CVE-2024-22949

CVE-2024-22949 concerns JFreeChart v1.5.4, where a NullPointerException is reported in the /chart/annotations/CategoryLineAnnotation component. Multiple sources note that the existence of a vulnerability is disputed and may be based on less robust tooling. Red Hat, OSV, and Ubuntu entries corrobo...

CVE-2024-31047

CVE-2024-31047 affects Academy Software Foundation OpenEXR v3.2.3 and earlier. A local attacker can trigger a denial of service via the convert function in exrmultipart.cpp. The connected materials consistently describe this DoS but do not publish explicit exploit details. Public advisories from ...

CVE-2024-26574

Wondershare Filmora 13.0.51 is affected by CVE-2024-26574 due to insecure permissions in WSNativePushService.exe. The vulnerability allows a local attacker with low privileges and no user interaction to execute arbitrary code via a crafted script, per multiple sources (NVD/Red Hat/etc.). The issu...

CVE-2024-31805

TOTOLINK EX200 firmware 4.0.3c.7646_B20201211 contains an authorization flaw in the setTelnetCfg function that allows an attacker to start the Telnet service without authentication by manipulating the telnet_enabled parameter. The vulnerability is documented across multiple sources (CVE-2024-3180...

CVE-2022-43216

CVE-2022-43216 affects AbrhilSoft Customer/Employee Portal (AbrhilSoft Employee’s Portal) prior to version 5.6.2, where a SQL injection vulnerability exists in the login page. The CVSSv3.1 base score is 9.1 (CRITICAL; Network attack, no user interaction required; confidentiality and integrity imp...

CVE-2024-31808

TOTOLINK EX200 v4.0.3c.7646_B20201211 is affected by CVE-2024-31808, a remote code execution (RCE) via the webWlanIdx parameter in the setWebWlanIdx function. Multiple connected sources confirm an RCE vulnerability in this specific version, enabling arbitrary code execution. The public discussion...

CVE-2024-31815

TOTOLINK EX200, version 4.0.3c.7314_B20191204, is exposed to an unauthorized disclosure of the device configuration via the /cgi-bin/ExportSettings.sh API endpoint. Multiple sources (CVE record, Red Hat security entry, CNVD/CNNVD summaries) align on a vulnerability described as improper privilege...

CVE-2024-23086

CVE-2024-23086 concerns Apfloat v1.10.1 with a stack overflow in org.apfloat.internal.DoubleModMath::modPow(double, double). The issue is disputed by third parties regarding its existence; no concrete exploit details or remediation are provided in the supplied documents. Connected sources identif...

CVE-2024-23082

CVE-2024-23082 concerns ThreeTen Backport v1.6.8, with an integer overflow in DateTimeFormatter.parse(CharSequence, ParsePosition). Multiple sources dispute the vulnerability’s existence; no solid public exploit details are provided in the documents. Red Hat/IBM postings flag a potential denial-o...

CVE-2024-3433

CVE-2024-3433 affects PuneethReddyHC Event Management 1.0. Affected is an unknown function in the file /backend/register.php where manipulation of the parameters event_id, full_name, email, mobile, college, or branch yields cross-site scripting. Exploitation could be performed remotely. The vulne...

CVE-2024-3432

CVE-2024-3432 affects PuneethReddyHC Event Management 1.0. The vulnerability is a SQL injection in the backend/register.php processing of parameters event_id/full_name/email/mobile/college/branch, exploitable remotely. Multiple sources confirm the issue and that the exploit has been disclosed pub...

CVE-2024-3431

CVE-2024-3431 (EyouCMS 1.6.5) involves a deserialization vulnerability in the Backend at the file path /login.php?m=admin&c=Field&a=channel_edit, where manipulating the argument channel_id leads to code execution. The issue is exploitable remotely and has public exploits/disclosures. Multiple sou...

CVE-2024-31291

CVE-2024-31291 is an Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid, affecting ProfileGrid versions up to 5.7.6 (listed as vulnerable in Red Hat CVE entry). The Red Hat page explicitly names the issue and affected product/version, but the provided document...

CVE-2024-31296

CVE-2024-31296 refers to an Authorization Bypass via a user-controlled key in BookingPress (BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin). Connected Red Hat advisory confirms the vulnerability affects BookingPress versions up to 1.0.81 and describes an Authoriza...

CVE-2024-31233

CVE-2024-31233 is an Unauthenticated Local File Inclusion affecting the Rehub theme for WordPress (rehub-theme) up to version 19.6.1. Public docs in connected sources corroborate the vulnerability type, affected software, and that the issue was patched (Patched). The initial entry also lists a hi...

CVE-2024-22155

CVE-2024-22155 is a documented CSRF vulnerability in Automattic WooCommerce affecting versions up to 8.5.2, as reflected by the connected Red Hat advisory. The available sources do not provide concrete exploit details, affected subcomponents, or a confirmed patch/version to mitigate this specific...

CVE-2024-31286

CVE-2024-31286 : WP Photo Album Plus (WordPress plugin) has an Unrestricted Upload of File with Dangerous Type vulnerability affecting WP Photo Album Plus versions prior to 8.6.03.005. The Wordfence vulnerability entry for this CVE notes the issue as an authenticated/unauthorized file upload flaw...

CVE-2024-31277

CVE-2024-31277 affects PickPlugins Product Designer (WordPress plugin) up to version 1.0.32. Root cause: Deserialization of untrusted data leading to unauthenticated PHP Object Injection. Impact: potential compromise of data integrity and confidentiality as indicated by CVSS, with unauthenticated...

CVE-2024-31308

CVE-2024-31308 refers to a Deserialization/PHP Object Injection vulnerability in the WP Import Export Lite WordPress plugin (affected up to and including 3.9.26). The issue is authenticated (Administrator+) and arises from Deserialization of Untrusted Data, enabling potential arbitrary object inj...

CVE-2024-3427

CVE-2024-3427 affects SourceCodester Online Courseware 1.0. The vulnerable component is the file addq.php where the id parameter can be manipulated to cause a cross-site scripting (XSS). Root cause: unsafely handled user input leading to XSS. Impact: potential remote exploitation; the exploit has...