CVE-2024-4695

Move Addons for Elementor (WordPress) - CVE-2024-4695: Stored XSS in multiple widgets due to insufficient input sanitization/output escaping for user-supplied attributes. Affected all versions up to 1.3.1. Exploitation requires contributor-level+ authentication to inject scripts that execute when...

Exploit for Use of Hard-coded Credentials in Dlink Dns-320L_Firmware

Dinkleberry 🫐 Are you one of the 92,000+ people1 stuck with a...

CVE-2024-4566

CVE-2024-4566 affects ShopLentor – WooCommerce Builder for WordPress. Wordfence and Red Hat entries confirm a missing capability check in ajax_dismiss across all versions

CVE-2024-4710

The UberMenu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ubermenu-col, ubermenumobileclosebutton, ubermenutoggle, ubermenu-search shortcodes in all versions up to, and including, 3.8.2 due to insufficient input sanitization and output escaping on user suppli...

CVE-2024-4710

CVE-2024-4710 – UberMenu (WordPress) is a stored cross‑site scripting vulnerability in UberMenu shortcodes (ubermenu-col, ubermenu_mobile_close_button, ubermenu_toggle, ubermenu-search) affecting all versions up to 3.8.2. The issue arises from insufficient input sanitization and output escaping o...

CVE-2024-4372

CVE-2024-4372 affects the Carousel Slider WordPress plugin (versions before 2.2.11). The issue is a stored XSS risk due to inadequate sanitization/escaping of certain parameters, exploitable by users with as little as Editor privileges. The Red Hat and Patchstack records corroborate the same vuln...

CVE-2024-4061

CVE-2024-4061 affects the Survey Maker WordPress plugin prior to 4.2.9. It fails to sanitize/escape certain plugin settings, enabling stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed. A fix is available in 4.2.9+; upgrading is recommended. If upgrading isn...

CVE-2024-3155

The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 2.2.80 due to insufficient input sanitization and output escaping...

CVE-2024-35056

CVE-2024-35056 affects NASA AIT-Core v2.5.2 with multiple SQL injection vulnerabilities in the query_packets and insert functions. The issue is documented across multiple sources (Red Hat, GHSA, OSV, NVD/CVE, and PT-Security) with a high-severity CVSS v3.1 base score of 9.8 (Critical) and network...

CVE-2024-35057

NASA AIT-Core v2.5.2 is affected by CVE-2024-35057, with the issue allowing arbitrary code execution via a crafted packet. The advisory sources from NVD/Red Hat/GHSA/osv indicate the vulnerability resides in the NASA AIT-Core component and implies a high-impact scenario (base CVSS v3.1: 7.5, high...

CVE-2024-35059

CVE-2024-35059 affects NASA AIT-Core v2.5.2 and its Pickle-based processing. Red Hat entries describe an unencrypted network channel enabling a man-in-the-middle, which when chained with CVE-2024-35059 results in unauthenticated, fully remote code execution. The core issue is the use of Pickle wi...

CVE-2024-35058

CVE-2024-35058 affects NASA AIT-Core v2.5.2. The issue is in the API wait function and allows an attacker to execute arbitrary code by supplying a crafted string. This is documented across Red Hat, GHSA, OSV, NVD, and CVE records, all referencing the same vulnerability in NASA AIT-Core v2.5.2. Th...

CVE-2024-35191

CVE-2024-35191 affects the verbb/formie Craft CMS plugin. Before version 2.1.6, users who can access a form’s settings could insert malicious Twig code into fields that support Twig (e.g., Submission Title or Success Message). The injected Twig could be executed when a submission is created or wh...

CVE-2024-31714

Buffer Overflow vulnerability in Waxlab wax v.0.9-3 and before allows an attacker to cause a denial of service via the Lua library component...

CVE-2024-29651

A Prototype Pollution issue in API Dev Tools json-schema-ref-parser v.11.0.0 and v.11.1.0 allows a remote attacker to execute arbitrary code via the bundle, parse, resolve, dereference functions...

CVE-2023-49334

Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while exporting a full summary report...

CVE-2023-49335

CVE-2023-49335 affects Zoho ManageEngine ADAudit Plus before build 7271. The issue is a SQL injection vulnerability when obtaining file server details, as documented across multiple sources. Impact is stated as high, with potential disclosure/integrity/availability concerns for affected installat...

CVE-2023-49334

Zoho ManageEngine ADAudit Plus is vulnerable prior to build 7271 due to an SQL Injection in the full summary report export. Affected component: ADAudit Plus report export. Impact: potential unauthorized data disclosure and modification (high), in line with CVSS metrics. Root cause: improper input...

CVE-2023-49333

CVE-2023-49333 affects Zoho ManageEngine ADAudit Plus versions below 7271, where the dashboard graph feature is vulnerable to SQL injection due to insufficient input handling. This could enable unauthorized access to data or manipulation via the dashboard graph component. A fixed version is 7271;...

CVE-2023-49331

CVE-2023-49331 concerns Zoho ManageEngine ADAudit Plus, with versions below 7271 affected by SQL injection in the aggregate reports search option. The vulnerability description across sources consistently states that the issue allows injection through user-controllable input in the aggregate repo...