CVE-2024-30493

CVE-2024-30493 is a CSRF vulnerability in the Church Admin WordPress plugin (Church Admin), affecting versions from n/a up to 4.1.7. Connected Red Hat and Wordfence entries confirm the CSRF nature and the affected plugin, but public details on the root cause, affected configurations, exploit vect...

CVE-2024-30488

CVE-2024-30488 is tied to the Zotpress WordPress plugin (Zotpress, affected: n/a through 7.3.7) and is characterized as an SQL Injection. The linked Red Hat/WordFence entries confirm the issue exists as an authenticated (Contributor+) SQL injection against Zotpress and note a patched status, indi...

CVE-2024-30423

CVE-2024-30423 is an Stored XSS vulnerability in the WordPress plugin Better Elementor Addons, affecting versions from n/a up to 1.3.7. The initial description attributes the flaw to improper neutralization of input during web page generation. Red Hat’s entry provides the same description. The co...

CVE-2024-30456

CVE-2024-30456 describes a Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WPCS (WordPress Currency Switcher Pro). The issue affects WPCS versions from unspecified earliest release up to 1.2.0.1. The CVE entry includes an CVSS vector with AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicat...

CVE-2024-30457

CVE-2024-30457 is described as a CSRF vulnerability in the MDTF (Meta Data and Taxonomies Filter) WordPress plugin. The vulnerability reportedly affects MDTF versions from a-n/a up to 1.3.3.1. The connected Red Hat entry reiterates the CSRF description for the same CVE, but there are no concrete ...

CVE-2024-30458

CVE-2024-30458 describes a Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WOOCS – WooCommerce Currency Switcher. Public record indicates the issue affects WOOCS versions from unspecified initial release up to 1.4.1.7. The connected Red Hat advisory corroborates the CSRF nature and ...

CVE-2024-30520

CVE-2024-30520 : Stored XSS in Carousel Anything For WPBakery Page Builder (vulnerable up to and including 2.1). Root cause: improper input neutralization during web page generation. Impact: cross-site scripting exposure; exact affected products/versions limited to Carousel Anything For WPBakery ...

CVE-2024-3078

CVE-2024-3078 affects Qdrant prior to 1.8.3 (versions up to 1.6.1, 1.7.4, 1.8.2) and stems from path traversal in the Full Snapshot REST API handler (lib/collection/src/collection/snapshots.rs). The vulnerability allows traversal of filesystem paths due to the processing logic described in multip...

CVE-2023-6191

CVE-2023-6191 involves an SQL injection in Egehan Security WebPDKS, caused by improper neutralization of specific elements in SQL commands. Affected product is WebPDKS (through 20240329). Core impact is high across confidentiality, integrity, and availability; CVSSv3.1 vector indicates remote acc...

CVE-2024-0956

CVE-2024-0956 affects the WP ERP plugin for WordPress, with a time-based SQL Injection via the erp/v1/accounting/v1/vendors/1/products/ REST route. Exploitation requires authenticated admin/accounting privileges; the issue impacts WP ERP versions listed (initial doc says up to 1.13.0; Red Hat ent...

CVE-2024-1872

CVE-2024-1872 affects Button for WordPress (all versions

CVE-2024-2476

CVE-2024-2476 concerns OceanWP for WordPress. The vulnerability is due to a missing capability check in load_theme_panel_pane, affecting all versions up to 3.5.4. The impact, as described in the sources, is unauthorized access to data for authenticated users with subscriber-level access and above...

CVE-2024-2842

CVE-2024-2842 concerns the WordPress plugin Easy Appointments. The vulnerability is a Stored Cross-Site Scripting flaw in the plugin’s ea_full_calendar shortcode, caused by insufficient input sanitization and output escaping on user-supplied attributes. Affected versions are all versions up to an...

CVE-2024-1729

The CVE-2024-1729 entry concerns a timing-attack vulnerability in gradio-app/gradio, specifically in the login workflow (routes.py) where credentials are validated with a direct comparison (app.auth[username] == password). This timing discrepancy can allow an attacker to guess valid credentials b...

CVE-2024-30639

Summary: CVE-2024-30639 affects Tenda F1202 v1.2.0.20(408). The vulnerability is a stack overflow in the page parameter of the fromAddressNat function, caused by insufficient validation of input length. Impact: described as a stack overflow with potential denial of service; some sources also sugg...

CVE-2024-30623

Tenda FH1205, firmware v2.0.0.7(775), contains a stack overflow in the page parameter of the fromDhcpListClient function. The vulnerability’s root cause is improper validation of input data to that parameter, which can lead to denial of service. Public references in CNVD/CNNVD describe a stack ov...

CVE-2024-30629

CVE-2024-30629 affects Tenda FH1205 v2.0.0.7(775). The flaw is a stack overflow in the fromDhcpListClient function, triggered by the list1 parameter, which can lead to a denial of service. The risk context is supported by multiple sources in the connected documents describing the same vulnerabili...

CVE-2024-30625

CVE-2024-30625 affects Tenda FH1205 (v2.0.0.7(775)). The vulnerability is a stack/stack buffer overflow in the entrys parameter of the fromAddressNat function, with exploitation described as possible (PoC) and an adjacent-remote feasible attacker scenario. Impact is high (possible arbitrary code ...

CVE-2024-30638

The CVE-2024-30638 entry affects Tenda F1202 v1.2.0.20(408). Root cause: a stack overflow in the fromAddressNat function triggered by the entrys parameter. Exploitation guidance describes remote attackers sending a crafted POST to /goform/addressNat to trigger the overflow, with potential impact ...

CVE-2024-27619

The CVE-2024-27619 entry concerns D-Link Dir-3040us A1 (firmware 1.20b03a hotfix). The issue is a buffer overflow caused by a read/write FTP server path that allows uploading files larger than available RAM, leading to RAM exhaustion and a system crash/reboot. The FTP service permits changing the...