CVE-2024-5590

The CVE-2024-5590 entry concerns Netentsec NS-ASG Application Security Gateway 6.3, where the JSON Content Handler’s file /protocol/iscuser/uploadiscuser.php contains exploitable code. Specifically, manipulation of the messagecontent argument causes SQL injection that can be triggered remotely. T...

CVE-2024-5589

Netentsec NS-ASG Application Security Gateway 6.3 is affected by CVE-2024-5589. The vulnerability targets the file /admin/config_MT.php?action=delete, where manipulation of the Mid parameter yields an SQL injection. The issue is exploitable remotely and has been disclosed publicly. Multiple sourc...

CVE-2023-51219

Summary (CVE-2023-51219) : KakaoTalk 10.4.3 contains a deep link validation issue allowing a remote attacker to direct users to execute attacker-controlled JavaScript within a WebView. A chained WebView trigger can leak an access token in an HTTP header, enabling potential takeover of another use...

CVE-2024-34987

CVE-2024-34987 is a SQL Injection vulnerability in PHPGurukul Online Fire Reporting System 1.2, affecting the ofrs/admin/index.php login flow. The issue allows bypassing authentication by injecting SQL into the username field, potentially exposing database data. Affected component: PHPGurukul Onl...

CVE-2024-5588

The CVE-2024-5588 entry concerns itsourcecode Learning Management System 1.0. The vulnerability affects the file processscore.php, where manipulating the LessonID parameter enables SQL injection. It is exploitable remotely and the exploit has been disclosed publicly. Multiple sources corroborate ...

CVE-2024-36392

The CVE-2024-36392 entry concerns MileSight DeviceHub with a cross-site scripting (CWE-79) weakness caused by improper input neutralization during web page generation. According to the public records, the vulnerability is network-exposed, requires user interaction, and the exploit complexity is l...

CVE-2024-36391

Technical details about CVE-2024-36391 are not publicly available in the provided connected documents; no affected products, versions, impact, or fix details are disclosed here. Monitor for updates.

CVE-2024-36390

Technical details about CVE-2024-36390 (affected components, exploit scenarios, and specific versions) are not publicly available in the provided documents. Monitor for updates.

CVE-2024-36389

The documents identify CVE-2024-36389 as affecting MileSight DeviceHub with CWE-330: Use of Insufficiently Random Values may allow Authentication Bypass. The NVD entry lists a 9.8 CVSS v3.1 score (Network attack, no privileges, high impact on confidentiality, integrity, and availability) and note...

CVE-2024-36388

Technical details (affected product, component, version, root cause, impact, or fix) are not publicly available in the provided documents. Monitor for updates.

CVE-2024-27776

CVE-2024-27776 affects MileSight DeviceHub. The issue is a CWE-22 path traversal vulnerability that may allow unauthenticated remote code execution over the network (no user interaction) with a CVSS v3.1 base score of 9.8 (CRITICAL). Root cause is improper limitation of a pathname to a restricted...

CVE-2024-2178

CVE-2024-2178 affects parisneo/lollms-webui. The path traversal exists in the copy_to_custom_personas endpoint (lollms_personalities_infos.py), allowing crafted values in category and name (e.g., ../ sequences) to read files outside the intended directory. This results in unauthorized access to s...

CVE-2024-5587

CVE-2024-5587 affects Casdoor up to 1.335.0, specifically the Configuration File Handler’s /conf/app.conf. The issue arises from a manipulation of an unknown function in that file, allowing access to files or directories. The vulnerability can be exploited remotely and an exploit has been disclos...

CVE-2024-4344

CVE-2024-4344 concerns the Shield Security – Smart Bot Blocking & Intrusion Prevention Security WordPress plugin. It is vulnerable to Cross-Site Request Forgery in all versions up to and including 19.1.13. The root cause is missing or incorrect nonce validation on the exec function, enabling unau...

CVE-2024-35645

CVE-2024-35645 affects the WordPress plugin Random Banner (versions up to and including 4.2.8). The vulnerability is described as Stored XSS due to Improper Neutralization of Input During Web Page Generation, enabling an attacker with Administrator privileges to inject malicious scripts that coul...

CVE-2024-35646

CVE-2024-35646 refers to a stored XSS vulnerability in the WordPress plugin Smartarget Message Bar. The available sources identify the issue as improper input neutralization during web page generation, allowing stored Cross‑Site Scripting for authenticated users (admin+). Affected versions are li...

CVE-2024-35647

CVE-2024-35647 concerns a Stored XSS in the WordPress Global Notification Bar plugin (vulnerable up to 1.0.1). The vulnerability is triggered via authenticated admin settings, enabling an attacker with Administrator privileges to inject scripts that could execute in contexts accessed by users. Th...

CVE-2024-4148

CVE-2024-4148 affects lunary-ai/lunary version 1.2.10. A ReDoS vulnerability arises when processing crafted regular expressions, leading to high availability impact (response time degradation or crash) as described in NVD/NVD-linked sources. The PT-2024-29418 entry corroborates the affected versi...

CVE-2024-35636

CVE-2024-35636 is a CSRF vulnerability in the Uploadcare File Uploader and Adaptive Delivery (beta) WordPress plugin. Affected versions are up to and including 3.0.11, with mitigation and fix implemented in version 3.1.0. Patch status indicates the issue was addressed in the 3.1.0 release; fixed ...

CVE-2024-3820

wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin (Premium) is affected by an unauthenticated SQL Injection via the id_key parameter of the wdt_delete_table_row AJAX action in versions up to 6.3.1. The root cause is insufficient escaping of the user-supplied parameter and ...