CVE-2024-1660

CVE-2024-1660 affects the WordPress Top Bar plugin prior to 3.0.5, where certain settings were not properly sanitised/escaped in the UI, enabling Stored XSS by high-privilege users (e.g., Administrators) even if unfiltered_html is disabled (including multisite setups). The Red Hat advisory mirror...

CVE-2024-1754

The CVE-2024-1754 entry concerns the NPS computy WordPress plugin (versions up to 2.7.5) where some settings are not sanitised/escaped, enabling Stored XSS by high-privilege users (e.g., Administrators) even if unfiltered_html is disallowed (e.g., multisite). Red Hat and Patchstack corroborate th...

CVE-2024-1712

The Carousel Slider WordPress plugin prior to version 2.2.7 does not sanitize/escape certain settings, allowing Stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (e.g., multisite). Affected versions:

CVE-2024-1755

CVE-2024-1755 affects the WordPress plugin “NPS computy” up to version 2.7.5, where missing CSRF checks in certain code paths could allow an attacker to cause logged-in users to perform unintended actions. The issue is documented as CSRF across multiple sources, with a remediation stating that ve...

CVE-2024-1746

CVE-2024-1746 affects the WordPress plugin Testimonial Slider (versions prior to 2.3.8). The vulnerability stems from insufficient sanitization/escaping of certain plugin settings, allowing Stored XSS by high-privilege users (e.g., administrators) even when the unfiltered_html capability is disal...

CVE-2024-1306

CVE-2024-1306 affects the Smart Forms WordPress plugin prior to version 2.6.94. The Red Hat advisory and NVD entry describe a CSRF vulnerability where missing CSRF protections in certain actions allow logged-in users to be tricked into performing unintended actions (e.g., editing entries). Root c...

CVE-2024-1307

CVE-2024-1307 refers to the Smart Forms WordPress plugin vulnerability. The issue is an authorization weakness in certain actions, allowing users with a low role (subscriber) to call those actions and perform unauthorized operations. Public sources in connected documents confirm the affected vers...

CVE-2024-1204

The CVE-2024-1204 issue affects the Meta Box WordPress Custom Fields Framework (versions prior to 5.9.4). It allows users with at least the Contributor role to access arbitrary custom fields assigned to other users’ posts, indicating a broken access control vulnerability. Remediation, per multipl...

CVE-2024-0902

CVE-2024-0902 affects the Fancy Product Designer WordPress plugin prior to 6.1.81. Root cause: the plugin does not sanitize and escape certain settings, allowing high-privilege users (e.g., admins) to perform Stored Cross-Site Scripting even when unfiltered_html is disallowed (e.g., multisite). I...

CVE-2024-0399

CVE-2024-0399 concerns the WordPress plugin WooCommerce Customers Manager prior to version 29.7. The issue is an SQL injection caused by improper sanitisation/escaping of a parameter used in a SQL statement, exploitable by a Subscriber+ role through the affected admin-ajax endpoint. Public source...

CVE-2023-6067

The CVE-2023-6067 entry concerns WP User Profile Avatar for WordPress, where versions ≤ 1.0.1 fail to validate/escape shortcode attributes, enabling Stored XSS for users with Contributor+ privileges. Red Hat and NVD entries confirm the vulnerability; the provided documents do not specify a fixed ...

CVE-2024-3768

Affected software: PHPGurukul/itsourcecode News Portal 4.1. The vulnerability resides in the search.php file where manipulating the searchtitle parameter leads to SQL injection. The issue is exploitable remotely and has been publicly disclosed. The CVEs collectively describe high-severity impacts...

CVE-2024-3777

CVE-2024-3777 affects Ai3 QbiBot where the password reset feature has broken access control, allowing unauthenticated remote reset of any user’s password. Public sources indicate the vulnerability exists in Ai3 QbiBot v8.0.4 and earlier. The CVSS‑3.1 base score is 9.8 (CRITICAL) with network acce...

CVE-2024-3767

CVE-2024-3767 affects PHPGurukul News Portal 4.1, specifically the code path in /admin/edit-post.php where manipulating the posttitle or related category parameters leads to an SQL injection . The vulnerability can be exploited remotely and, per connected sources, the exploit has been publicly di...

CVE-2024-3776

CVE-2024-3776 is a reflected XSS vulnerability in Netvision airPASS login parameter handling. An unauthenticated attacker can inject JavaScript via the login parameter due to insufficient input filtering. Documented impact is cross-site scripting with potential access to user context; exploitatio...

CVE-2024-30840

The CVE-2024-30840 affects Tenda AC15 v15.03.05.18, due to a stack overflow in the fromDhcpListClient function when handling the LISTEN parameter, leading to a denial of service. Public sources in the connected documents confirm the vulnerable component and impact (DoS). A remediation hint from P...

WBCE 1.6.0 SQL Injection

Exploit Title: |Unauthenticated SQL injection in WBCE 1.6.0 Date: 15.11.2023 Exploit Author: young pope Vendor Homepage: https://github.com/WBCE/WBCECMS Software Link: https://github.com/WBCE/WBCECMS/archive/refs/tags/1.6.0.zip Version: 1.6.0 Tested on: Kali linux CVE : CVE-2023-39796 There is an...

CVE-2024-30567

CVE-2024-30567 affects JNT Telecom’s JNT Liftcom UMS V1.J Core, version JM-V15. The issue allows a remote attacker to execute arbitrary code via the Network Troubleshooting functionality. Public sources consistently describe the vulnerable component as the Network Troubleshooting feature in JM-V1...

CVE-2024-28557

CVE-2024-28557 affects Sourcecodester PHP Task Management System v1.0, with a SQL Injection vulnerability in update-admin.php. The underlying cause is improper input handling that allows an attacker to inject SQL through crafted payloads, enabling remote code execution, privilege escalation, and ...

CVE-2024-31650

CVE-2024-31650 describes a cross-site scripting (XSS) vulnerability in the Cosmetics and Beauty Product Online Store v1.0. The flaw is triggered through a crafted payload in the Last Name parameter, allowing arbitrary web scripts/HTML execution. The NVD entry reports a CVSSv3.1 base score of 9.6 ...