CVE-2024-5241

CVE-2024-5241 affects Huashi Private Cloud CDN Live Streaming Acceleration Server (up to 20240520). The vulnerability is in an unknown function of the file /manager/ipconfig_new.php, where manipulation of the dev argument leads to OS command injection. It can be exploited remotely, and the exploi...

CVE-2024-5240

The CVE-2024-5240 entry pertains to Campcodes Complete Web-Based School Management System v1.0, with a SQL injection in the /view/unread_msg.php file caused by manipulating the my_index argument. Multiple connected sources confirm remote exploitation and public disclosure of the exploit. Concrete...

CVE-2024-4347

The WP Fastest Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.2.6 via the specificDeleteCache function. This makes it possible for authenticated attackers to delete arbitrary files on the server, which can include wp-config.php files of the...

CVE-2024-4399

The does not validate a parameter before making a request to it, which could allow unauthenticated users to perform SSRF attack...

CVE-2024-4388

This does not validate a path generated with user input when downloading files, allowing unauthenticated user to download arbitrary files from the server...

CVE-2024-3918

The Pet Manager WordPress plugin through 1.4 does not sanitise and escape some of its Pet settings, which could allow high privilege users such as Contributor to perform Stored Cross-Site Scripting attacks...

CVE-2024-3917

The Pet Manager WordPress plugin through 1.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-3594

The IDonate WordPress plugin through 1.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-4399

The WordPress CAS Theme (≤ 1.0.0) is affected by an SSRF vulnerability. The CVE-2024-4399 entry notes an SSRF flaw where a parameter is not validated before making a request, enabling unauthenticated SSRF. Nuclei/Nuclei templates specify SSRF via the get_remote_data.php script with a vulnerable u...

CVE-2024-4388

CVE-2024-4388 affects the WordPress CAS plugin (versions <= 1.0.0). The vulnerability arises from a failure to validate a user-supplied path when downloading files, enabling an unauthenticated attacker to download arbitrary server files via endpoints like download.php?path=.... Several connect...

CVE-2024-3917

CVE-2024-3917 relates to the WordPress plugin Pet Manager, affected up to version 1.4. The issue is a Reflected XSS caused by not sanitising and escaping a parameter before echoing it on the page, potentially impacting admin users. Public sources consistently describe the vulnerability and its el...

CVE-2024-5238

CVE-2024-5238 affects Campcodes Complete Web-Based School Management System 1.0. The vulnerability is an SQL injection in an unknown part of /view/timetable_insert_form.php triggered by manipulating the grade parameter. It can be exploited remotely and has publicly disclosed exploit information (...

CVE-2024-5236

CVE-2024-5236 affects Campcodes Complete Web-Based School Management System 1.0. The vulnerability is an SQL injection in the file /view/teacher_salary_invoice1.php triggered by manipulating the date parameter. It is exploitable remotely, and public exploit information exists. Affected component ...

CVE-2024-5233

CVE-2024-5233 affects Campcodes Complete Web-Based School Management System 1.0. The issue is an SQL injection caused by manipulation of the index argument in the file /view/teacher_salary_details3.php. The vulnerability can be triggered remotely and the exploit has been disclosed publicly. The c...

CVE-2024-3201

The WP DSGVO Tools GDPR plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pplink' shortcode in all versions up to, and including, 3.1.32 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

CVE-2023-6844

CVE-2023-6844 affects the iframe WordPress plugin (all versions up to 5.0) and is a Stored Cross-Site Scripting vulnerability via shortcode attributes. The issue arises from insufficient input sanitization and output escaping, allowing authenticated attackers with contributor-level permissions to...

CVE-2024-29853

An authentication bypass vulnerability in Veeam Agent for Microsoft Windows allows for local privilege escalation...

CVE-2024-29850

Veeam Backup Enterprise Manager allows account takeover via NTLM relay...

CVE-2024-22026

A local privilege escalation vulnerability in EPMM before 12.1.0.0 allows an authenticated local user to bypass shell restriction and execute arbitrary commands on the appliance...

CVE-2024-22026

CVE-2024-22026 is a local privilege-escalation flaw in Ivanti EPMM (MobileIron Core) prior to 12.1.0.0. The root cause is inadequate validation in the software-update CLI, which can fetch an unverified RPM from a remote URL and execute it with root privileges, enabling arbitrary code execution. A...