CVE-2024-32816

Technical details about CVE-2024-32816 (PickPlugins Post Grid) are not publicly provided in the supplied documents. Monitor for updates from official advisories and vendor disclosures before assessing risk or mitigations.

CVE-2024-32817

CVE-2024-32817 describes a deserialization of untrusted data vulnerability in the WordPress plugin “Import and export users and customers,” affecting version range up to 1.26.2. The Red Hat entry reproduces the description and indicates the issue is resolved in a patched state. Public details in ...

CVE-2024-32836

CVE-2024-32836 affects WP-Lister Lite for eBay (WordPress plugin); an authenticated user can upload any file due to Unrestricted Upload of File with Dangerous Type, enabling potential system compromise. Affected versions are up to 3.5.11. The issue is rated CVSS v3.1 score 9.1 (Critical). Remedia...

CVE-2024-32718

The Pack Elementor addons (Header Footer & WooCommerce Builder, Template Library)

CVE-2024-32955

CVE-2024-32955 is a Server-Side Request Forgery (SSRF) in FV Flowplayer Video Player for WordPress. Affected: FV Flowplayer Video Player plugin versions up to 7.5.43.7212. Impact and exploit details are not provided beyond SSRF. Refs indicate the issue is patched in the FV Flowplayer entry (Patch...

CVE-2024-32948

CVE-2024-32948 corresponds to a Missing Authorization vulnerability in ARMember (Repute Infosystems) affecting ARMember up to version 4.0.28. The vulnerability is categorized as network-exploitable with no user interaction, enabling an attacker with no privileges to access or modify restricted re...

CVE-2024-32951

CVE-2024-32951 affects BloomPixel Max Addons Pro for Bricks (Max Addons Pro for Bricks) up to version 1.6.1, with a Missing Authorization vulnerability that could permit unauthorized access to plugin settings. The CVSS 3.1 base metrics show a Medium severity (6.5) with network attack vector, no c...

CVE-2024-31406

RoamWiFi R10 firmware before 4.8.45 contains an Active debug code vulnerability (CWE-489). A network-adjacent, unauthenticated attacker with access to the device can perform unauthorized operations. Affected products are RoamWiFi R10 versions prior to 4.8.45; remediation is to update to 4.8.45 or...

CVE-2024-3261

The CVE-2024-3261 entry concerns the WordPress plugin Strong Testimonials (prior to 3.1.12). It states that certain Testimonial fields are not validated/escaped before being output on pages, enabling Stored XSS for users with contributor role or higher when a specific view is accessed. Affected a...

CVE-2024-2972

CVE-2024-2972 affects the WordPress plugin Floating Chat Widget (Chaty) before version 3.1.9. The issue is stored XSS caused by inadequate sanitization/escaping of plugin settings, enabling high-privilege users (e.g., admins) to inject script even when unfiltered_html is disallowed (including mul...

CVE-2024-4093

CVE-2024-4093 affects SourceCodester Simple Subscription Website 1.0. A SQL injection vulnerability exists in view_application.php caused by manipulating the id parameter in an unknown function, enabling remote exploitation. Multiple connected sources confirm a critical severity with high impact ...

CVE-2024-28613

CVE-2024-28613 describes an SQL Injection vulnerability in PHP Task Management System v1.0. The flaw allows a remote attacker to escalate privileges and access sensitive information through the task_id parameter used by task-details.php and edit-task.php. Public references in the initial and conn...

CVE-2024-4074

The CVE-2024-4074 affects Kashipara Online Furniture Shopping Ecommerce Website version 1.0. The vulnerability resides in prodInfo.php, where manipulating the prodId parameter triggers a cross-site scripting (XSS) flaw. The issue can be exploited remotely and the public exploit has been disclosed...

CVE-2024-4071

CVE-2024-4071 affects Kashipara Online Furniture Shopping Ecommerce Website version 1.0. The vulnerability is in the prodInfo.php file, where manipulation of the prodId argument leads to SQL injection. An attacker can exploit remotely; public disclosure is noted. Several connected sources confirm...

CVE-2024-4070

CVE-2024-4070 affects Kashipara Online Furniture Shopping Ecommerce Website 1.0. The vulnerability is in the prodList.php file, where manipulation of the prodType parameter enables SQL injection. It is a remotely exploitable issue and has been disclosed publicly. Exploitation details are cited ac...

CVE-2024-32875

Hugo static site generator vulnerability CVE-2024-32875 affects versions prior to 0.125.3 (starting in 0.123.0). The issue is that title arguments in Markdown for links and images were not escaped in internal render hooks, potentially impacting users who have these hooks enabled and do not trust ...

CVE-2024-32662

CVE-2024-32662 — FreeRDP out-of-bounds read : Affected software is FreeRDP clients before 3.5.1. The issue occurs when a WCHAR string is read with twice its size and converted to UTF-8/base64, and the string is used to compare against the redirection server certificate. The vulnerability has a hi...

CVE-2024-4064

CVE-2024-4064 affects Tenda AC8 16.03.34.09. The R7WebsSecurityHandler function in /goform/execCommand mishandles the password parameter, causing a stack-based buffer overflow. This enables remote exploitation; the exploit has been disclosed publicly. Multiple sources (NVD, Red Hat, CNVD, CNNVD, ...

CVE-2024-32659

Summary (CVE-2024-32659) FreeRDP clients prior to 3.5.1 are vulnerable to an out-of-bounds read when the width and height are both zero (nWidth == 0 and nHeight == 0). The issue is fixed in FreeRDP version 3.5.1. Several connected advisories reinforce the same flaw and patch, noting that affected...

CVE-2024-32658

CVE-2024-32658 affects FreeRDP:FreeRDP-based clients prior to version 3.5.1 are vulnerable to an out-of-bounds read. Version 3.5.1 contains the patch. No public workarounds are documented in the provided sources. Impact is described as high (likely crash or information disclosure per out-of-bound...