CVE-2024-43338

CVE-2024-43338 is a CSRF vulnerability in Crowdsignal Dashboard – Polls, Surveys & more (WordPress plugin Crowdsignal) affecting versions up to and including 3.1.2. The issue permits Cross Site Request Forgery with CVSS v3.1 base score 4.3 (Medium). Connected Patchstack entries classify the vulne...

CVE-2024-51648 WordPress e-shops plugin 1.0.3 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability

Cross-Site Request Forgery CSRF vulnerability in hands01 e-shops e-shops-cart2 allows Reflected XSS.This issue affects e-shops: from n/a through = 1.0.3...

CVE-2024-51648

CVE-2024-51648 describes a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin “e-shops” (e-shops-cart2) version

CVE-2024-50546 WordPress MyOrderDesk plugin <= 3.2.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Riley Magnuson MyOrderDesk myorderdesk allows DOM-Based XSS.This issue affects MyOrderDesk: from n/a through = 3.2.6...

CVE-2024-50546

CVE-2024-50546 affects WordPress MyOrderDesk plugin (≤3.2.6). The issue is a DOM-based XSS arising from improper input neutralization during page generation. Public records (NVD, Red Hat, Patchstack, CVE lists) confirm the vulnerability and indicate a fix exists; remediation is to update to a ver...

CVE-2024-51802

CVE-2024-51802 is a DOM-based XSS vulnerability in the Bread & Butter WordPress plugin (Bread & Butter) affecting versions up to 7.4.857. The issue arises from improper neutralization of input during Web Page Generation, enabling cross-site scripting. Multiple connected sources (e.g., Red Hat adv...

CVE-2024-52435

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Shahjada WPDM – Premium Packages wpdm-premium-packages.This issue affects WPDM – Premium Packages: from n/a through = 6.0.5...

CVE-2024-52435 WordPress Premium Packages – Sell Digital Products Securely plugin <= 5.9.3 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in W3 Eden, Inc. Premium Packages allows SQL Injection.This issue affects Premium Packages: from n/a through 5.9.3...

CVE-2024-52435 WordPress Premium Packages – Sell Digital Products Securely plugin <= 6.0.5 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Shahjada WPDM – Premium Packages wpdm-premium-packages.This issue affects WPDM – Premium Packages: from n/a through = 6.0.5...

Cross-site Scripting (XSS)

Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the servicetype parameter in services.inc.php. PoC Pass in a servicetype parameter value...

Cross-site Scripting (XSS)

Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the hostname parameter in capture.inc.php, when creating a new device. PoC Pass in a...

CVE-2024-52369

Unrestricted Upload of File with Dangerous Type vulnerability in Optimal Access KBucket kbucket allows Upload a Web Shell to a Web Server.This issue affects KBucket: from n/a through = 4.2.2...

CVE-2024-52369 WordPress KBucket plugin <= 4.2.2 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Optimal Access KBucket kbucket allows Upload a Web Shell to a Web Server.This issue affects KBucket: from n/a through = 4.2.2...

CVE-2024-52369

CVE-2024-52369 affects WordPress KBucket plugin versions up to 4.1.6 and is an Unrestricted Upload of File with Dangerous Type vulnerability that allows upload of a web shell to the server. Connected records indicate patched status for KBucket, with fixes in later builds (e.g., 4.2.2+ as per Patc...

JVN#05136799: WordPress Plugin "VK All in One Expansion Unit" vulnerable to cross-site scripting

"Custom Alert Content" of WordPress Plugin "VK All in One Expansion Unit" provided by Vektor,Inc. contains a stored cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the web browser of the user who is accessing the web site using the product. Solution Update...

CVE-2024-10218

XSS Attack in mar.jar, Monitoring Archive Utility MAR Utility, monitoringconsolecommon.jar in TIBCO Software Inc TIBCO Hawk and TIBCO Operational Intelligence...

CVE-2024-10218 TIBCO Hawk Stored-XEE Vulnerability

XSS Attack in mar.jar, Monitoring Archive Utility MAR Utility, monitoringconsolecommon.jar in TIBCO Software Inc TIBCO Hawk and TIBCO Operational Intelligence...

CVE-2024-10218

TIBCO Hawk and TIBCO Operational Intelligence (MAR Utility) are affected by CVE-2024-10218 due to a stored-XEE/XSS vulnerability in mar.jar and monitoringconsolecommon.jar. The issue could allow an attacker to read sensitive files on the host with the server’s privileges. Affected products/versio...

CVE-2024-10217 TIBCO Hawk Stored-XSS Vulnerability

XSS Attack in mar.jar, Monitoring Archive Utility MAR Utility, monitoringconsolecommon.jar in TIBCO Software Inc TIBCO Hawk and TIBCO Operational Intelligence...

CVE-2024-10217

CVE-2024-10217 describes a stored XSS vulnerability in TIBCO Hawk and TIBCO Operational Intelligence, specifically in mar.jar (Monitoring Archive Utility) and monitoringconsolecommon.jar. The advisory details that a malicious .mar file could trigger XSS, potentially allowing an attacker to execut...