CVE-2024-5406

CVE-2024-5406 affects WinNMP 19.02, where an XSS flaw exists in the index page via the from, subject, text, and hash parameters. A remote attacker could send a specially crafted query to an authenticated user, potentially stealing session details. The NVD entry lists CVSSv3.1: AV:N/AC:L/PR:N/UI:R...

CVE-2023-6349

CVE-2023-6349 (libvpx) describes a heap overflow when VP9 encodes frames wider than the configured size. Connected advisories/plugins confirm libvpx is affected in multiple Linux distributions (e.g., Amazon Linux 2/3, MiracleLinux, TencentOS Server) and commonly reference upgrading to libvpx 1.13...

CVE-2024-26289

Deserialization of Untrusted Data vulnerability in PMB Services PMB allows Remote Code Inclusion.This issue affects PMB: from 7.5.1 before 7.5.6-2, from 7.4.1 before 7.4.9, from 7.3.1 before 7.3.18...

CVE-2024-26289

The CVE-2024-26289 issue is a Deserialization of Untrusted Data vulnerability in PMB Services PMB that enables Remote Code Inclusion. Concrete details from connected documents: affected PMB versions are 7.3.1–7.3.18, 7.4.1–7.4.9, and 7.5.1–7.5.6-2. Root cause is deserialization of untrusted data....

CVE-2024-4532

The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions such as deleting cards via CSRF attacks...

CVE-2024-4531

The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions such as editing cards via CSRF attacks...

CVE-2024-4533

The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admin users to perform SQL injection attacks...

CVE-2024-4532

CVE-2024-4532 concerns the WordPress plugin “Business Card” (≤1.0.0) by Esterox. The issue is a CSRF vulnerability due to missing CSRF checks in certain actions, which could allow an attacker to cause logged-in users to delete cards via CSRF. Public sources identify the affected software and desc...

CVE-2024-4531

CVE-2024-4531: The WordPress Business Card plugin (

CVE-2024-4533

CVE-2024-4533 affects the KKProgressbar2 Free WordPress plugin up to version 1.1.4.2, where an unsanitized parameter is used directly in a SQL statement, enabling admin users to perform SQL injection. The connected documents confirm the issue but do not provide a remediation version or patch deta...

CVE-2024-4535

CVE-2024-4535 : The WordPress plugin KKProgressbar2 Free (versions

CVE-2024-4534

CVE-2024-4534 affects KKProgressbar2 Free WordPress plugin (versions

CVE-2024-4530

CVE-2024-4530 concerns the WordPress plugin “Business Card” up to version 1.0.0, which lacks CSRF checks in several areas. The public records state this could enable attackers to induce logged-in users to perform actions such as editing card categories via CSRF attacks. Technical details from con...

CVE-2024-4529

CVE-2024-4529 affects the WordPress Business Card plugin (

CVE-2024-5400

CVE-2024-5400 affects Openfind Mail2000, where a CGI parameter handling vulnerability enables OS command injection. Multiple sources describe that remote attackers with regular privileges can exploit improper filtering of specific CGI parameters to execute arbitrary system commands on the remote ...

CVE-2024-35291

Cross-site scripting vulnerability exists in Splunk Config Explorer versions prior to 1.7.16. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is using the product...

CVE-2024-35291

Splunk Config Explorer contains a reflected XSS (CWE-79) in versions prior to 1.7.16. The issue arises from inadequate protection of the web page structure, allowing an arbitrary script to run in the victim’s browser when exploited. Affected: Splunk Config Explorer

CVE-2024-5396

The CVE-2024-5396 entry concerns itsourcecode Online Student Enrollment System 1.0, with a SQL injection in the file newfaculty.php. The vulnerability arises from manipulation of the name parameter, enabling remote exploitation. Multiple connected records corroborate this issue across CVE databas...

CVE-2024-5393

CVE-2024-5393 affects the itsourcecode Online Student Enrollment System 1.0. A SQL injection vulnerability exists in the file listofcourse.php where altering the parameter idno enables remote exploitation. Exploitation is publicly disclosed. The vulnerability impacts confidentiality, integrity, a...

CVE-2024-30658

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability...