CVE-2024-26023

CVE-2024-26023 affects BUFFALO wireless LAN routers. Affected component: BUFFALO WLR/WSR/WCR series firmware; vulnerability allows a logged-in user to execute arbitrary OS commands (OS command injection). Root cause and impact are described as command execution with local access; CVSS v3.1 base s...

CVE-2024-23486

Buffalo BUFFALO wireless LAN routers are affected by CVE-2024-23486 due to plaintext storage of passwords, enabling a network-adjacent, unauthenticated attacker with access to the login page to obtain configured credentials. The issue is documented for multiple WSR-series models (e.g., WSR-... va...

CVE-2024-30220

CVE-2024-30220 : Command injection in PLANEX COMMUNICATIONS wireless LAN router models (notably MZK-MF300N). An unauthenticated, network-adjacent attacker can trigger arbitrary commands by sending a crafted request to a specific port. The MZK-MF300N is no longer supported, and vendor updates are ...

CVE-2024-32129

CVE-2024-32129 is a URL redirection (open redirect) vulnerability in the official Freshdesk plugin for WordPress, affecting Freshdesk (official) from n/a through 2.3.6. The issue has concrete details in connected sources: an open redirect vulnerability in the Freshdesk plugin identified as CVE-20...

CVE-2024-31376

CVE-2024-31376 is a CSRF flaw in the WordPress plugin Dashboard To-Do List by Andrew Rapps, affecting the plugin up to version 1.3.1. The RedHat/Wordfence entries indicate the vulnerability path involves ardtdw_widgetupdate() and allows Cross-Site Request Forgery to perform actions on behalf of a...

CVE-2024-31381

Technical details about CVE-2024-31381 and affected products are not provided in the connected documents. Monitor for official advisories to learn impact, vulnerable components, and remediation.

CVE-2024-31382

CVE-2024-31382: CSRF in Blocksy (Creative Themes HQ Blocksy) affecting Blocksy versions up to and including 2.0.22. Connected sources confirm the issue is CSRF, but no exploit details or confirmed fixed version are provided in the supplied documents. remediation/fix version is not specified in th...

CVE-2024-31384

CVE-2024-31384 is a Cross‑Site Request Forgery vulnerability affecting the Rara Theme Spa and Salon plugin/theme, with affected versions listed as Spa and Salon: from n/a through 1.2.7. The connected Red Hat entry confirms the same CVE and description. The available data indicate a CSRF issue but...

CVE-2024-31385

Technical details about CVE-2024-31385 (affected version, root cause, exploitability, fix) are not provided in the connected documents. The initial description notes a CSRF issue in ReDi Restaurant Reservation; monitor for official advisories for specifics.

CVE-2024-31389

CVE-2024-31389 is a confirmed CSRF vulnerability in Ertano MihanPanel. Affected versions are before 12.7; upgrading to 12.7 or later is the stated remediation. The connected Red Hat entry corroborates the CSRF nature and target product/version. No exploit details are provided in the available doc...

CVE-2024-31422

CVE-2024-31422 is a CSRF vulnerability in the WordPress Favicon plugin by RealFaviconGenerator. The issue affects the Favicon plugin versions

CVE-2024-31428

CVE-2024-31428 is a CSRF vulnerability in the WordPress theme The Conference (Rara Theme) affecting versions up to and including 1.2.0. The connected Red Hat entry reiterates the same description. Public details in the provided documents do not specify affected builds beyond “n/a through 1.2.0,” ...

CVE-2024-31431

CVE-2024-31431: CSRF in Tyche Softwares Product Input Fields for WooCommerce affects Product Input Fields for WooCommerce versions up to 1.7.0 (no details on root cause beyond CSRF and no patch/version provided in the available documents). Affects the plugin for WooCommerce; reported by Red Hat/W...

CVE-2024-31432

CVE-2024-31432 is a Missing Authorization vulnerability in the StellarWP Restrict Content plugin for WordPress, affecting versions up to 3.2.8. From the provided documents, exploitation details are not disclosed, but the issue allows unauthorized access to restricted content. Remediation, per the...

CVE-2024-31921

Technical details (affected product version specifics, root cause, exploit info, and remediation) for CVE-2024-31921 are not provided in the connected documents; no patch/version info is present. Monitor vendor advisories for updates.

CVE-2024-31922

Technical details about CVE-2024-31922 are not provided in the supplied documents. Public details (affected product, root cause, patch) are not present here. Monitor for updates from vendors and vulnerability disclosures.

CVE-2024-31923

CVE-2024-31923 covers a CSRF vulnerability in Feather Login Page for WordPress. The connected documents specify the issue as a Cross-Site Request Forgery via saveData() affecting Feather Login Page versions up to 1.1.5 (no exact minimum version provided in the sources). The CVSS vector in the Ini...

CVE-2024-31933

Technical details for CVE-2024-31933 are not publicly provided in the supplied documents; monitor for updates from vendors and advisories.

CVE-2024-31938

CVE-2024-31938 is a CSRF issue affecting Themeinwp NewsXpress (NewsXpress) up to version 1.0.7. The connected Red Hat entry reiterates the CSRF description without enabling concrete exploit or remediation details in the provided documents. No public patch/version fix is listed here; monitor for o...

CVE-2024-31941

CVE-2024-31941 affects the WordPress CP Media Player plugin (versions ≤ 1.1.3). The vulnerability is a Cross-Site Request Forgery (CSRF) flaw, with unauthenticated exploitation potential as described by Patchstack; advisory notes indicate the issue has low severity (CVSS v3.1 base score 5.4) and ...