CVE-2024-4466

CVE-2024-4466 describes a SQL injection in Gescen on the centrosdigitales.net platform. The vulnerability allows an attacker to send a specially crafted SQL query to the pass parameter and retrieve all data from the database, indicating a data confidentiality and integrity impact. The PT-2024-312...

CVE-2024-4461

SugarSync for Windows is affected by CVE-2024-4461: unquoted service path in the installed SugarSync service allows a local attacker to inject arbitrary code, leading to privilege escalation. The issue affects versions before 4.1.3; remediation is to upgrade to 4.1.3 or later.

CVE-2024-33921

CVE-2024-33921 targets the ReviewX WordPress plugin (ReviewX – Multi-criteria Rating & Reviews for WooCommerce). The connected Red Hat advisory confirms a Broken Access Control vulnerability in ReviewX affecting versions from n/a up to 1.6.21. The NVD entry rates the issue as High risk with CVSS ...

CVE-2024-33923

CVE-2024-33923 affects the SP Project & Document Manager (WordPress plugin) and is due to Missing Authorization in the plugin. The vulnerability affects SP Project & Document Manager versions from n/a up to 4.69. Reported CVSS 3.1 base metrics indicate Network access (AV:N), low attack complexity...

CVE-2024-33925

The CVE-2024-33925 entry concerns the Embed Google Fonts plugin for WordPress. The Red Hat and Wordfence records concur a Missing Authorization vulnerability affecting Embed Google Fonts up to version 3.1.0, with a base CVSS v3.1 score of 4.3 (Medium). Root cause: missing/insufficient authorizati...

CVE-2024-33937

CVE-2024-33937 describes a Missing Authorization vulnerability in the Progressive WordPress (PWA) plugin. Connected Red Hat advisory confirms this issue affects Progressive WordPress (PWA) versions up to 2.1.13 and does not provide explicit patch details in the documents. The available informatio...

CVE-2024-28072

SolarWinds Serv-U FTP Server is affected by CVE-2024-28072: a highly privileged account can overwrite arbitrary files via log output due to unsanitized log file path tags. Affected versions include 15.4.0–15.4.2 (HF1). Remediation: upgrade to 15.4.3 or apply 15.4.2 HF1 where available.

CVE-2024-24710

CVE-2024-24710 affects WordPress plugin Feed Them Social (SlickRemix) up to version 4.2.0. The issue is a missing authorization vulnerability (broken access control) that could enable unauthorized actions on affected sites. The CVE entry notes updated versions and references Patch Stack indicatin...

CVE-2024-32810

CVE-2024-32810 concerns the WordPress plugin ShortPixel Critical CSS. Public records indicate a Missing Authorization vulnerability affecting ShortPixel Critical CSS versions from n/a up to and including 1.0.2. The CVE’s collected data shows a CVSS v3.1 base score of 7.6 (HIGH) with network attac...

CVE-2023-25457

CVE-2023-25457 (WordPress Slider Carousel – Responsive Image Slider) is a Missing Authorization/Broken Access Control vulnerability in the Richteam Slider Carousel – Responsive Image Slider plugin. Affected versions: 1.5.1 and earlier (WordPress plugin “slider-images”). Root cause: unauthorized a...

CVE-2023-44472

CVE-2023-44472: Unyson WordPress plugin (<= 2.7.28) contains a Missing Authorization/Broken Access Control vulnerability. Root cause is missing authorization checks; impact is limited by documented scope (Unyson

CVE-2024-33926

CVE-2024-33926 relates to the GWP-Histats WordPress plugin. Connected data confirms an authenticated (Contributor+) Stored XSS via GWP-Histats

CVE-2024-33928

CVE-2024-33928 affects CodeBard's Patron Button and Widgets for Patreon (WordPress plugin), with a Reflected XSS vulnerability due to improper neutralization of input during web page generation. Affected versions are from n/a through 2.2.0. Exploitation would involve attacker-supplied script exec...

CVE-2024-33934

CVE-2024-33934 affects Mini Loops WordPress plugin (versions

CVE-2024-33936

CVE-2024-33936 is a Stored Cross-Site Scripting (XSS) vulnerability in Twinpictures Print-O-Matic for WordPress, affecting Print-O-Matic: from n/a through 2.1.10. The issue arises from improper input neutralization during web page generation. No exploits or vectors are provided in the documents. ...

CVE-2024-33946

CVE-2024-33946 is a reflected XSS in WPify Woo Czech (WordPress plugin). Affected: WPify Woo Czech up to version 4.0.10. Impact per CVSS: Confidentiality, Integrity, Availability - Low. Root cause: improper input handling during web page generation. Exploitation vector: reflected input. Remediati...

CVE-2024-3703

CVE-2024-3703 affects the Carousel Slider WordPress plugin prior to 2.2.10. The vulnerability is a Stored Cross-Site Scripting (XSS) flaw arising from failure to validate/escape certain Slide options before they are output in the page/post where the Slide shortcode is embedded. Reports from Red H...

CVE-2024-3637

CVE-2024-3637 affects the WordPress plugin Lead Form Builder (Responsive Contact Form Builder & Lead Generation) = 1.9.8. If upgrading to a version addressing this issue (e.g., 1.9.8 or later) is available, apply it. Until patched, exposure exists for admin users who can modify settings. Technica...

CVE-2024-4439

WordPress Core prior to 6.5.2 is affected by CVE-2024-4439: a stored XSS in user display names used in the Avatar block, due to insufficient output escaping. The issue allows authenticated attackers with contributor-level access and above to inject scripts, and can also affect unauthenticated use...

CVE-2023-51633

Centreon (Centreon) sysName Cross-Site Scripting Remote Code Execution vulnerability (CVE-2023-51633) stems from improper validation of input in the SNMP sysName OID, enabling arbitrary code execution with the service account when a user-provided value is processed. Exploitation requires user int...