CVE-2024-3926

CVE-2024-3926 affects Element Pack Elementor Addons for WordPress (bdthemes-element-pack-lite). Vulnerability: Stored XSS via custom_attributes in widgets, exploitable by authenticated users with Contributor+ on versions

CVE-2024-35556

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/vpsSysdeal.php?mudi=infoSet...

CVE-2024-35558

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/cadeal.php?mudi=rev&nohrefStr=close...

CVE-2024-35551

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/infoWebdeal.php?mudi=add...

CVE-2024-35554

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/infoWebdeal.php?mudi=del&dataType=newsWeb&dataTypeCN...

CVE-2024-35561

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/cadeal.php?mudi=add&nohrefStr=close...

CVE-2024-35557

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/vpsApideal.php?mudi=rev&nohrefStr=close...

CVE-2024-35560

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/cadeal.php?mudi=del&dataType=&dataTypeCN...

CVE-2024-35475

A Cross-Site Request Forgery CSRF vulnerability was discovered in OpenKM Community Edition on or before version 6.3.12. The vulnerability exists in /admin/DatabaseQuery, which allows an attacker to manipulate a victim with administrative privileges to execute arbitrary SQL commands...

CVE-2024-35550

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/infoWebdeal.php?mudi=rev...

CVE-2024-35561

The Net Titanium Technology idcCMS (IDC Cloud Management Agent System) version 1.35 is vulnerable to a Cross-Site Request Forgery (CSRF) . The flaw exists in the /admin/ca_deal.php component, specifically involving the mudi and nohrefStr parameters. This vulnerability allows an attacker to perfor...

CVE-2024-35559

The idccms (Net Titanium IDC Cloud Management Agent System) v1.35 is vulnerable to a Cross-Site Request Forgery (CSRF) . The flaw exists in the /admin/infoMove_deal.php component, specifically involving the mudi and nohrefStr parameters. This vulnerability allows an attacker to trigger unauthoriz...

CVE-2024-35553

The idccms v1.35 cloud management agent system by Net Titanium Technology contains a Cross-Site Request Forgery (CSRF) vulnerability. The flaw is located in the /admin/infoMove_deal.php?mudi=add&nohrefStr=close component, which allows unauthorized requests to be made on behalf of a user. As a tem...

CVE-2024-35551

The idccms v1.35 (Net Titanium IDC Cloud Management Agent System) contains a Cross-Site Request Forgery (CSRF) vulnerability in the /admin/infoWeb_deal.php?mudi=add component. This flaw allows an attacker to perform malicious requests on behalf of a legitimate user. As a temporary workaround, it ...

CVE-2024-35552

The idccms v1.35 (Net Titanium IDC Cloud Management Agent System) is vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability. The flaw is located in the component /admin/infoMove_deal.php and can be triggered using the parameters mudi=del , dataType=logo , and dataTypeCN . This vulnerabil...

CVE-2024-4261

CVE-2024-4261 affects the Responsive Contact Form Builder & Lead Generation Plugin for WordPress, enabling authenticated users with subscriber+ privileges to execute arbitrary shortcodes via improper validation in do_shortcode. The Red Hat entry corroborates the issue and the Wordfence summary no...

CVE-2024-5196

CVE-2024-5196 targets Arris VAP2500 v08.50. A vulnerability in /tools_command.php (parameter cmb_header/txt_command) allows remote command injection. Exploitation is possible remotely; public disclosure noted. No remediation details provided in the supplied documents.

CVE-2024-5194

CVE-2024-5194 affects Arris VAP2500 firmware 08.50. The vulnerability is a command injection in an unknown functionality of the file /assoc_table.php triggered by manipulating the id parameter. It can be exploited remotely and exploit details have been disclosed publicly. The available documents ...

CVE-2024-4362

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'siteoriginwidget' shortcode in all versions up to, and including, 1.60.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

CVE-2024-4896

The WPB Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...