CVE-2024-24883

CVE-2024-24883 affects BdThemes Prime Slider – Addons For Elementor (WordPress). Affected versions: up to 3.11.10. Root cause: missing authorization check in bdt_duplicate_as_draft() allows authenticated users with contributor-level access and above to duplicate private/password-protected posts. ...

CVE-2024-25907

CVE-2024-25907 affects WP Media Folder plugin for WordPress (versions

CVE-2024-24850

CVE-2024-24850: Quicksand Post Filter jQuery Plugin (WordPress) <= 3.1.1 has a Missing Authorization vulnerability via quicksand_admin_ajax, allowing unauthenticated access to delete arbitrary site options (Broken Access Control). The CVE is listed with a high risk in WordPress vulnerability f...

CVE-2024-25922

The CVE-2024-25922 entry describes a Missing Authorization vulnerability in the Peach Payments Gateway WordPress plugin (Peach Payments Gateway) affecting versions up to 3.1.9. The root cause is broken access control via peach_core_version_rollback(), allowing unauthorized actions by subscribers ...

CVE-2024-29019

CVE-2024-29019 affects ESPHome’s dashboard API (version 2023.12.9 and prior) and is due to a CSRF flaw that lets a logged-in user’s session perform operations on configuration files if the victim visits a weaponized page. The issue enables bypassing authentication for API calls that manipulate co...

CVE-2024-27966

CVE-2024-27966 is a stored XSS in the WordPress plugin “Quiz And Survey Master” (ExpressTech) affecting versions up to 8.2.2. The root cause is improper neutralization of input during web page generation, enabling stored cross-site scripting when used by authenticated users. Wordfence/RedHat/NVD ...

CVE-2024-27969

CVE-2024-27969 affects the Free Downloads WooCommerce WordPress plugin (Free Downloads WooCommerce) and is a Stored XSS vulnerability. It impacts Free Downloads WooCommerce versions up to 3.5.8.2 and arises from improper input neutralization during web page generation. Public sources in the Conne...

CVE-2024-27988

CVE-2024-27988 affects the WordPress plugin WEN Responsive Columns (

CVE-2024-27991

CVE-2024-27991 affects the WordPress plugin SupportCandy (up to version 3.2.3). The issue is a Stored XSS caused by improper input neutralization during web page generation. Impact is stored XSS on affected pages; patch is available in 3.2.3 (upgrade to 3.2.3 or later). Other sources (Red Hat, NV...

CVE-2024-27992

CVE-2024-27992 is a Reflected XSS in the WordPress plugin Link Whisper Free . Public disclosures indicate the vulnerability affects versions from some unspecified start up to and including 0.6.8, with the issue present in the Free edition and not in Pro as described in sources. Multiple CVE recor...

Microsoft Warns of New Tax Returns Phishing Scams Targeting You

By Waqas About to pay your taxes? Watch out for tax return phishing and malware campaigns targeting individual taxpayers and businesses. This is a post from HackRead.com Read the original post: Microsoft Warns of New Tax Returns Phishing Scams Targeting You...

Online-College-Event-Hall-Reservation-System SQL Injection Vulnerability

Online-College-Event-Hall-Reservation-System is an online college event hall reservation system by Magesh K individual developer. Designed to automate the hall booking process to eliminate manual logging and increase efficiency. Online-College-Event-Hall-Reservation-System suffers from a SQL...

CVE-2024-25651

RESERVED This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...

CVE-2024-25228

RESERVED This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...

CVE-2024-1654

RESERVED This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...

CVE-2024-1221

RESERVED This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...

CVE-2024-26048

Technical details for CVE-2024-26048 are not publicly available in the provided documents. No impacted products, versions, or root cause are specified. Monitor for updates.

CVE-2023-20907

CVE-2023-20907 is listed in the Android 14 security release notes as a high-severity DoS in the Framework component. The Android bulletin groups it among Framework vulnerabilities for Android 14, with reference A-239415997. The document does not provide specific affected product versions beyond A...

CVE-2024-2094

Technical details for CVE-2024-2094 are not publicly available in the provided documents. Monitor for updates as additional information is published.

GHSA-R4FM-G65H-CR54 Mattermost incorrectly allows access individual posts

Mattermost version 8.1.x before 8.1.9 fails to sanitize data associated with permalinks when a plugin updates an ephemeral post, allowing an authenticated attacker who can control the ephemeral post update to access individual posts' contents in channels they are not a member of...