PT-2024-26494 · Vmir · Vmir

Name of the Vulnerable Software and Affected Versions: vmir e8117 Description: A segmentation violation issue was discovered in vmir via the function prepare parse function located at /src/vmir function.c. Recommendations: For vmir e8117, as a temporary workaround, consider disabling the function...

PT-2024-26492 · Unknown · Vmir E8117

Name of the Vulnerable Software and Affected Versions: vmir e8117 version e8117 Description: A heap buffer overflow issue was discovered in vmir e8117 via the wasm parse section functions function at /src/vmir wasm parser.c. This issue occurs due to a heap buffer overflow, which can be exploited...

PT-2024-34573 · Draytek · Draytek Vigor3900

Name of the Vulnerable Software and Affected Versions: Draytek Vigor3900 version 1.5.1.3 Description: The issue allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the reboot function. This enables remote reboot and potentially other...

PT-2024-16507 · Unknown · Phpgurukul Online Shopping Portal

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Shopping Portal version 2.0 Description: A vulnerability was found in the PHPGurukul Online Shopping Portal, allowing for cross-site scripting XSS attacks. The issue is related to an unknown function in the file...

PT-2024-8002 · Lb Link · Lb-Link Bl-Wr 1300H

Name of the Vulnerable Software and Affected Versions: LB-LINK BL-WR 1300H version 1.0.4 Description: The issue is related to hardcoded credentials stored in the /etc/shadow file of the LB-LINK BL-WR 1300H router. These credentials are easily guessable, which could allow a remote attacker to gain...

PT-2024-34578 · Draytek · Draytek Vigor3900

Name of the Vulnerable Software and Affected Versions: DrayTek Vigor3900 version 1.5.1.3 Description: The issue allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the ruequest certificate function. Recommendations: For DrayTek Vigor3900...

PT-2024-24326 · Engenius · Engenius Esr580

Name of the Vulnerable Software and Affected Versions: EnGenius ESR580 A8J-EMR5000 devices affected versions not specified Description: The issue allows a remote attacker to conduct stored XSS attacks, potentially leading to arbitrary JavaScript code execution under the context of the user's...

PT-2024-34628 · Ethereum +1 · Ethereum +1

Name of the Vulnerable Software and Affected Versions: Ethereum version 1.12.2 WaterToken smart contract affected versions not specified Description: An issue in the WaterToken smart contract, which can be run on the Ethereum blockchain, allows remote attackers to have an unspecified impact. The...

PT-2024-16306 · Linzhaoguan · Linzhaoguan Pb-Cms

Name of the Vulnerable Software and Affected Versions: LinZhaoguan pb-cms versions up to 2.0.1 Description: A problematic issue has been found in the Edit Article Handler component, affecting the processing of the file "/adminarticle/edit?id=2". This leads to cross-site scripting, and the attack...

PT-2024-34254 · Unknown · Swoop 1-Click Login: Passwordless Authentication

Name of the Vulnerable Software and Affected Versions: Swoop 1-Click Login: Passwordless Authentication version 1.4.5 Description: The issue is related to an Authentication Bypass by Primary Weakness vulnerability in the Passwordless Authentication feature. This vulnerability allows for...

PT-2024-34241 · Unknown · Wp Seo – Calin Vingan Premium Seo Pack

Name of the Vulnerable Software and Affected Versions: WP SEO – Calin Vingan Premium SEO Pack versions 1.6.001 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection...

CVE-2020-26303

The CVE-2020-26303 entry concerns the insane HTML sanitizer. Affected versions are 2.6.2 and earlier. The underlying issue is a Regular Expression Denial of Service (ReDoS) vulnerability in one or more regular expressions used by the sanitizer. Public documentation indicates that as of publicatio...

PT-2024-10800 · Unknown · Validate.Js

Name of the Vulnerable Software and Affected Versions: Validate.js versions prior to the version released after 30 November 2020 Description: The issue concerns Regular Expression Denial of Service ReDoS due to vulnerable regular expressions in Validate.js. As of the time of publication, it is...

PT-2024-16221 · Unknown · Codezips Sales Management System

Name of the Vulnerable Software and Affected Versions: Codezips Sales Management System version 1.0 Description: A critical issue has been identified, allowing for SQL injection through the manipulation of the prodtype argument in an unknown function of the file /addstock.php. This can be exploit...

PT-2024-33492 · Smartup · Smartup

Name of the Vulnerable Software and Affected Versions: smartUp versions 7.2.622.1170 Description: The issue is a universal cross-site scripting problem that allows another extension to execute arbitrary code in the context of the user’s tab. No known patches exist for this issue. Recommendations:...

PT-2024-33482 · Zimaos · Zimaos

Name of the Vulnerable Software and Affected Versions: ZimaOS versions 1.2.4 and earlier Description: The issue allows authenticated users to perform a directory traversal attack via the API endpoint http:///v2 1/file, enabling access to sensitive system directories such as /etc. This could expos...

PT-2024-16112 · Code Projects · Pharmacy Management System

Name of the Vulnerable Software and Affected Versions: code-projects Pharmacy Management System version 1.0 Description: A problem was discovered in the Pharmacy Management System, affecting some unknown functionality of the file /manage medicine.php of the component Manage Medicines Page. The...

PT-2024-33171 · Sage · Sage 1000

Name of the Vulnerable Software and Affected Versions: Sage 1000 version 7.0.0 Description: A Reflected Cross-Site Scripting issue exists, allowing attackers to inject malicious scripts into URLs. These scripts are reflected back by the server in the response without proper sanitization or...

PT-2024-7364 · Unknown · Laquis Scada

Name of the Vulnerable Software and Affected Versions: LAquis SCADA version 4.7.1.511 Description: A cross-site scripting vulnerability in LAquis SCADA could allow an attacker to inject arbitrary code into a web page, potentially enabling them to steal cookies, redirect users, or perform...

PT-2024-33454 · Unknown · Jiangqie Free Mini Program

Name of the Vulnerable Software and Affected Versions: JiangQie Free Mini Program versions n/a through 2.5.2 Description: The issue allows for the unrestricted upload of files with dangerous types, enabling an attacker to upload a web shell to a web server. This can lead to significant security...