CVE-2024-30227

The CVE-2024-30227 entry concerns the WordPress Geo Controller plugin (≤ 8.6.4). The vulnerability is due to Deserialization of Untrusted Data leading to PHP Object Injection, with unauthenticated exploitation possible. Impact is high (confidentiality, integrity, availability all affected) and CV...

CVE-2024-30228

CVE-2024-30228 affects the WordPress Hercules Core plugin (≤ 6.4). The vulnerability is a PHP Object Injection via deserialization of untrusted input, exploitable by authenticated users with subscriber-level access. Impact (as stated) can include deletion of arbitrary files, exposure of sensitive...

CVE-2024-30229

CVE-2024-30229 affects GiveWP – Donation Plugin and Fundraising Platform for WordPress. It is a Deserialization of Untrusted Data vulnerability (PHP Object Injection) in GiveWP, with impact described as authenticated (GiveWP Manager+) PHP Object Injection. Affected versions are GiveWP from n/a th...

CVE-2024-30237

Summary of CVE-2024-30237 (WordPress Slider by Supsystic) : Affects the Supsystic Slider plugin for WordPress, versions up to 1.8.10. Root cause: improper neutralization of special elements in an SQL statement, resulting in an SQL Injection vulnerability. Impact/publication details from connected...

CVE-2024-30242

Affected product/variant: WordPress plugin “Contact Form to Any API” (versions

CVE-2024-2091

The CVE refers to WordPress plugin Elementor Addon Elements (Addon Elements for Elementor Page Builder). Affected versions: all up to 1.13.1 (and related advisory notes cite <= 1.13.2 as affected by an authenticated Stored Cross-Site Scripting vulnerability). Root cause: insufficient input san...

CVE-2024-3015

CVE-2024-3015 affects SourceCodester Simple Subscription Website 1.0, specifically the manage_plan.php/file path that handles plan management. Affected functionality allows manipulation of the id parameter, leading to SQL injection. The vulnerability is exploitable remotely and, per the sources, ...

CVE-2024-28006

CVE-2024-28006 affects NEC Aterm series (e.g., WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP, W1200EX(-MS), WG1200HS, WF300HP2, W300P, WF800HP, WR8165N, WG2200HP, WF1200HP2, WG1800HP2, WF1200HP, WG600HP, WG300HP, WG1400HP, WR8175N, WR9300N, WR8750N, WR8160N,...

CVE-2024-28005

CVE-2024-28005 affects NEC Aterm family (e.g., WG1800HP4, WG1200HS3, WG1900HP2, WR8165N, WM3400RN, WG1810HP, and many others listed in sources). The root cause is an Incorrect Permission Assignment for a Critical Resource (CWE-732) that, when combined with high privileges, allows an attacker to e...

CVE-2024-3013

The CVE-2024-3013 entry affects Teledyne FLIR AX8 (up to v1.46.16) in the User Registration component, specifically the /tools/test_login.php?action=register path. The root cause is an improper authorization vulnerability in an unknown function, allowing remote exploitation. Reports indicate the ...

CVE-2024-3011

CVE-2024-3011 affects Tenda FH1205 (version 2.0.0.7(775)). The vulnerability is in the function formQuickIndex of the file /goform/QuickIndex , where manipulating the PPPOEPassword parameter causes a stack-based buffer overflow . Exploitation can be performed remotely, and multiple sources note t...

CVE-2024-30589

Tenda FH1202 firmware v1.2.0.14(408) is affected by a stack overflow in the fromAddressNat function’s entrys parameter. The CVE-2024-30589 entry assigns a Critical CVSS v3.1 score (9.8) with network attack vector, no user interaction, and impact to confidentiality, integrity, and availability. Th...

CVE-2024-30606

CVE-2024-30606 affects Tenda FH1203 v2.0.1.6. Multiple sources describe a stack/ buffer overflow in the page parameter of the fromDhcpListClient function, enabling potential arbitrary code execution or denial of service. Exploitation vectors cited include remote POST requests to the /goform/DhcpL...

CVE-2024-31062

CVE-2024-31062 is a Cross Site Scripting vulnerability in the Insurance Management System, affected versions 1.0.0 and earlier. The issue allows a remote attacker to execute arbitrary code via the Street input field, indicating a client-side/script injection flaw in the Street field processing. T...

CVE-2024-30600

CVE-2024-30600 concerns the Tenda FH1203 router (v2.0.1.6). The issue is a stack overflow in the schedEndTime parameter of the setSchedWifi function. The public records describe this as a buffer/stack overflow that can impact the device’s security posture, with high-severity metrics (CVSSv3.1: AV...

CVE-2024-30593

The CVE-2024-30593 entry refers to a stack overflow in the Tenda FH1202 v1.2.0.14(408) where the deviceName parameter of the formSetDeviceName function can be overflowed. Public sources in the Connected documents confirm the vulnerability exists in the deviceName handling, with some references no...

CVE-2024-29489

CVE-2024-29489 affects JerryScript 2.4.0, with a segmentation fault in ecma_get_object_type (jerry-core/ecma/base/ecma-helpers.c:238:58). The description and connected documents confirm the vulnerable component/function but do not provide public details on exploitation, affected products beyond J...

CVE-2024-30590

CVE-2024-30590 affects Tenda FH1202 v1.2.0.14(408). The issue is a stack overflow in the schedEndTime parameter of the setSchedWifi function, as reported across multiple sources. Root cause: a stack buffer overflow in that parameter. Impact is described as a vulnerability in the device that can a...

CVE-2024-30586

CVE-2024-30586 affects Tenda FH1202 v1.2.0.14(408). A stack overflow vulnerability exists in the security_5g parameter of the formWifiBasicSet function. Documented impact is a stack overflow with potential crash conditions; CVSSv3.1 base score is 6.5 (Medium) with adjacent access, no privileges r...

CVE-2024-23727

CVE-2024-23727 affects the YI Smart Kami Vision (com.kamivision.yismart) Android app via version 1.0.0_20231219. The vulnerability stems from allow­ing an implicit Android intent to WebViewActivity to execute arbitrary JavaScript code, enabling a remote attacker to run JS on the device with no us...