PT-2024-36516

Name of the Vulnerable Software and Affected Versions Slideshow Gallery LITE plugin for WordPress versions up to, and including, 1.8.1 Description The issue allows authenticated attackers with Contributor-level access and above to perform time-based SQL Injection via the id parameter due to...

PT-2024-27176 · Unknown · Boelter Blue System Management

Name of the Vulnerable Software and Affected Versions: Boelter Blue System Management version 1.3 Description: The issue allows a remote attacker to execute arbitrary code and obtain sensitive information. This is achieved via the id parameter to "news details.php" and "location details.php", and...

Cab Management System SQL Injection Vulnerability

Cab Management System is a cab management system. A SQL injection vulnerability exists in Cab Management System version 1.0, which originates from an unknown section in /cms/classes/Users.php that leads to SQL injection via the parameter id...

Employee and Visitor Gate Pass Logging System SQL Injection Vulnerability

Employee and Visitor Gate Pass Logging System is an employee and visitor pass logging system developed by Carlo Montero. An SQL injection vulnerability exists in Employee and Visitor Gate Pass Logging System version 1.0 due to an unknown part of the deleteusers function in /classes/Users.php, whi...

CVE-2024-5543: Improper Neutralization of Special Elements used in an SQL Command

The Slideshow Gallery LITE plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter in all versions up to, and including, 1.8.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...

CVE-2024-5896: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability, which was classified as critical, was found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. Affected is the function saveusers of the file /classes/Users.php?f=save. The manipulation of the argument id leads to sql injection. It is possible to launch the atta...

PT-2024-37141 · Unknown · Itsourcecode Vehicle Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Vehicle Management System version 1.0 Description: A critical issue was found in the SourceCodester Vehicle Management System, affecting some unknown functionality of the file updatebill.php. The manipulation of the id argument...

CVE-2024-5638

The Formula theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in the 'ticustomizernotifydismissrecommendedplugins' AJAX action in all versions up to, and including, 0.5.1 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2024-5638: Improper Neutralization of Input During Web Page Generation

The Formula theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in the 'ticustomizernotifydismissrecommendedplugins' AJAX action in all versions up to, and including, 0.5.1 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2024-5613: Improper Neutralization of Input During Web Page Generation

The Formula theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in the 'qualitycustomizernotifydismissaction' AJAX action in all versions up to, and including, 0.5.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-4902

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the ‘courseid’ parameter in all versions up to, and including, 2.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existi...

PT-2024-36809 · WordPress · Formula Theme

Name of the Vulnerable Software and Affected Versions: Formula theme for WordPress versions up to, and including, 0.5.1 Description: The issue is related to Reflected Cross-Site Scripting via the id parameter in the "ti customizer notify dismiss recommended plugins" AJAX action. This is due to...

PT-2024-36720 · WordPress · Formula

Name of the Vulnerable Software and Affected Versions: The Formula theme for WordPress versions up to, and including, 0.5.1 Description: The issue is related to Reflected Cross-Site Scripting via the id parameter in the 'quality customizer notify dismiss action' AJAX action due to insufficient...

CVE-2024-4890 Blind SQL Injection in berriai/litellm

A blind SQL injection vulnerability exists in the berriai/litellm application, specifically within the '/team/update' process. The vulnerability arises due to the improper handling of the 'userid' parameter in the raw SQL query used for deleting users. An attacker can exploit this vulnerability b...

CVE-2024-5161

The Magical Addons For Elementor Header Footer Builder, Free Elementor Widgets, Elementor Templates Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.1.39 due to insufficient input sanitization and output...

CVE-2024-5152

The ElementsReady Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 6.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-4608

The SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.9.8 due to insufficient input sanitization and output escaping. This makes it...

WordPress SellKit plugin <= 1.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via id Parameter vulnerability discovered by stealthcopter in WordPress Plugin SellKit versions = 1.9.8...

PT-2024-36418 · Lunary Ai · Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary version 1.2.7 Description: A Cross-site Scripting XSS issue exists due to the application's failure to escape or validate the orgId parameter supplied by the user before incorporating it into the generated response. The...

CVE-2024-4608: Improper Neutralization of Input During Web Page Generation

The SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.9.8 due to insufficient input sanitization and output escaping. This makes it...