CVE-2024-2813

CVE-2024-2813 affects Tenda AC15 (firmware 15.03.20_multi). The vulnerability is in the function form_fast_setting_wifi_set (/goform/fast_setting_wifi_set); manipulating the ssid parameter causes a stack-based buffer overflow. It is exploitable remotely and exploit details are publicly disclosed....

CVE-2024-2812

CVE-2024-2812 affects Tenda AC15 (versions 15.03.05.18–15.03.20_multi) via the formWriteFacMac /goform/WriteFacMac endpoint. The mac argument can be manipulated to trigger OS command injection, enabling remote code execution. Public exploitation has been disclosed. Related sources confirm the iss...

CVE-2024-2811

The CVE-2024-2811 issue affects the Tenda AC15 15.03.20_multi, specifically the function formWifiWpsStart in /goform/WifiWpsStart. The vulnerability is triggered by manipulating the index argument, causing a stack-based buffer overflow. It can be exploited remotely and has been disclosed publicly...

CVE-2024-2810

CVE-2024-2810 affects Tenda AC15 firmware versions 15.03.05.18–15.03.20_multi. The vulnerability is in function formWifiWpsOOB of file /goform/WifiWpsOOB, where manipulating the argument index leads to a stack-based buffer overflow. This can be triggered remotely, with public exploit disclosures....

CVE-2024-2809

Summary of CVE-2024-2809 (Tenda AC15) A stack-based buffer overflow vulnerability exists in the Tenda AC15 router, specifically in the function formSetFirewallCfg of the page /goform/SetFirewallCfg . Manipulation of the argument firewallEn can be exploited remotely to gain execution on the device...

CVE-2024-2808

CVE-2024-2808 affects Tenda AC15 (versions 15.03.05.18 through 15.03.20_multi). The flaw is in function formQuickIndex of /goform/QuickIndex, where manipulating the PPPOEPassword argument triggers a stack-based buffer overflow. Impact includes potential unauthorized remote code execution with eff...

CVE-2024-2807

CVE-2024-2807 – Tenda AC15 : A stack-based buffer overflow in the /goform/expandDlnaFile endpoint, arising from unsafely handling the filePath parameter in the function formExpandDlnaFile. Affected: Tenda AC15 firmware 15.03.05.18 and 15.03.20_multi. Impact: remote attacker could exploit to execu...

CVE-2024-2806

The CVE-2024-2806 entry concerns Tenda AC15 routers (versions 15.03.05.18–15.03.20_multi). The vulnerability lies in the addWifiMacFilter function at /goform/addWifiMacFilter , where unsafely handling the arguments deviceId/deviceMac leads to a stack-based buffer overflow . This can be triggered ...

CVE-2024-2805

Summary: CVE-2024-2805 affects Tenda AC15 routers (versions 15.03.05.18–15.03.20_multi) via the /goform/SetSpeedWan endpoint. The root cause is a stack-based buffer overflow triggered by manipulating the speed_dir argument in the formSetSpeedWan function, which can be exploited remotely and may i...

CVE-2024-0957

CVE-2024-0957 affects the WordPress plugin “WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels” up to version 4.4.1. It is a stored cross‑site scripting vulnerability in the Customer Notes field caused by insufficient input sanitization and output escaping, allowing unaut...

CVE-2024-2500

CVE-2024-2500 affects ColorMag WordPress theme up to v3.1.6, where a Stored Cross-Site Scripting (XSS) flaw arises from a user's Display Name due to insufficient input sanitization and output escaping. The vulnerability requires authenticated access at Contributor level or higher and can allow in...

CVE-2024-2392

CVE-2024-2392 affects Blocksy Companion for WordPress; versions up to and including 2.0.31 are vulnerable to Stored XSS via the Newsletter widget due to insufficient input sanitization/escaping. Exploitation requires Contributor+ authenticated access; impact is arbitrary script injection in pages...

CVE-2024-2080

CVE-2024-2080 affects the LiquidPoll – Polls, Surveys, NPS and Feedback Reviews WordPress plugin. The vulnerability enables Sensitive Information Exposure via the poller_list shortcode in all versions up to and including 3.3.76, allowing authenticated attackers with contributor-level access or hi...

CVE-2024-2780

CVE-2024-2780 affects Campcodes Online Marriage Registration System 1.0. A cross-site scripting flaw exists in the admin-profile.php file via the adminname parameter, exploitable remotely. Public disclosure is noted. Red Hat and other sources corroborate the same issue. The root cause is input ha...

CVE-2024-2779

Campcodes Online Marriage Registration System 1.0 is affected by a cross-site scripting (XSS) issue in the /admin/application-bwdates-reports-details.php file, caused by manipulation of the fromdate parameter. Exploitation is possible remotely and the exploit has been disclosed publicly. Several ...

CVE-2024-2778

CVE-2024-2778 affects Campcodes Online Marriage Registration System 1.0, specifically the /admin/search.php endpoint. The vulnerability arises from unsanitized input in the searchdata parameter, enabling cross-site scripting (XSS). Exploitation may be performed remotely and the exploit has been d...

CVE-2024-29271

VvvebJs (software/library) is affected by a reflected XSS vulnerability (CVE-2024-29271) present in versions before 1.7.7. The issue allows remote attackers to exfiltrate data or execute arbitrary code via the action parameter in save.php. Affected versions: VvvebJs

CVE-2023-41099

CVE-2023-41099 affects the Windows installer of Atos Eviden CardOS API prior to version 5.5.5.2811, enabling local privilege escalation from a regular user to SYSTEM. The issue is documented across multiple sources (NVD, Red Hat advisory, CNNVD, CVE list) with the same description. Remediation: u...

CVE-2024-28560

Affected product : Niushop B2B2C, all versions up to 5.3.3. Vulnerability : SQL injection in Niushop B2B2C, enabling privilege escalation via functions in Address.php (deleteArea()) and, per several sources, also via Goodsbatchset.php (setPrice()). Root cause : Improper handling of user-supplied ...

CVE-2024-25808

Lychee 3.1.6 is affected by a Cross-site Request Forgery (CSRF) vulnerability that enables remote attackers to execute arbitrary code via the create new album function. The issue is documented across multiple sources (e.g., NVD/Red Hat/CVE records and PT Security), all referencing Lychee 3.1.6 as...