CVE-2024-27996

CVE-2024-27996 affects the WordPress plugin Survey Maker (Survey Maker – Best WordPress Survey Plugin) with a Stored XSS vulnerability caused by improper input neutralization during web page generation. It applies to versions up to and including 4.0.5. The connected documents indicate the issue i...

CVE-2024-27997

CVE-2024-27997 is a stored cross-site scripting vulnerability in Visual Composer Website Builder. The initial and connected documents indicate the flaw stems from improper input neutralization during web page generation, allowing stored XSS. Affected software is Visual Composer Website Builder, w...

CVE-2024-29091

CVE-2024-29091 affects WP Armour – Honeypot Anti Spam (WordPress plugin). The connected documents confirm a Reflected XSS caused by improper input neutralization during web page generation, affecting WP Armour – Honeypot Anti Spam versions from n/a up to 2.1.13. The CVSS 3.1 base score is 7.1 (HI...

CVE-2024-29092

CVE-2024-29092 is a reflected XSS in Permalink Manager Lite for WordPress. The root cause is improper input neutralization during web page generation. Affected: Permalink Manager Lite versions from n/a up to and including 2.4.3. Remediation: update to the patched version (2.4.3 or later).

CVE-2024-29094

CVE-2024-29094 relates to HT Easy GA4 (HasThemes) for WordPress, vulnerability type: Stored XSS due to Improper Neutralization of Input During Web Page Generation. Affected software: HT Easy GA4 (Google Analytics 4) plugin; affected range: from n/a through version 1.1.7. The impact is stored cros...

CVE-2023-41793

CVE-2023-41793 is a path traversal vulnerability in Pandora FMS affecting versions 700 through 776. The issue allows an attacker to change directories, create files, and download them outside the permitted directories, potentially enabling writing arbitrary files and enabling a later chain to rem...

CVE-2023-44092

CVE-2023-44092 affects Pandora FMS versions 700 through

CVE-2024-2442

The CVE-2024-2442 vulnerability affects Franklin Fueling System EVO 550 and EVO 5000 (ATG) with versions prior to 2.26.3.8963. It is a Path Traversal (CWE-25) flaw that could allow an attacker to access sensitive files on the system, potentially enabling remote exploitation with low attack comple...

CVE-2023-44090

Summary: Pandora FMS versions 700–776 are affected by an SQL Injection flaw tied to the Grafana module, caused by improper neutralization of SQL elements. The vulnerability enables unauthorized modification of multiple files in the Grafana component. Impact (as stated): potential risk to data and...

CVE-2024-29095

CVE-2024-29095 affects the Site Reviews WordPress plugin (versions n/a through 6.11.6). The vulnerability is a Stored XSS arising from improper input neutralization during web page generation. Exploitation could allow an attacker to inject script that runs in a victim user’s browser; CVSS 3.1/3.1...

CVE-2024-29096

CVE-2024-29096 is an XSS vulnerability in the MJM Clinic WordPress plugin (MJM Clinic), affecting versions from unspecified up to and including 1.1.22. The root cause is improper neutralization/escaping of user input during web page generation, enabling cross‑site scripting. The Red Hat entry rei...

CVE-2023-32260

CVE-2023-32260 describes a Misinterpretation of Input vulnerability affecting OpenText SMAX, AMX, and HCMX. Affected: SMAX versions 2020.05–2023.05; AMX versions 2021.08–2023.05; HCMX versions 2020.05–2023.05. Root cause: misinterpretation of input data leading to input data manipulation. Impact ...

CVE-2023-32259

CVE-2023-32259 concerns insufficient granularity of access control in OpenText SMAX and AMX. Affected products/versions: SMAX 2020.05–2022.11 and AMX 2021.08–2022.11. Root cause per sources: incorrectly configured access control security levels leading to improper access checks. Potential impact ...

CVE-2023-6597

CVE-2023-6597 affects CPython’s tempfile.TemporaryDirectory behavior across multiple Python releases. The issue arises when cleanup dereferences symlinks during permissions-related error handling, potentially allowing a user running privileged programs to modify permissions of files referenced by...

CVE-2024-29103

CVE-2024-29103 is an authenticated, stored XSS vulnerability in the WordPress plugin “Database for Contact Form 7” affecting versions up through 3.0.6. The issue is documented by Wordfence under Vulnerability ID CVE-2024-29103, noting that the flaw has been patched (Patch Status: Patched) and tha...

CVE-2024-29106

CVE-2024-29106 affects LeapWorx’s Leap13 Premium Addons for Elementor (WordPress Premium Addons for Elementor) up to version 4.10.16. The issue is an Improper Neutralization of Input During Web Page Generation, i.e., Stored XSS. Root cause: insufficient input sanitization in the affected plugin’s...

CVE-2024-0450

The CVE-2024-0450 issue affects the CPython zipfile module across multiple releases (3.12.1, 3.11.7, 3.10.13, 3.9.18, 3.8.18 and earlier). It exploits the zip format via “quoted-overlap” zip-bombs, where crafted archives with overlapping entries can cause excessive processing. The fixed CPython r...

CVE-2024-29111

CVE-2024-29111 affects Sitekit (Webvitaly Sitekit) up to version 1.6. Root cause: Improper neutralization of input during web page generation enabling Stored XSS. Impact: Stored cross-site scripting on affected Sitekit pages. No patch/fix details provided in the available documents.

CVE-2024-29112

CVE-2024-29112 is a stored XSS in the WooCommerce Google Feed Manager plugin for WordPress, affecting versions from 0 through 2.2.0. Root cause: improper neutralization of input during web page generation. Impact per sources: stored cross-site scripting that can be exploited by an authenticated u...

CVE-2024-2639

Affects Bdtask Wholesale Inventory Management System (up to 20240311). Multiple sources confirm a session fixation vulnerability in an unknown functionality, exploitable remotely and publicly disclosed. The root cause is not explicitly detailed across documents, but remediation guidance suggests ...