CVE-2023-46012

The CVE-2023-46012 entry refers to a Buffer Overflow in Linksys EA7500 firmware (version 3.0.1.207964) affecting the IGD UPnP service. Public sources describe a vulnerable path in the UPnP IGD handling in which the HTTP request data is copied into a fixed 184‑byte stack buffer during processing o...

CVE-2024-25507

RuvarOA v6.01 and v12.01 are affected by a SQL injection via the email_attach_id parameter in /LHMail/AttachDown.aspx. Root cause: lack of validation of external SQL input in that endpoint. CVSS v3.1 base score 9.4 (CRITICAL); impact: Confidentiality and Integrity high, Availability low. No remed...

CVE-2024-33434

CVE-2024-33434 affects tiagorlampert CHAOS (v5.0.1 before 1b451cf62582295b7225caf5a7b506f0bad56f6b and 24c9e109b5be34df7b2bce8368eae669c481ed5e). The root cause is unsafe concatenation of the filename argument into buildStr without sanitization, enabling remote code execution. Public reports desc...

CVE-2024-33164

CVE-2024-33164 affects J2EEFAST v2.7.0. A SQL injection in authUserList() via the sql_filter parameter is reported, with CVSS 3.1 base score 9.8 (CRITICAL). Impact: potentially arbitrary SQL execution and data leakage; network access, no user interaction required. Some sources note mitigations su...

CVE-2024-33857

The CVE-2024-33857 affects Logpoint before 7.4.0. Lack of input validation on URLs in threat intelligence allows a low-privilege attacker to trigger server-side request forgery (SSRF). CVSS v3.1: Critical (9.6) with network access, low attack complexity, low privileges, no user interaction; impac...

CVE-2024-33148

CVE-2024-33148 : Concrete details from connected docs show a SQL injection in J2EEFAST v2.7.0 via the sql_filter parameter in the list function. Root cause, per CNVD/NVD/Red Hat/CVE records, is improper validation of external input in that function. Reported impact is SQL data exposure/alteration...

CVE-2024-33856

CVE-2024-33856 affects Logpoint before 7.4.0. An attacker can enumerate valid usernames by observing response times at the Forgot Password endpoint, indicating a timing-based leakage. Impact is account enumeration; no broader impact stated. Remediation: upgrade to Logpoint 7.4.0 or later; as a te...

CVE-2024-33153

CVE-2024-33153 affects J2EEFAST v2.7.0. A SQL injection vulnerability exists in the commentList() function via the sql_filter parameter due to lack of validation against externally entered SQL statements. Impact described in sources is high (confidentiality, integrity, and availability affected) ...

CVE-2024-25512

CVE-2024-25512 affects RuvarOA v6.01 and v12.01. The vulnerability is a SQL injection in the /Bulletin/AttachDownLoad.aspx endpoint via the attach_id parameter, arising from input validation gaps. Impact described across sources includes the ability to execute arbitrary SQL and exfiltrate sensiti...

CVE-2024-34413

CVE-2024-34413 is a Stored XSS in the SliceWP Affiliates plugin for WordPress, affecting SliceWP Affiliates up to version 1.1.10. The vulnerability is authenticated (Admin+ required) and is documented as a vulnerability in Wordfence with patch status: Patched (no specific patched version provided...

CVE-2024-33570

CVE-2024-33570: Metform Elementor Contact Form Builder for WordPress (versions ≤ 3.8.3) has a Missing Authorization/Broken Access Control vulnerability. The issue enables unauthorized access due to missing authorization checks. Reported as affecting Metform Elementor Contact Form Builder; remedia...

CVE-2024-33576

CVE-2024-33576 concerns the WordPress WPPizza plugin, with a Missing Authorization vulnerability affecting versions up to 3.18.10. The connected Red Hat advisory explicitly names Missing Authorization as the root cause but does not provide exploitation specifics or exact remediation steps within ...

CVE-2024-33907

CVE-2024-33907 affects Print My Blog (WordPress plugin) with missing authorization vulnerability up to version 3.26.2. Exploitation details are not provided in the documents, but Red Hat and Wordfence entries confirm a Missing Authorization flaw and a patched remediation path: upgrade to 3.26.2 o...

CVE-2024-33908

CVE-2024-33908: The ThemeGr ove WidgetKit (All-in-One Addons for Elementor WidgetKit) has a Missing Authorization vulnerability affecting WidgetKit versions up to 2.5.0. Connected documents identify this as a Missing Authorization to Notice Dismissal issue. The Wordfence entry notes the patch sta...

CVE-2024-33912

CVE-2024-33912 pertains to Academy LMS (WordPress) and is a Missing Authorization vulnerability affecting Academy LMS versions up to 1.9.16. Public documents identify it as an authorization bypass issue allowing access to paid courses. The vulnerability is listed as patched in subsequent advisori...

CVE-2024-34372

CVE-2024-34372 is a Missing Authorization vulnerability in the Post Grid Master (AddonMaster) plugin, affecting Post Grid Master versions up to 3.4.7. Public records from Red Hat and Wordfence corroborate the issue as Missing Authorization with a CVSS v3.1 base score of 5.3 (Medium). The Patch st...

CVE-2024-34378

LeadConnector WordPress plugin versions

CVE-2024-34389

CVE-2024-34389 is a Missing Authorization vulnerability in the AF Themes WP Post Author plugin. Red Hat’s security entry attributes this to WP Post Author and lists affected versions as up to 3.6.4. The connected documents do not provide technical details about the vulnerability’s root cause beyo...

CVE-2024-34366

CVE-2024-34366: Stored XSS in Alt Text AI WordPress plugin. Root cause: improper input neutralization during web page generation. Affected: Alt Text AI Download Alt Text AI (versions up to 1.3.4). Existence of connected claim shows a patched status for the vulnerability in the plugin beyond 1.3.4...

CVE-2024-34369

CVE-2024-34369 is a reflected XSS in the Webpushr Web Push Notifications WordPress plugin, caused by improper input neutralization during page generation and affecting Webpushr versions up to 4.35.0. The vulnerability has been patched in subsequent releases; update to a patched version. No exploi...