CVE-2024-30868

CVE-2024-30868 affects netentsec NS‑ASG 6.3, with a SQL Injection vulnerability in /admin/add_getlogin.php. The issue is triggered via user-controlled input and is rated Critical (CVSS 3.1: 9.8, Network access, no user interaction, high confidentiality/ integrity/ availability impact). Public ref...

CVE-2024-30864

CVE-2024-30864 affects netentsec NS-ASG 6.3 with an SQL Injection vulnerability in the /admin/config_ISCGroupTimePolicy.php endpoint. The CVSSv3.1 vector is AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L (base score 6.3, MEDIUM). Attack requires adjacent access, no privileges, and no user interaction; impac...

CVE-2024-30860

CVE-2024-30860 affects netentsec NS-ASG version 6.3. The connected documents specify a SQL Injection in the endpoint /admin/export_excel_user.php, indicating an input handling/root-cause issue that allows arbitrary SQL execution. The impact is described as high (confidentiality, integrity, availa...

CVE-2024-30862

NetentSec NS-ASG 6.3 is vulnerable to SQL Injection via the /3g/index.php endpoint. Affected component: NS-ASG 6.3. Reported impact includes high confidentiality, integrity, and availability according to CVSS metrics. The connected sources confirm the vulnerability detail; no patch/version remedi...

CVE-2024-31033

CVE-2024-31033 concerns the JJWT (Java JWT) library up to version 0.12.5, where an issue in signing/verification could lead a user to falsely believe a key is strong due to ignored characters in signing operations (setSigningKey in DefaultJwtParser and signWith in DefaultJwtBuilder). IBM and Red ...

CVE-2024-30524

CVE-2024-30524 : Stored XSS in RedLettuce PDF Viewer for Elementor caused by improper input neutralization during web page generation. Affected: PDF Viewer for Elementor versions up to 2.9.3 (vendor listing notes “from n/a through 2.9.3”). CVSS v3.1 base score 5.4 (medium); impact limited to conf...

CVE-2024-30550

CVE-2024-30550 refers to an XSS vulnerability in wpdevart’s Responsive Image Gallery / Gallery Album. The issue is described as Reflected Cross-Site Scripting due to improper input neutralization during web page generation, affecting Gallery Album versions from n/a through 2.0.3. Connected source...

CVE-2024-30552

Technical details for CVE-2024-30552 are not provided in the supplied documents. Monitor for updates on affected products/versions and remediation.

CVE-2024-30556

Technical details beyond the initial description for CVE-2024-30556 are not present in the connected documents. The vulnerability is described as Stored XSS in Mighty Classic Pros And Cons plugin; no further product/version specifics or patch info are provided here. Monitor for updates.

CVE-2024-30557

The connected record for CVE-2024-30557 indicates a stored cross-site scripting flaw in Aesop Story Engine for WordPress, up to version 2.3.2. Root cause: improper neutralization of input during web page generation. Access requires authentication (Contributor+). Impact per docs: stored XSS, with ...

CVE-2024-30559

CVE-2024-30559 is a cross-site scripting (Stored XSS) vulnerability reported in the Spin 360 deg and 3D Model Viewer WordPress plugin. The CVE entry notes the flaw affects Spin 360 deg and 3D Model Viewer versions from an unspecified baseline up to 1.2.7. The linked Red Hat entry reiterates the i...

CVE-2024-31092

CVE-2024-31092 affects the Comic Easel WordPress plugin (reported by Philip M. Hofer/Frumph) with a Reflected XSS due to improper input neutralization during web page generation. Affected versions are from n/a through 1.15. The CVSS 3.1 base score is 7.1 (HIGH) with Network attack vector, User In...

CVE-2024-31104

CVE-2024-31104 is a stored XSS vulnerability in GetResponse for WordPress (≤ 5.5.33). Exploitation requires an authenticated user (Contributor+). The issue is unpatched according to the connected data, with CVSS v3.1 base score 6.5 (Medium). Affected component: input handling during web page gene...

CVE-2024-31106

Technical details about CVE-2024-31106 are not provided in the supplied documents; no affected versions, root cause specifics, or remediation information are included here. Monitor for updates.

CVE-2024-31107

Technical details for CVE-2024-31107 are not provided in the supplied documents. Monitor for updates; current materials reference XSS broadly but do not specify affected versions, vectors, exploit status, or fixes.

CVE-2024-31108

CVE-2024-31108 relates to iFlyChat – WordPress Chat (plugin), with a Stored XSS vulnerability in the web page generation input handling. The issue affects iFlyChat – WordPress Chat from n/a through 4.7.2, per the description. The connected data notes the vulnerability as a vulnerability in an act...

CVE-2024-31110

CVE-2024-31110 — Reflected XSS in Contact Form 7 Newsletter (WordPress plugin) via Katz Web Services, Katz Contact Form 7 Newsletter. The vulnerability is an improper input neutralization vulnerability that could affect from n/a through 2.2. CVSS v3.1 base score listed as 7.1 (HIGH). Connected Re...

CVE-2024-31117

CVE-2024-31117 is an HTML/JavaScript input handling vulnerability (Cross-site Scripting) in the WordPress plugin WooCommerce Bookings Calendar by Moises Heberle. The description (from Red Hat and the CVE entry) states this is an improper neutralization of input during web page generation, enablin...

CVE-2024-31121

CVE-2024-31121 is a Cross-Site Scripting (XSS) vulnerability in the HeartThis WordPress plugin, affecting version

CVE-2024-31115

CVE-2024-31115: Unrestricted Upload of File with Dangerous Type in Chauffeur Taxi Booking System for WordPress. Affected: Chauffeur Taxi Booking System for WordPress plugin (WordPress site) up to version 7.2; CVSS v3.1 base score 10.0 (Critical). Patch status: Unpatched in provided sources. No ex...