CVE-2024-27190

CVE-2024-27190 affects WordPress Plugin Download Media (Jean-David Daviet) with Missing Authorization in versions n/a through 1.4.2. Root cause: broken access control allowing unauthorized access. Exploitation status is not provided in the documents. Patch status for this entry is Unpatched; reme...

CVE-2024-27956

Summary of CVE-2024-27956 (WordPress WP Automatic SQLi) : The WP Automatic plugin (WordPress) is vulnerable to unauthenticated SQL Injection, affecting versions up to 3.92.0 (and variants noting patch to 3.92.1). The underlying issue is insufficient input handling in the plugin’s SQL queries, ena...

CVE-2024-27968

CVE-2024-27968 is a Cross‑Site Request Forgery (CSRF) vulnerability in the WordPress plugin “Super Page Cache for Cloudflare,” which allows Stored XSS. Public details show affected software: Super Page Cache for Cloudflare, versions from n/a up to and including 4.7.5. The vulnerability is mitigat...

CVE-2024-2578

CVE-2024-2578 affects WP Coder (WordPress plugin) with Stored XSS due to improper input handling during page generation in versions up to 3.5. A fix is available in 3.5.1; CVSS metrics vary by source (NVD v3.1 base score 4.8; PatchStack guidance lists ~5.9). No exploitation details are provided b...

CVE-2024-2580

CVE-2024-2580 affects WordPress Automation By Autonami (FunnelKit Automations) up to version 2.8.2, with a Stored XSS in Cross Site Scripting via input during web page generation. Root cause: improper input neutralization/output escaping. Impact: potential stored attacker-controlled scripts execu...

CVE-2024-29180

CVE-2024-29180 affects the webpack-dev-middleware development middleware used with webpack-dev-server/webpack-dev-middleware. The vulnerability arises from improper URL unescaping/normalization before parsing the requested file, allowing path traversal via sequences like %2e and %2f to access loc...

CVE-2024-27964

CVE-2024-27964 affects the Zippy WordPress plugin (Gesundheit Bewegt GmbH) up to version 1.6.9. It is an Unrestricted Upload of File with Dangerous Type vulnerability that requires authenticated access (Editor+). Successful exploitation could allow an attacker to upload arbitrary files, potential...

CVE-2024-27965

CVE-2024-27965 is a stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin WPFunnels (Easiest Sales Funnel Builder for WordPress & WooCommerce) affecting versions up to 3.0.6. The issue stems from improper input neutralization during web page generation, enabling injected script ...

CVE-2024-29019

CVE-2024-29019 affects ESPHome’s dashboard API (version 2023.12.9 and prior) and is due to a CSRF flaw that lets a logged-in user’s session perform operations on configuration files if the victim visits a weaponized page. The issue enables bypassing authentication for API calls that manipulate co...

CVE-2024-27966

CVE-2024-27966 is a stored XSS in the WordPress plugin “Quiz And Survey Master” (ExpressTech) affecting versions up to 8.2.2. The root cause is improper neutralization of input during web page generation, enabling stored cross-site scripting when used by authenticated users. Wordfence/RedHat/NVD ...

CVE-2024-27967

CVE-2024-27967 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the plugin “DSGVO All in one for WP” by Michael Leithold. The vulnerability affects versions from n/a up to 4.3. The NVD metrics indicate a high-severity impact (CVSS v3.1: 8.8, HIGH) with network attack vector, no priv...

CVE-2024-27969

CVE-2024-27969 affects the Free Downloads WooCommerce WordPress plugin (Free Downloads WooCommerce) and is a Stored XSS vulnerability. It impacts Free Downloads WooCommerce versions up to 3.5.8.2 and arises from improper input neutralization during web page generation. Public sources in the Conne...

CVE-2024-27988

CVE-2024-27988 affects the WordPress plugin WEN Responsive Columns (

CVE-2024-27989

CVE-2024-27989 is a Cross‑site Scripting vulnerability in the WordPress plugin WP Responsive Tabs horizontal, vertical, and accordion Tabs. Multiple connected sources confirm a stored XSS flaw arising from improper neutralization of input during web page generation, affecting the plugin’s tab com...

CVE-2024-27991

CVE-2024-27991 affects the WordPress plugin SupportCandy (up to version 3.2.3). The issue is a Stored XSS caused by improper input neutralization during web page generation. Impact is stored XSS on affected pages; patch is available in 3.2.3 (upgrade to 3.2.3 or later). Other sources (Red Hat, NV...

CVE-2023-47715

CVE-2023-47715 describes an access-control vulnerability in IBM Storage Protect Plus Server. Affected: IBM Storage Protect Plus Server 10.1 (10.1.0–10.1.16). An authenticated user with read-only privileges could add or delete entries in an existing HyperVisor configuration, enabling unauthorized ...

CVE-2024-29880

JetBrains TeamCity prior to 2023.11 is vulnerable: users with access to the agent machine may escalate privileges to the user running the agent process due to dangerous methods used in the CI/CD system. Remediation per PT-2024-2340 is to upgrade to version 2023.11 or later; details in other sourc...

CVE-2024-29879

CVE-2024-29879 describes a Cross-Site Scripting (XSS) vulnerability in Sentrifugo 3.2. The flaw arises in the business_id parameter of the URL path /sentrifugo/index.php/index/getdepartments/format/html, where insufficient input filtering/escaping enables injection of arbitrary script code. Impac...

CVE-2024-29877

Sentrifugo 3.2 is affected by a Cross-Site Scripting (XSS) vulnerability in the endpoint /sentrifugo/index.php/expenses/expensecategories/edit, via the expense_category_name parameter. The issue arises from insufficient input filtering/escaping, enabling a remote attacker to craft a URL that coul...

CVE-2024-29876

CVE-2024-29876 is a SQL injection vulnerability in Sentrifugo 3.2 exploitable via the sortby parameter in /sentrifugo/index.php/reports/activitylogreport. Remote attackers could craft a query to exfiltrate data from the server. The connected documents provide explicit vulnerability details (affec...