easy Property Listings plugin for WordPress is vulnerable to time-based SQL Injection via the ‘propertystatus’ shortcode attribute in all versions up to, and including, 3.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

GeoServer 安全漏洞

GeoServer is an open source software server written in Java. Allows users to share and edit geospatial data. An arbitrary file upload vulnerability exists in GeoServer versions prior to 2.23.4 and 2.24.1, which stems from the application's lack of effective authentication of uploaded files. An...

UBUNTU-CVE-2024-27930

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can access sensitive fields data from items on which he has read access. This issue has been patched in version 10.0.13...

UBUNTU-CVE-2024-27937

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can obtain the email address of all GLPI users. This issue has been patched in version 10.0.13...

GLPI Security Vulnerabilities

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner and ink...

CVE-2024-1685

The Social Media Share Buttons plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.0 via deserialization of untrusted input through the attachmentUrl parameter. This makes it possible for authenticated attackers, with subscriber-level access and...

CVE-2024-1239

The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the blog post read more button in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2024-17574 · WordPress · Elementskit Elementor Addons

Name of the Vulnerable Software and Affected Versions: ElementsKit Elementor addons plugin for WordPress versions up to, and including, 3.0.4 Description: The issue is related to Stored Cross-Site Scripting via the blog post read more button due to insufficient input sanitization and output...

CVE-2024-1950

The Product Carousel Slider & Grid Ultimate for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.7 via deserialization of untrusted input via shortcode. This makes it possible for authenticated attackers, with contributor access and...

CVE-2024-1452

The GenerateBlocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.2 via Query Loop. This makes it possible for authenticated attackers, with contributor access and above, to see contents of posts and pages in draft or private status ...

CVE-2024-1363

The Easy Accordion – Best Accordion FAQ Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'accordioncontentsource' attribute in all versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping. This makes it possible...