CVE-2021-33633

CVE-2021-33633 affects openEuler aops-ceres (Linux) with OS Command Injection through ceres/function/util.py; affected versions 1.3.0–1.4.1. Root cause: improper neutralization of special elements in OS command handling. Impact: local privilege escalation/command execution (CVSSv3.1: AV:L/AC:L/PR...

CVE-2024-2832

Summary of CVE-2024-2832 : Campcodes Online Shopping System 1.0 is affected by a cross-site scripting (XSS) vulnerability in the file /offersmail.php caused by improper handling of the email parameter. The issue allows an attacker to inject malicious scripts via remote access, with exploitation d...

CVE-2024-2202

CVE-2024-2202 affects Page Builder by SiteOrigin for WordPress. It is a Stored XSS via the legacy Image widget in all versions up to 2.29.6, exploitable by authenticated users with contributor+ access to inject scripts executed when users view the affected pages. A fix exists in 2.29.7; update to...

CVE-2024-2688

The CVE-2024-2688 entry concerns the WordPress plugin EmbedPress (all versions up to 3.9.12; 3.9.13 introduced a fix). Root cause: insufficient input sanitization and output escaping on EmbedPress widget attributes (embedpress_doc_custom_color). Impact: authenticated attackers with Contributor+ p...

CVE-2024-2131

The CVE-2024-2131 entry pertains to Move Addons for Elementor (WordPress). It affects all versions up to 1.2.9 and describes a Stored Cross-Site Scripting (XSS) via the plugin’s infobox and button widget due to insufficient input sanitization and output escaping on user-supplied attributes. Authe...

CVE-2024-1697

CVE-2024-1697 affects the Custom WooCommerce Checkout Fields Editor plugin for WordPress, up to version 1.3.1. Root cause: insufficient input sanitization and output escaping in save_wcfe_options, enabling Stored XSS. Impact: authenticated users with subscriber+ access can inject scripts that exe...

CVE-2024-2025

CVE-2024-2025 pertains to the WordPress plugin “BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages.” It is a PHP Object Injection vulnerability caused by deserialization of untrusted input in the get_simple_request function, affecting all versions up to and including 3...

CVE-2024-23755

ClickUp Desktop prior to version 3.3.77 (macOS and Windows) is affected by a code injection vulnerability due to Electron Fuses, specifically inadequate protection around RunAsNode settings. The issue, described across multiple sources (NVD/Red Hat/CVE records and corroborating security portals),...

CVE-2024-24725

Gibbon CVE-2024-24725 affects Gibbon up to version 26.0.00 and earlier, enabling remote authenticated PHP deserialization via columnOrder in a POST to modules/System Admin/import_run.php&type=externalAssessment&step=4. Metasploit’s gibbon_auth_rce_cve_2024_24725 module documents this as a Remote ...

CVE-2024-29059

CVE-2024-29059 is a Microsoft .NET Framework information disclosure vulnerability that leaks ObjRef URIs, enabling potential .NET Remoting abuse. Public traces show exploitation activity (CISA KEV catalog; numerous sightings). Public advisories/entries confirm affected .NET Framework versions and...

CVE-2024-29190

MobSF (Mobile Security Framework) vulnerability CVE-2024-29190 causes SSRF via hostname extraction in android:host when input validation is not performed in versions up to 3.9.5 Beta. The issue arises from host resolution in valid_host(), where socket.gethostbyname() can be abused with DNS rebind...

CVE-2024-29057

Microsoft Edge (Chromium-based) is affected by CVE-2024-29057, described as a spoofing vulnerability that can spoof user interface elements. The data indicates network-based access with low attack complexity and user interaction required, yielding a MEDIUM severity (CVSS 3.1: 4.3) and potential U...

CVE-2024-26247

CVE-2024-26247 is a Microsoft Edge (Chromium-based) security feature bypass vulnerability. Affected component: Edge’s Chromium-based browser; root cause: bypass of security features as described in multiple sources. Impact: ensures bypass with a CVSSv3.1 base score of 4.7 (Network, no confidentia...

CVE-2024-2828

CVE-2024-2828 affects lakernote EasyAdmin, specifically the function thumbnail in src/main/java/com/laker/admin/module/sys/controller/IndexController.java. The issue arises from manipulation of the argument url, leading to a server-side request forgery (SSRF) . Exploitation was disclosed publicly...

CVE-2024-2825

CVE-2024-2825 (lakernote EasyAdmin) : A critical path-traversal vulnerability affects an unknown part of the file /ureport/designer/saveReportFile. Manipulating the file argument enables path traversal (e.g., ../filedir) and can be exploited remotely. Multiple sources confirm the issue for lakern...

CVE-2023-5685

Technical details about CVE-2023-5685 are not provided in the connected documents. No confirmed affected products/versions or patches can be derived from the supplied materials. Monitor official advisories for updates.

CVE-2024-2824

CVE-2024-2824 affects Matthias-Wandel jhead 3.08. The vulnerability is in the function PrintFormatNumber of exif.c and results in a heap-based buffer overflow. The manipulation can be exploited remotely; a public exploit/POC has been disclosed. No remediation details are provided in the connected...

CVE-2024-29184

FreeScout before 1.8.128 is affected by a Stored XSS in the Signature Input Field. The CSP policy (script-src 'self' 'nonce-abcd') blocks inline scripts and nonces, but an attacker bypassed it by uploading a JS file via POST to /conversation/upload and then using the uploaded file’s URL as the sr...

CVE-2024-2823

CVE-2024-2823 affects DedeCMS 5.7, impacting the /src/dede/mda_main.php path. The issue is a cross-site request forgery (CSRF) vulnerability that can be triggered remotely; the CVSS vectors indicate NETWORK access, LOW attack complexity, NONE privileges, UI interaction required, with I/LOW impact...

CVE-2024-2822

CVE-2024-2822 affects DedeCMS 5.7, targeting the /src/dede/vote_edit.php component. The issue arises from manipulating the parameter aid , enabling remote cross-site request forgery (CSRF). Exploitation has been disclosed publicly; no patch/versioned fix is documented in the provided sources. A p...