CVE-2024-29915

CVE-2024-29915 affects Podlove Podlove Podcast Publisher for WordPress (affected versions: n/a through 4.0.9). The vulnerability is an XSS issue arising from improper neutralization of input during web page generation (Reflected XSS). The connected Red Hat entry reiterates the same description, c...

CVE-2024-29914

Technical details about CVE-2024-29914 are not provided in the supplied documents. The initial entry notes a Stored XSS in MotoPress Stratum (WordPress plugin) up to version 1.3.15, but no fix/impact specifics are included here.

CVE-2024-29913

CVE-2024-29913 is an improper input handling vulnerability causing Stored XSS in Tutor LMS Elementor Addons (Themeum). Affected: Tutor LMS Elementor Addons up to 2.1.3. Root cause: improper neutralization of input during web page generation. Impact: stored XSS. Remediation/patch details are not p...

CVE-2024-29907

CVE-2024-29907 affects the SEO Backlink Monitor plugin for WordPress, exposing a Reflected XSS in web page generation. Affected: SEO Backlink Monitor

CVE-2024-30193

CVE-2024-30193 concerns the WordPress plugin Church Admin by Andy Moyle. Connected documents confirm a Stored XSS vulnerability in Church Admin, described as Improper Neutralization of Input During Web Page Generation, enabling XSS via meta-text/shortcode vectors. Affected software: Church Admin

CVE-2024-2954

CVE-2024-2954 affects the Action Network WordPress plugin (version 1.4.3) and is due to insufficient escaping of the bulk-action parameter, enabling an authenticated attacker with administrator-level access or higher to inject arbitrary SQL into existing queries. This could lead to extraction of ...

CVE-2024-27188

CVE-2024-27188 concerns the WordPress Breeze plugin (Cloudways Breeze) with a stored XSS vulnerability caused by improper neutralization of input during web page generation. Affected versions are Breeze through 2.1.3; the patch is to upgrade to version 2.1.4 or later. The issue requires the attac...

CVE-2024-30197

CVE-2024-30197 corresponds to an authenticated Stored XSS in the WordPress plugin Church Admin. According to the entry, Church Admin versions up to 4.0.26 are affected and allow stored XSS via shortcode due to improper input neutralization during web page generation. The vulnerability impact is c...

CVE-2024-30199

CVE-2024-30199 is a Reflected XSS in WP-Lister Lite for Amazon (WordPress plugin) affecting versions up to 2.6.8. Connected Red Hat entry corroborates the same vulnerability description. The CVSSv3.1 base metrics provided in the initial data indicate a base score of 7.1 (HIGH) with Network attack...

CVE-2024-22299

CVE-2024-22299 describes a Reflected XSS in FV Flowplayer Video Player for WordPress, affecting FV Flowplayer Video Player: from n/a through 7.5.41.7212. Affected software is FV Flowplayer WordPress plugin; CVSS 3.1/3.1 base score 7.1 (High). Attack vector: Network; Impact: confidentiality, integ...

CVE-2024-24700

CVE-2024-24700 affects the WordPress WP Editor plugin

CVE-2024-2943

CVE-2024-2943 affects Campcodes Online Examination System 1.0. The vulnerability resides in the file /adminpanel/admin/query/deleteExamExe.php, where manipulating the id parameter triggers a SQL injection. Exploitation can be performed remotely and the vulnerability has been publicly disclosed. M...

CVE-2024-2097

CVE-2024-2097 affects Hitachi Energy MACH SCM Server. An authenticated malicious client can use the SCM List control to submit a crafted LINQ query and remotely execute arbitrary code on the SCM Server (the host running SCMArchivedEventViewerTool). The vulnerability path relies on authenticated a...

CVE-2024-2942

CVE-2024-2942 affects Campcodes Online Examination System 1.0, leveraging SQL injection via the id parameter in /adminpanel/admin/query/deleteQuestionExe.php. Multiple connected sources confirm remote exploitation potential and that the vulnerability stems from unsanitized input in deleteQuestion...

CVE-2024-2941

Campcodes Online Examination System 1.0 contains a SQL injection vulnerability in the /adminpanel/admin/query/loginExe.php loginExe.php handler. The issue arises from unsafely manipulating the pass parameter, enabling remote exploitation. Multiple connected sources confirm the vulnerability's exi...

CVE-2024-1532

Hitachi Energy RTU500 CMU Firmware is affected by CVE-2024-1532 (stb-language file handling). A specially crafted stb-language file uploaded by an authorized user could cause diagnostic texts to be displayed as empty strings. Affected firmware ranges include 12.0.1–12.0.14, 12.2.1–12.2.11, 12.4.1...

CVE-2024-2940

CVE-2024-2940 affects Campcodes Online Examination System 1.0. The vulnerability is a cross-site scripting in the /adminpanel/admin/facebox_modal/updateCourse.php file triggered by manipulating the id argument. It is remotely exploitable and has been publicly disclosed (VDB-258031). Public notice...

CVE-2024-2206

CVE-2024-2206 describes an SSRF vulnerability in the gradio-app/gradio project where insufficient validation of user-supplied URLs in the /proxy route allows manipulation of the self.replica_urls set via the X-Direct-Url header on requests to the / and /config routes. This enables attackers to ad...

CVE-2024-25389

The CVE-2024-25389 entry concerns RT-Thread up to version 5.0.2, where the function calc_random (rt_random.c) uses a weak linear congruential generator seed = 214013L * seed + 2531011L; return (seed >> 16) & 0x7FFF;. This results in predictable random numbers and thus potential exploitation...

CVE-2024-24335

The CVE-2024-24335 entry describes a heap buffer overflow in RT-Thread’s dfs_v2 romfs filesystem (RT-Thread RTOS) affecting version 5.0.2 and earlier. The vulnerability stems from insufficient validation of input data length in the dfs_v2 romfs file handling, enabling a overflow of the heap. Repo...