CVE-2023-7073

The CVE-2023-7073 entry concerns the WordPress plugin Auto Featured Image (Auto Post Thumbnail) prior to or including version 4.0.0. It is exposed to Server-Side Request Forgery via the upload_to_library AJAX action, enabling authenticated attackers with author-level access and above to trigger w...

CVE-2024-5565

CVE-2024-5565 concerns the Vanna.AI library (Python) where prompt injection in the library’s ask API, with visualize set to True, can execute arbitrary Python code on the host, enabling remote code execution. The vulnerability arises from insufficient input validation in the prompt generation tha...

CVE-2024-31908

IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

CVE-2024-31907

IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 289889...

CVE-2024-31907

CVE-2024-31907 affects IBM Planning Analytics Local (Workspace) Web UI in versions 2.0 and 2.1, allowing an attacker to embed arbitrary JavaScript and potentially disclose credentials within a trusted session. The root cause is a cross-site scripting vulnerability in the Web UI. The impact descri...

CVE-2024-31908

Summary: CVE-2024-31908 affects IBM Planning Analytics Local (IBM Planning Analytics Workspace) versions 2.0 and 2.1 with a stored cross-site scripting vulnerability in the Web UI that could allow embedding arbitrary JavaScript and potentially disclose credentials within a trusted session. Detail...

CVE-2024-31889

CVE-2024-31889 affects IBM Planning Analytics Local (IBM Planning Analytics Workspace) versions 2.0 and 2.1. The vulnerability is a cross-site scripting flaw in the Web UI that allows embedding arbitrary JavaScript, potentially altering functionality and leading to credentials disclosure within a...

CVE-2024-5484

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2024-5538

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2024-22338

IBM Security Verify Access OIDC Provider versions 22.09–23.03 are affected by an input validation vulnerability (hazardous input validation) that could disclose sensitive information to a local user. The issue is specific to the OIDC Provider component and enables information disclosure under loc...

CVE-2024-5347

The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'arrow' attribute within the plugin's Post Navigation widget in all versions up to, and including, 3.10.9 due to insufficient input sanitization and output escaping on user supplied attributes...

CVE-2024-5525

Improper privilege management vulnerability in Astrotalks affecting version 10/03/2023. This vulnerability allows a local user to access the application as an administrator without any provided credentials, allowing the attacker to perform administrative actions...

CVE-2024-5523

CVE-2024-5523 affects Astrotalks and describes an SQL injection flaw in the searchString parameter, exploitable by an authenticated local user. The vulnerability could allow retrieval of all information stored in the database. Details indicate the issue affects Astrotalks as of 10/03/2023; no rem...

CVE-2024-5427

The WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Reservation Form shortcode in all versions up to, and including, 2.2.24 due to insufficient input sanitization and outp...

CVE-2024-4379

The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Global Tooltip widget in all versions up to, and including, 4.10.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo...

CVE-2024-4469

The WP STAGING WordPress Backup Plugin WordPress plugin before 3.5.0 does not prevent users with the administrator role from pinging conducting SSRF attacks, which may be a problem in multisite configurations...

CVE-2024-36246

Missing authorization vulnerability exists in Unifier and Unifier Cast. If this vulnerability is exploited, arbitrary code may be executed with LocalSystem privilege. As a result, a malicious program may be installed, data may be altered or deleted...

CVE-2024-23847

Incorrect default permissions issue exists in Unifier and Unifier Cast. If this vulnerability is exploited, arbitrary code may be executed with LocalSystem privilege. As a result, a malicious program may be installed, data may be altered or deleted...

CVE-2024-5418

The DethemeKit For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slitems' attribute within the plugin's De Product Tab & Slide widget in all versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-5345

CVE-2024-5345 affects the WordPress plugin Responsive Owl Carousel for Elementor. The vulnerability is a Local File Inclusion (LFI) in all versions up to 1.2.0, exploitable via the layout parameter. Authenticated attackers with Contributor-level access and above can cause the server to include an...