CVE-2024-1800

Progress Telerik Report Server CVE-2024-1800 describes an insecure deserialization vulnerability in versions prior to 2024 Q1 (10.0.24.130) that enables remote code execution. The issue arises from deserialization flaws in the server, allowing an attacker to trigger code execution remotely. Sever...

CVE-2024-1811

CVE-2024-1811 affects OpenText ArcSight Platform. Connected PT-2024-18327 documentation indicates versions up to 24.1.0 are affected and that the issue could be remotely exploited, potentially enabling remote code execution. Affected software is OpenText ArcSight Platform; root cause details are ...

CVE-2023-52229

CVE-2023-52229 concerns Word Replacer Pro (WordPress plugin)

CVE-2024-2702

CVE-2024-2702 covers Olive One Click Demo Import (Olive Themes) with Missing Authorization that enables importing settings/data and leads to XSS on versions up to 1.1.1. Public sources confirm a patch in 1.1.2. Remediation: upgrade to Olive One Click Demo Import 1.1.2 or apply vendor-provided fix...

CVE-2024-2687

CVE-2024-2687 affects Campcodes Online Job Finder System 1.0. A SQL injection vulnerability exists in the /admin/applicants/index.php file when the id parameter is manipulated, potentially allowing remote exploitation. Public exploit information is noted, and multiple sources (NVD entry and vendo...

CVE-2024-2686

CVE-2024-2686 affects Campcodes Online Job Finder System 1.0. The vulnerability is a cross-site scripting flaw in /admin/applicants/controller.php, triggered by manipulating the JOBREGID parameter. Exploitation is remote, and public exploits have been disclosed. CVSS metrics indicate a MEDIUM sev...

CVE-2024-2684

CVE-2024-2684 affects Campcodes Online Job Finder System 1.0. The vulnerability is in the file /admin/category/index.php, where manipulating the numeric/string parameter view leads to cross-site scripting (XSS). The issue is exploitable remotely and has been publicly disclosed. Multiple sources c...

CVE-2024-2683

The CVE-2024-2683 entry concerns Campcodes Online Job Finder System 1.0. The vulnerability is a cross-site scripting (XSS) flaw in the /admin/company/index.php file, caused by manipulating the view parameter. It is exploitable remotely, and public exploit details have been disclosed. Affected fun...

CVE-2024-2680

CVE-2024-2680 affects Campcodes Online Job Finder System 1.0. The vulnerability is a cross-site scripting issue in the /admin/user/index.php file, caused by manipulation of the view parameter. It is exploitable remotely, and multiple sources confirm that the exploit has been disclosed publicly. C...

CVE-2024-2679

CVE-2024-2679 affects Campcodes Online Job Finder System 1.0. A cross-site scripting vulnerability exists in the /admin/vacancy/index.php file, caused by manipulation of the view parameter. It can be exploited remotely, and public exploits are noted. Impact details in sources indicate user intera...

CVE-2024-2678

CVE-2024-2678 affects Campcodes Online Job Finder System v1.0, specifically the /admin/applicants/controller.php functionality. The root cause is a SQL injection vulnerability via the JOBREGID parameter, which can be exploited remotely. The vulnerability is confirmed across multiple sources (e.g....

CVE-2024-1325

CVE-2024-1325 affects the Live Sales Notification for Woocommerce – Woomotiv WordPress plugin (versions ≤ 3.4.3). The vulnerability is Cross-Site Request Forgery due to missing or incorrect nonce validation in the ajax_cancel_review function, enabling unauthenticated attackers to reset the site’s...

CVE-2024-1711

The CVE-2024-1711 vulnerability affects the Create by Mediavine WordPress plugin (versions up to and including 1.9.4). It enables unauthenticated SQL Injection via the id parameter due to insufficient escaping and lack of proper query preparation, allowing an attacker to inject additional SQL and...

CVE-2024-1379

CVE-2024-1379 affects Website Article Monetization By MageNet for WordPress. All versions up to 1.0.11 are vulnerable to unauthenticated Stored XSS via the abp_auth_key parameter due to insufficient input sanitization/output escaping and a missing authorization check, enabling injection of script...

CVE-2024-2304

The CVE refers to the WordPress Animated Headline plugin (affected: all versions up to 4.0) with a Stored XSS vulnerability via the animated-headline shortcode caused by insufficient input sanitization and lack of proper output escaping on user-supplied attributes. Exploitation requires authentic...

CVE-2024-1119

CVE-2024-1119 – Order Tip for WooCommerce (WordPress) : Unauthenticated users can export the plugin’s order fees due to a missing authorization check in export_tips_to_csv() across all versions up to 1.3.1. This is a broken access control vulnerability that enables data exposure. A fix is availab...

CVE-2024-1844

CVE-2024-1844 (RevivePress plugin) Vulnerability in RevivePress – Keep your Old Content Evergreen for WordPress (up to version 1.5.6) due to missing capability checks in import_data and copy_data. This enables authenticated attackers with subscriber-level access or higher to view and modify plugi...

CVE-2024-2459

CVE-2024-2459 affects the WordPress plugin UX Flat. The Red Hat and Wordfence entries confirm: all versions up to and including 4.1 are vulnerable to a Stored Cross-Site Scripting (XSS) via the plugin’s button shortcode, caused by insufficient input sanitization and output escaping of user-suppli...

CVE-2024-2129

CVE-2024-2129: WPBITS Addons For Elementor Page Builder for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s heading widget in all versions up to and including 1.3.4.2, due to insufficient input sanitization and output escaping on user-supplied attributes. Attack scenario: ...

CVE-2024-2677

CVE-2024-2677 concerns Campcodes Online Job Finder System 1.0. Affected component: the file /admin/category/controller.php, where manipulating the CATEGORYID parameter triggers an SQL injection. The vulnerability can be exploited remotely; multiple sources label the issue as critical. The exploit...