CVE-2024-3162

The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.6.3, due to insufficient input sanitization and output escaping in the Testimonial Widget Attributes. An authenticated attacker with contributor access or higher can inject ar...

CVE-2024-1327

CVE-2024-1327 affects the Jeg Elementor Kit WordPress plugin. It allows Stored XSS via the Image Box widget in all versions up to 2.6.3 due to inadequate input sanitization and output escaping. Exploitation requires contributor-level authentication (or higher); the script executes when a user loa...

CVE-2024-3227

CVE-2024-3227 affects Panwei eoffice OA up to 9.5 (Backend) and involves a path traversal in file /general/system/interface/theme_set/save_image.php. The vulnerability is triggered by manipulating the argument image_type to navigate to a directory like ‘../filedir’. It is remotely exploitable and...

CVE-2024-3226

CVE-2024-3226 affects Campcodes Online Patient Record Management System 1.0. The vulnerability is a SQL injection in the password parameter of the /admin/login.php file. It can be triggered remotely; the attack does not require user interaction beyond sending crafted input. Multiple connected sou...

CVE-2024-3225

The CVE-2024-3225 entry concerns SourceCodester PHP Task Management System 1.0, where the vulnerability resides in edit-task.php. The issue stems from manipulation of the task_id argument, leading to SQL injection. It can be exploited remotely and the exploit has been disclosed publicly. Multiple...

CVE-2024-3221

CVE-2024-3221 affects SourceCodester PHP Task Management System 1.0, with a vulnerability in attendance-info.php where manipulating the user_id parameter leads to SQL injection. The issue can be exploited remotely and has public disclosure; associated references indicate a high/critical risk depe...

CVE-2023-44038

CVE-2023-44038 affects VeridiumID prior to 3.5.0, where the identity provider page is vulnerable to an LDAP injection that allows an unauthenticated attacker to enumerate information about registered users. Affected product: VeridiumID (versions before 3.5.0). Root cause: LDAP injection on the id...

CVE-2024-25864

Friendica (post-2023.12 versions) is affected by a Server-Side Request Forgery (SSRF) in the fpostit.php component. The underlying issue enables a remote attacker to cause arbitrary code execution and obtain sensitive information. The vulnerability is documented across multiple feeds, with remedi...

CVE-2023-35812

CVE-2023-35812 affects OpenSSH 7.4 in Amazon Linux 1/2. The issue stems from an incomplete mitigation for CVE-2019-6111: when a relative path is used with scp, the client does not verify that the received filename matches the requested one, allowing potential file misassociation. Public advisorie...

CVE-2023-44040

CVE-2023-44040 affects VeridiumID prior to 3.5.0. An internal unauthenticated attacker can trigger a cross-site scripting (XSS) on the identity provider page, allowing JavaScript execution in the user’s authentication context. Multiple sources (NVD, Red Hat advisory, CVE listings, and third-party...

CVE-2024-31011

CVE-2024-31011 affects beescms v4.0, where an Arbitrary file write vulnerability exists in admin_template.php due to a file path that was not isolated and an unverified suffix. This allows a remote attacker to write arbitrary files and, as described, execute arbitrary code. The impact is consiste...

Security Advisory 0095

Security Advisory 0095 PDF Date: April 3, 2024 Revision | Date | Changes ---|---|--- 1.0 | April 3, 2024 | Initial release The CVE-ID tracking this issue: CVE-2024-3094 CVSSv3.1 Base Score: 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Description Arista Networks is providing this security...

CVE-2024-30568

Netgear R6850 router, firmware v1.1.0.88, is affected by a command injection vulnerability in the ping_test function triggered via the c4_IPAddr parameter. The issue arises because input is not properly validated/filtered, allowing an unauthenticated attacker to inject arbitrary system commands, ...

CVE-2024-31009

CVE-2024-31009 involves a SQL injection in SEMCMS v4.8, exploitable via the lgid parameter in Banner.php. The vulnerability could allow a remote attacker to obtain sensitive information. No exploitation details are provided in the documents; CVSS base score is 6.5 (MEDIUM). Remediation or workaro...

CVE-2024-30569

Affected product: Netgear R6850 router, version 1.1.0.88. Vulnerability: Information disclosure in the currentsetting.htm page, exposing sensitive system information without authentication. Root cause (per sources): Hidden interface in currentsetting.htm that is not protected by authentication; u...

CVE-2024-30998

CVE-2024-30998 affects PHPGurukul Men Salon Management System v2.0. A SQL injection via the email parameter in index.php is documented, enabling remote data access and potentially arbitrary code execution. Root cause: inadequate input validation and unsafe query construction. Public sources consi...

CVE-2024-29413

CVE-2024-29413 affects Webasyst v2.9.9. A Cross Site Scripting vulnerability in the Instant messenger field of the Contact info function could allow a remote attacker to run arbitrary code. The provided documents consistently describe the same issue with Webasyst 2.9.9 and do not provide explicit...

CVE-2024-28515

CVE-2024-28515 affects CSAPP Lab3 (CSAPP Lab, version 15-213 Fall 20xx). The vulnerability is a Buffer Overflow in the lab3/buflab-update.pl component that enables remote code execution. Public details in connected documents confirm the affected product/code path and the underlying issue, with ex...

CVE-2024-3218

The CVE-2024-3218 entry affects Shibang Communications IP Network Intercom Broadcasting System v1.0, specifically the /php/busyscreenshotpush.php endpoint. The vulnerability arises from path traversal via manipulation of jsondata[callee]/jsondata[imagename] to escalate outside the intended direct...

CVE-2024-3248

CVE-2024-3248 affects Xpdf 4.05 and earlier due to a PDF object loop in attachments that triggers infinite recursion and a stack overflow. Connected advisories show remediation by upgrading to xpdf 4.06 (e.g., Fedora updates and Slackware SSA references), confirming a version-based fix. The avail...