CVE-2024-27202

CVE-2024-27202 is a DOM-based XSS in the BIG-IP Configuration utility. Affected BIG-IP versions include 17.1.0–17.1.1, 16.1.0–16.1.4, and 15.1.0–15.1.10. An attacker can run JavaScript in the context of an authenticated admin session via a malicious page, a control-plane issue with no data-plane ...

CVE-2024-32049

CVE-2024-32049 affects BIG-IP Next Central Manager . Per F5 advisories, an unauthenticated, remote attacker could perform a man-in-the-middle to obtain credentials used by BIG-IP Next LTM/WAF, with a CVSSv3 score of 7.4 (Network, High impact on confidentiality; no availability impact). Vulnerable...

CVE-2024-25560

CVE-2024-25560 affects F5 BIG-IP AFM/TMM: when a DNS profile is applied to a virtual server, undisclosed DNS traffic can cause the Traffic Management Microkernel (TMM) to terminate, leading to DoS. The advisory K000139037 lists affected branches and fixes: BIG-IP (all modules) 17.x (17.1.0 vulner...

CVE-2024-4654

CVE-2024-4654 affects BlueNet Technology Clinical Browsing System v1.2.1. The vulnerability resides in /xds/cloudInterface.php where manipulating the INSTI_CODE parameter triggers SQL injection. Attackers may exploit remotely, and the exploit has been disclosed publicly. Several sources corrobora...

CVE-2024-32980

CVE-2024-32980 affects Spin prior to 2.4.3. Specifically configured Spin applications that use self requests without a URL authority can be induced to make requests to arbitrary hosts via the Host header. Vulnerable conditions include: routing requests based on URL rather than Host while preservi...

CVE-2024-4653

BlueNet Technology Clinical Browsing System 1.2.1 is affected by CVE-2024-4653. The vulnerability targets an unknown functionality in the file /xds/outIndex.php where manipulation of the name parameter enables SQL injection. It can be exploited remotely and a public exploit has been disclosed. No...

CVE-2024-33573

CVE-2024-33573 is a Missing Authorization vulnerability in the WordPress plugin EPROLO Dropshipping (through version 1.7.1). Public documents confirm the issue is caused by missing authorization checks, potentially allowing unauthorized access to restricted areas. The Red Hat advisory and PT-secu...

CVE-2024-33574

CVE-2024-33574 is a Missing Authorization vulnerability in the WordPress plugin Vitepos (appsbd Vitepos). Affected: Vitepos Lite up to 3.0.1. Root cause: missing authorization allowing unauthorized access. Impact details are limited in the provided sources (no explicit exploit data or affected sc...

CVE-2024-4649

CVE-2024-4649 affects Campcodes Complete Web-Based School Management System 1.0, specifically the /view/student_exam_mark_insert_form1.php file. The issue arises from manipulation of the page parameter, enabling cross-site scripting (XSS) and enabling remote exploitation. The vulnerability has be...

CVE-2024-24833

CVE-2024-24833 affects the WordPress plugin Happy Addons for Elementor (Leevio) up to version 3.10.1, caused by broken access control (missing authorization) when cloning posts or adding rows. Patch 3.10.2 fixes the issue. If using this plugin, upgrade to 3.10.2 or later to mitigate the vulnerabi...

CVE-2024-30459

CVE-2024-30459 is a Missing Authorization vulnerability in WordPress plugin AI WP Writer (AIpost AI WP Writer). Public records indicate the issue affects AI WP Writer versions up to 3.6.5. Root cause described as Missing Authorization, with no explicit exploit details in the provided documents. R...

CVE-2024-1438

The CVE-2024-1438 entry concerns the WordPress plugin Rolo Slider (PressFore Ro lo Slider). Technical details in connected docs show a Missing Authorization vulnerability that allows unauthorized changes to settings in Rolo Slider versions up to and including 1.0.9. Public sources consistently de...

CVE-2022-40218

The CVE-2022-40218 entry concerns the WordPress plugin ThemeHunk Advance Product Search (WordPress TH Advance Product Search Plugin), affecting versions 1.1.4 and earlier. The root cause is a missing authorization check that allows an unauthenticated user to change plugin settings, enabling impac...

CVE-2024-34548

CVE-2024-34548 is a Stored XSS in Themesgrove WidgetKit (WidgetKit for Elementor). Affected: WidgetKit versions up to 2.4.8. Root cause: improper neutralization of input during web page generation. Impact: stored cross-site scripting vesting on pages using the widget. Remediation: patch/upgrade t...

CVE-2024-34553

CVE-2024-34553 is a reflected XSS vulnerability in Stockholm Core (WordPress plugin) affecting versions up to 2.4.1. The Red Hat advisory reiterates the same description. Public references (PatchStack listing) confirm the issue is a cross-site scripting flaw triggered during web page generation. ...

CVE-2024-34562

CVE-2024-34562 is a stored XSS in Move Addons for Elementor caused by improper input neutralization during web page generation, affecting Move Addons for Elementor up to version 1.3.0. Connected sources indicate the issue has been patched in later updates; no exploitation details are provided in ...

CVE-2024-34563

CVE-2024-34563 is a stored XSS in Gold Addons for Elementor. The Red Hat and Wordfence records confirm the vulnerability affects Gold Addons for Elementor (

CVE-2024-34566

CVE-2024-34566 is a Stored XSS in Content Blocks (Custom Post Widget) for WordPress. The issue arises from improper input neutralization during web page generation. Affected: Content Blocks (Custom Post Widget)

CVE-2024-34568

CVE-2024-34568 affects the WordPress LetterPress Newsletter plugin, versions <= 1.2.1. Root cause: Improper neutralization of input during web page generation, leading to Stored XSS. Impact is documented as Cross-Site Scripting with low CVSS v3.1 base score (5.9) and low overall severity; expl...

CVE-2024-34570

CVE-2024-34570 is a Stored XSS in Xpro Elementor Addons for WordPress (Xpro Elementor Addons) that affects versions from unspecified up to 1.4.3. The issue occurs during web page generation due to improper input neutralization, enabling malicious payloads to be stored and served to users. Public ...