CVE-2024-25937

Delta Electronics DIAEnergie DIAE_tagHandler.ashx contains an SQL injection vulnerability (CWE-89) caused by improper handling of SQL commands. Public sources describe an impact to the back-end database, with possible viewing, addition, modification, or deletion of data, affecting DIAEnergie prio...

CVE-2024-28891

Delta Electronics DIAEnergie is affected by a SQL injection in the Handler_CFG.ashx script (CWE-89). The ICS advisory (I CS A-24-074-12) and CNA entries identify the vulnerability as CVE-2024-28891 with a CVSS v3.1 score of 8.8 (High). The issue arises from improper neutralization of SQL commands...

CVE-2024-28119

CVE-2024-28119 — Grav vulnerable to SSTI via Twig escape handler . Grav (open-source flat-file CMS) prior to 1.7.45 allows an attacker to redefine the Twig escape function through unrestricted access to the twig extension class from the Grav context, enabling arbitrary command execution and privi...

CVE-2024-28118

Grav (open-source flat-file CMS) -- Affects versions prior to 1.7.45. Unrestricted access to the Twig extension class from the Grav context allows an attacker to redefine configuration variables, bypass a prior SSTI mitigation, and enable Twig processing of static pages by an admin. Since the Twi...

CVE-2024-28117

Grav (CVE-2024-28117) is vulnerable to Server-Side Template Injection due to improper validation of accessible functions: Utils::isDangerousFunction checks are bypassed for twig_array_map, allowing an attacker to execute arbitrary commands via the Twig processor when static pages are processed. A...

CVE-2024-27921

CVE-2024-27921 affects Grav CMS prior to 1.7.45. The vulnerability is a file upload path traversal in Grav’s media handling (MediaUploadTrait.php), allowing an attacker to replace or create files with extensions such as .json, .zip, .css, .gif, etc. The underlying risk includes arbitrary code exe...

CVE-2024-2764

The CVE-2024-2764 vulnerability affects Tenda AC10U 15.03.06.48, specifically the function formSetPPTPServer within /goform/SetPptpServerCfg. The issue is a stack-based buffer overflow caused by improper handling of the endIP argument, enabling remote initiation of an attack. Public exploits have...

CVE-2024-1727

Summary: CVE-2024-1727 describes a CSRF vulnerability in the Gradio application (gradio-app/gradio) that can allow an attacker to trigger unauthorized uploads of large files to a victim’s local Gradio server (gradio/routes.py), potentially exhausting disk space and causing a denial of service. Im...

CVE-2024-24883

CVE-2024-24883 affects BdThemes Prime Slider – Addons For Elementor (WordPress). Affected versions: up to 3.11.10. Root cause: missing authorization check in bdt_duplicate_as_draft() allows authenticated users with contributor-level access and above to duplicate private/password-protected posts. ...

CVE-2024-25907

CVE-2024-25907 affects WP Media Folder plugin for WordPress (versions

CVE-2024-24850

CVE-2024-24850: Quicksand Post Filter jQuery Plugin (WordPress) <= 3.1.1 has a Missing Authorization vulnerability via quicksand_admin_ajax, allowing unauthenticated access to delete arbitrary site options (Broken Access Control). The CVE is listed with a high risk in WordPress vulnerability f...

CVE-2022-44633

CVE-2022-44633 affects YITH WooCommerce Gift Cards Premium up to version 3.23.1. The issue is described as Missing Authorization / Broken Access Control, enabling unauthenticated actors to perform unauthorized actions (wording varies across sources, including ‘Unauth Gift Card Creation’ leading t...

CVE-2024-25908

CVE-2024-25908 affects the WordPress plugin WP Media Folder (JoomUnited) up to version 5.7.2. The root cause is missing authorization validation, enabling unauthenticated or subscriber-level users to modify post/page titles and excerpts. Public sources in connected data confirm the vulnerability ...

CVE-2024-25912

CVE-2024-25912 concerns the WordPress Moveto (MoveTo) plugin by Skymoonlabs, affecting MoveTo versions from n/a through 6.2. The root issue is Missing Authorization, allowing an unauthenticated attacker to perform an Unauthenticated Settings Change. The CVSS 3.1 base score is 9.8 (Network attack ...

CVE-2024-25922

The CVE-2024-25922 entry describes a Missing Authorization vulnerability in the Peach Payments Gateway WordPress plugin (Peach Payments Gateway) affecting versions up to 3.1.9. The root cause is broken access control via peach_core_version_rollback(), allowing unauthorized actions by subscribers ...

CVE-2024-25935

RegistrationMagic (WordPress plugin)

CVE-2023-27607

The CVE-2023-27607 issue affects the WordPress plugin Points and Rewards for WooCommerce (versions up to and including 1.5.0). The root cause is Missing Authorization checks, allowing unauthorized users to change settings. Impact is a Low-severity exposure (CVSS 5.4) involving settings changes. M...

CVE-2022-44595

CVE-2022-44595 : WordPress WP2FA plugin

CVE-2024-27277

CVE-2024-27277 affects IBM Storage Protect Plus Server (Version 10.1.0–10.1.16). It discloses the private key used in the server certificate, undermining certificate security. Remediation: upgrade to 10.1.16.1 on Linux (Fixing Level 10.1.16.1). Connected sources confirm the affected product/versi...

CVE-2023-49837

CVE-2023-49837 concerns the WordPress Code Embed (simple-embed-code) plugin. A Denial of Service vulnerability exists in Code Embed versions ≤ 2.3.6 that allows an authenticated attacker with Contributor+ privileges to trigger uncontrolled resource consumption, potentially impacting site availabi...