CVE-2024-27775

CVE-2024-27775 affects SysAid prior to version 23.2.14 b18. The vulnerability is a Server-Side Request Forgery (SSRF) issue that may expose the local operating system user’s NTLMv2 hash. The PT-security and other sources specify that versions before 23.2.14 b18 are impacted; remediation is to upg...

CVE-2024-30422

CVE-2024-30422 affects WPVibes Elementor Addon Elements (WordPress plugin) up to version 1.13.1. It is a Stored XSS caused by improper neutralization of input during web page generation. The vulnerability can impact confidentiality and integrity (as per CVSS metrics: C/L, I/L with UI/R; attack ve...

CVE-2023-52628

CVE-2023-52628 : Linux kernel netfilter nftables exthdr fix for a 4-byte stack OOB write. If priv->len is a multiple of 4, dst[len/4] can overflow the destination array, causing stack corruption. The bug affected the kernel since the 4.1 cycle and was carried forward with tcp/sctp and IP optio...

CVE-2022-45850

The CVE-2022-45850 entry concerns the WordPress plugin Nickys Image Map Pro (premium) with versions prior to 5.6.9. The vulnerability is described as a Cross-Site Request Forgery (CSRF) that enables Stored XSS. Affected component is the plugin’s CSRF handling which, when exploited, can store a sc...

CVE-2024-28002

Cornerstone (WordPress plugin) CVE-2024-28002 describes a Reflected XSS vulnerability in Cornerstone versions up to 0.8.0. The issue is caused by improper neutralization of input during web page generation, enabling script execution in a victim’s browser. Patch status shown in connected data is P...

CVE-2023-52231

CVE-2023-52231 affects Booster Plus for WooCommerce (WordPress). Root cause: missing authorization check allows unauthorized access to order information in versions prior to 7.1.2. Impact per available data: information disclosure of order data to unauthorized actors; CVSS base score 6.5 (Medium)...

CVE-2023-52234

CVE-2023-52234 refers to Booster Elite for WooCommerce. Patchstack confirms vulnerable versions are

CVE-2024-22138

CVE-2024-22138 affects the WordPress Seraphinite Accelerator plugin (versions up to 2.20.47). Root cause: insertion of sensitive information into log files, enabling potential information exposure. Impact is unauthenticated; vulnerable component is the logging path used by the plugin. Remediation...

CVE-2024-29239

Summary (CVE-2024-29239) : A SQL injection vulnerability exists in the Recording.CountByCategory webapi component of Synology Surveillance Station prior to 9.2.0-11289 and 9.2.0-9289. The issue stems from improper neutralization of special elements in SQL commands, enabling remote authenticated u...

CVE-2024-29238

Synology Surveillance Station is affected by an SQL Injection in the Log.CountByCategory webapi component. The issue arises from improper neutralization of elements in SQL commands, allowing remote authenticated users to read database contents (non-sensitive data) and perform limited denial-of-se...

CVE-2024-29235

The CVE-2024-29235 issue affects Synology Surveillance Station’s IOModule.EnumLog webapi component, where improper neutralization of input enables SQL Injection. Affected products/versions are Synology Surveillance Station before 9.2.0-11289 and before 9.2.0-9289. The vulnerability allows remote ...

CVE-2024-2890

CVE-2024-2890 affects the WordPress plugin Tumult Hype Animations up to version 1.9.12. The issue is an Unrestricted Upload of File with Dangerous Type due to insufficient validation in hypeanimations_panel_upload(), allowing authenticated attackers with author-level access to upload arbitrary fi...

CVE-2023-34370

CVE-2023-34370 is a Server-Side Request Forgery (SSRF) vulnerability affecting Brainstorm Force Starter Templates — Elementor, WordPress & Beaver Builder Templates and Brainstorm Force Premium Starter Templates up to version 3.2.4. The cited sources identify the root cause as SSRF and indicate af...

CVE-2024-28003

CVE-2024-28003 affects the WordPress plugin Max Mega Menu (Max Mega Menu) up to version 3.3 (inclusive). Root cause: missing authorization check in the sandbox() function enables “broken access control,” allowing unauthorised or limited-privilege actions by authenticated users (e.g., subscriber l...

CVE-2024-30221

CVE-2024-30221 concerns the WordPress plugin Sunshine Photo Cart, affected until version 3.1.1. The vulnerability is a PHP Object Injection via deserialization of untrusted data, allowing unauthenticated attackers to potentially inject objects. The issue is fixed in version 3.1.2; users should up...

CVE-2024-30222

CVE-2024-30222 affects ARMember WordPress plugin versions

CVE-2024-30224

CVE-2024-30224 covers a PHP Object Injection vulnerability in the WordPress plugin WholesaleX (WholesaleX plugin for WooCommerce). The issue arises from deserialization of untrusted data in all versions up to and including 1.3.2, allowing unauthenticated attackers to inject PHP objects. Impact de...

CVE-2024-0677

CVE-2024-0677 is a confirmed SSRF vulnerability in the Pz-LinkCard WordPress plugin (versions ≤ 2.5.1). The flaw allows high-privilege users (e.g., Contributors) to ping arbitrary external hosts via certain shortcodes, enabling SSRF. Red Hat and Patchstack entries corroborate the issue and note a...

CVE-2024-0672

The CVE concerns the Pz-LinkCard WordPress plugin (versions up to 2.5.1; later advisories reference fixes by 2.5.3) where user-supplied parameters are not properly sanitised or escaped before being echoed in the page. This causes a Reflected Cross‑Site Scripting vulnerability that can affect high...

CVE-2024-30226

CVE-2024-30226 affects the WordPress WPDeveloper BetterDocs plugin up to version 3.3.3. The vulnerability is due to deserialization of untrusted data, enabling PHP Object Injection and unauthenticated exploitation. Affects BetterDocs components handling untrusted input; PatchStack and related sou...