CVE-2024-4318

CVE-2024-4318 (Tutor LMS – WordPress) is a time-based SQL Injection in Tutor LMS up to and including version 2.7.0 via the question_id parameter, caused by insufficient escaping and improper query preparation. Exploitation is possible by authenticated users with Instructor-level permissions and h...

CVE-2024-4635

The vulnerability CVE-2024-4635 affects Menu Icons by ThemeIsle (WordPress plugin). In versions up to 0.13.13, stored cross-site scripting can be triggered via the add_mime_type function due to insufficient input sanitization and output escaping. Exploitation requires authenticated access at auth...

CVE-2024-4945

CVE-2024-4945 affects SourceCodester Best Courier Management System 1.0, targeting the file view_parcel.php. The issue arises from manipulation of the id parameter in an unseen function, enabling unrestricted file upload and enabling remote exploitation. Exploitation details are described across ...

CVE-2024-4933

CVE-2024-4933 affects SourceCodester Simple Online Bidding System 1.0, with a SQL injection in the admin page: /simple-online-bidding-system/admin/index.php?page=manage_product where the parameter id can be manipulated. The vulnerability is exploitable remotely and has been disclosed publicly. Va...

CVE-2024-4931

CVE-2024-4931 affects SourceCodester Simple Online Bidding System 1.0. The vulnerability is in the admin endpoint /simple-online-bidding-system/admin/index.php?page=view_udet, where manipulation of the id parameter leads to SQL injection. Attackers can exploit this remotely, and public disclosure...

CVE-2024-4930

The CVE-2024-4930 entry affects SourceCodester Simple Online Bidding System 1.0, with a SQL injection described in the index.php?page=view_prod endpoint due to manipulation of the id parameter. The vulnerability is remote and has been publicly disclosed, implying potential exploitation vectors, t...

CVE-2024-4928

CVE-2024-4928 affects SourceCodester Simple Online Bidding System v1.0. A SQL injection vulnerability exists in the vulnerable endpoint /simple-online-bidding-system/admin/ajax.php?action=delete_category where manipulating the id parameter can lead to unauthorized data access via SQL injection. E...

CVE-2024-4927

CVE-2024-4927 affects SourceCodester Simple Online Bidding System 1.0. The issue resides in an unknown functionality of the file /simple-online-bidding-system/admin/ajax.php?action=save_product, enabling unrestricted file uploads and allowing remote exploitation. Multiple sources note this as a c...

CVE-2024-4925

CVE-2024-4925 affects SourceCodester School Intramurals Student Attendance Management System v1.0. The vulnerability is in the handling of the file /intrams_sams/manage_course.php, where manipulation of the id parameter enables SQL injection. The issue can be exploited remotely, and public exploi...

CVE-2024-4922

SourceCodester Simple Image Stack Website 1.0 is affected by a Cross-Site Scripting (XSS) issue arising from manipulation of the page parameter. The vulnerability can be triggered remotely, and multiple sources corroborate the issue without detailing a confirmed patch. Remediation guidance in rel...

CVE-2024-4918

CVE-2024-4918 affects Campcodes Online Examination System 1.0. The issue resides in the file updateQuestion.php, where manipulation of the parameter id leads to a SQL injection vulnerability. The vulnerability can be exploited remotely and has been disclosed publicly. Multiple sources corroborate...

CVE-2024-4914

The CVE-2024-4914 entry affects Campcodes Online Examination System 1.0, where the vulnerability lies in ranking-exam.php: the manipulation of the exam_id parameter enables SQL injection. This can be exploited remotely, and public disclosures exist. The connected sources confirm affected software...

CVE-2024-35184

CVE-2024-35184 affects Paperless-ngx before 2.8.6. Evidence from PT-2024-26365 and ongoing CVE records shows that versions 2.5.0 through 2.8.5 expose remote API access via authentication that can be used even when API access is disabled. The root cause per the advisory is improper enforcement of ...

CVE-2024-4913

The CVE-2024-4913 entry concerns Campcodes Online Examination System version 1.0, affecting the file exam.php. The vulnerability arises from manipulation of the id argument, enabling SQL injection. Exploitation appears possible remotely and public disclosure exists. Several connected sources reit...

CVE-2024-4947

The CVE-2024-4947 entry corresponds to a Type Confusion vulnerability in Google Chrome/Chromium V8 that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Affected software is the Chrome/Chromium stack using V8 prior to version 125.0.6422.60. The root c...

CVE-2024-4949

CVE-2024-4949 affects Chromium-based Chrome builds due to a use-after-free in V8 prior to 125.0.6422.60, enabling potential heap corruption via a crafted HTML page. Connected advisories (Debian, Fedora, CHAINGUARD CGR, and vendor advisories) confirm this CVE and indicate updates to Chromium 125.0...

CVE-2024-27243

CVE-2024-27243 describes a buffer overflow in Zoom Workplace Apps and SDKs. The vulnerability affects Zoom’s Workplace components when processing untrusted input, allowing an authenticated user to cause a denial of service over a network connection. The CVSSv3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:...

CVE-2024-4976

CVE-2024-4976 affects Xpdf; an out-of-bounds write occurs in AcroForm field reference due to a missing object type check in Xpdf 4.05 and earlier. Fedora advisories and Slackware/Nessus entries corroborate impact and note remediation by updating to 4.06. Practical impact is an out-of-bounds write...

CVE-2024-4911

CVE-2024-4911 affects Campcodes Complete Web-Based School Management System v1.0. The vulnerability is in /view/student_exam_mark_update_form.php where manipulation of the exam parameter enables SQL injection, admitting remote exploitation. Multiple connected sources confirm the issue without det...

CVE-2024-31409

CVE-2024-31409 affects CyberPower PowerPanel software. The vulnerability arises from insufficient authorization due to MQTT wildcards not being blocked, which could allow an attacker who gains access to any device to read data from across the system. Affected product: PowerPanel (enterprise/busin...