CVE-2024-1363

The Easy Accordion – Best Accordion FAQ Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'accordioncontentsource' attribute in all versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2024-1358

The Elementor Addon Elements plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.12.12 via the render function. This makes it possible for authenticated attackers, with contributor access or higher, to include the contents of arbitrary PHP files on th...

CVE-2024-0896

The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button link parameter in all versions up to, and including, 2.7.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...

PT-2024-2214 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 10.0.13 Description: The issue is related to a SQL injection vulnerability in the search engine of GLPI, a Free Asset and IT Management Software package. An authenticated user can exploit this vulnerability to extract...

PT-2024-16558 · WordPress · The Beaver Builder

Name of the Vulnerable Software and Affected Versions: The Beaver Builder – WordPress Page Builder plugin for WordPress versions up to, and including, 2.7.4.4 Description: The issue is related to Stored Cross-Site Scripting via the heading tag due to insufficient input sanitization and output...

PT-2024-3978

Name of the Vulnerable Software and Affected Versions LenelS2 NetBox versions prior to and including 5.6.1 Description The issue is related to an authenticated remote code execution RCE that allows an attacker to execute malicious commands. It is associated with the injection or modification of...

PT-2024-18293 · WordPress · Play.Ht

Name of the Vulnerable Software and Affected Versions: Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio plugin for WordPress versions up to, and including, 3.6.4 Description: The issue allows authenticated attackers with contributor-level access and above to inject a PHP Object...

PT-2024-18640 · WordPress · Exclusive Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Exclusive Addons for Elementor plugin for WordPress versions up to, and including, 2.6.9 Description: The issue is related to Stored Cross-Site Scripting via the Covid-19 Stats Widget due to insufficient input sanitization and output escaping...

PT-2024-18226 · WordPress · Terawallet

Name of the Vulnerable Software and Affected Versions: The TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds plugin for WordPress versions up to, and including, 1.4.10 Description: The issue allows authenticated attackers with subscriber-level acce...

PT-2024-20298 · Telefonica · Movistar 4G Router

Name of the Vulnerable Software and Affected Versions: Movistar 4G router version ES WLD71-T1 v2.0.201820 Description: The issue is a command injection vulnerability that allows an authenticated user to execute commands inside the router. This can be achieved by making a POST request to the API...

PT-2024-19590 · WordPress · Sky Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Sky Addons for Elementor plugin for WordPress versions up to, and including, 2.4.0 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplied attributes,...

PT-2024-2326 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 10.0.13 Description: The issue is related to insufficient authorization procedure in GLPI, a free asset and IT management software package. This allows an authenticated user to access sensitive fields data from items on...

CVE-2024-1303

Incorrectly limiting the path to a restricted directory vulnerability in Badger Meter Monitool that affects versions up to 4.6.3 and earlier. This vulnerability allows an authenticated attacker to retrieve any file from the device using the download-file functionality...

PT-2024-13434 · WordPress · Ladiapp

Name of the Vulnerable Software and Affected Versions: LadiApp plugin for WordPress versions up to, and including, 4.4 Description: The issue arises from a missing capability check on the publish lp function, which is hooked via an AJAX action. This allows authenticated attackers with...

PT-2024-8898 · Intel · Intel Distribution For Gdb

Name of the Vulnerable Software and Affected Versions: Intel Distribution for GDB versions prior to 2024.0.1 Description: The issue is related to insufficient input validation, which may allow an authenticated user to potentially enable denial of service via local access. Recommendations: For...

CVE-2024-1382

The Restaurant Reservations plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9 via the ndrstlayout attribute of the ndrstsearch shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to include and...

PT-2024-22262 · Schoolbox · Schoolbox

Name of the Vulnerable Software and Affected Versions: Schoolbox versions prior to 23.1.3 Description: The issue concerns stored cross-site scripting in the news functionality, allowing an authenticated attacker to perform security actions in the context of affected users. Recommendations: For...

CVE-2024-20346

A vulnerability in the web-based management interface of Cisco AppDynamics Controller could allow an authenticated, remote attacker to perform a reflected cross-site scripting XSS attack against a user of the interface of an affected device. This vulnerability is due to insufficient validation of...

PT-2024-21795

Name of the Vulnerable Software and Affected Versions ESPHome versions 2023.12.9 through 2024.2.2 Description The issue allows a remote authenticated user to inject arbitrary web script and exfiltrate session cookies via Cross-Site scripting. A malicious authenticated user can inject arbitrary...

CVE-2024-25613

Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system...