CVE-2024-25657

CVE-2024-25657 affects AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS. An open redirect exists in the Login/Logout web management flow, potentially causing authenticated users to be redirected to malicious websites. The initial entry reports a CVSSv3.1 base score of 5.4 (Medium) wit...

CVE-2021-47157

The CVE-2021-47157 entry affects the Kossy Perl module before 0.60. The root cause is mishandling of the X-Requested-With header, enabling JSON hijacking and compromising confidentiality, integrity, and availability (CVSS v3.1: 9.8, critical; AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected softwar...

CVE-2024-2569

CVE-2024-2569 affects SourceCodester Employee Task Management System 1.0, with a vulnerability in the file /admin-manage-user.php. The issue enables execution after redirect and can be exploited remotely; the exploit has been disclosed publicly. Multiple connected sources corroborate the impact a...

CVE-2024-2567

The CVE-2024-2567 entry concerns jurecapuder AndroidWeatherApp 1.0.0 on Android, where an unknown function of androidmanifest.xml within the Backup File Handler component can be manipulated to expose backup files to an unauthorized control sphere. Documents across NVD, Red Hat, CVE, and related f...

CVE-2024-27961

CVE-2024-27961 is a reflected Cross-Site Scripting vulnerability in Codekraft AntiSpam for Contact Form 7 (CF7 AntiSpam). The issue arises from improper input neutralization during web page generation, allowing an attacker to inject script that is reflected to victims. Affected range is AntiSpam ...

CVE-2024-27959

CVE-2024-27959 — Affected: WC Shop Sync – Integrate Square and WooCommerce for Seamless Shop Management. Root cause: Improper neutralization of input during web page generation, enabling a reflected XSS. Affected versions: up to 4.2.9 (n/a through 4.2.9). Status: The vulnerability has been report...

CVE-2024-25903

CVE-2024-25903 affects the WordPress Frontend File Manager plugin (Frontend File Manager). Public documentation indicates an information-disclosure vulnerability where unauthenticated actors can access user-uploaded files, with affected versions up to 22.7. The issue stems from exposure of sensit...

CVE-2024-25591

Summary: CVE-2024-25591 affects the WordPress plugin WP Editor (versions

CVE-2024-2566

The CVE-2024-2566 entry concerns Fujian Kelixin Communication Command and Dispatch Platform (up to 20240313). The vulnerability targets the file api/client/get_extension_yl.php, where manipulation of the imei parameter yields an SQL injection. Exploitation is described as remote. Public disclosur...

CVE-2024-2565

CVE-2024-2565 affects PandaXGO PandaX up to 20240310. The File Extension Handler’s /apps/system/router/upload.go contains a vulnerability in an unknown function that allows manipulating the file argument to achieve unrestricted file uploads. It can be exploited remotely and the exploit has been d...

CVE-2024-2564

CVE-2024-2564 affects PandaXGO PandaX up to 20240310 . The vulnerability is in the function ExportUser (file /apps/system/api/user.go ); manipulating the filename parameter enables a path traversal (e.g., '../filedir'), potentially allowing access to files outside the intended directory. Exploita...

CVE-2024-2563

The CVE-2024-2563 entry concerns PandaXGO PandaX up to 20240310. A path traversal flaw exists in the DeleteImage function in /apps/system/router/upload.go, where an attacker can manipulate the fileName parameter (e.g., ../../../../../../../../../tmp/1.txt) to traverse to ../filedir. The issue is ...

CVE-2024-2562

CVE-2024-2562 affects PandaXGO PandaX up to 20240310, targeting the InsertRole function in /apps/system/services/role_menu.go. The vulnerability arises from improper handling of the roleKey parameter, enabling SQL injection. Exploitation is possible remotely, and multiple sources note public disc...

CVE-2024-2561

The vulnerability CVE-2024-2561 affects 74CMS 3.28.0. Affected component: Company Logo Handler, function sendCompanyLogo in /controller/company/Index.php#sendCompanyLogo. The arg imgBase64 can be manipulated to lead to unrestricted file upload, allowing remote execution per CNVD/CNNVD/PT security...

CVE-2024-2559

CVE-2024-2559 describes a cross-site request forgery in the SysToolReboot function of the /goform/SysToolReboot path on the Tenda AC18 router with firmware 15.03.05.05. The issue allows remote-triggered CSRF by an attacker and has publicly disclosed exploit information, affecting the Tenda AC18 d...

CVE-2024-2558

CVE-2024-2558 affects Tenda AC18, version 15.03.05.05. A stack-based buffer overflow in formexeCommand (file /goform/execCommand) is triggered by the cmdinput parameter, potentially allowing remote code execution and impacting confidentiality, integrity, and availability. Sources consistently des...

CVE-2024-2557

CVE-2024-2557 affects kishor-23 Food Waste Management System 1.0, with a vulnerability in /admin/admin.php enabling improper authorization. A remote-ready issue has been disclosed publicly; multiple sources indicate it could be exploited to bypass authorization. Risk is rated HIGH by CVSS 3.1 in ...

CVE-2024-2553

CVE-2024-2553 affects SourceCodester Product Review Rating System 1.0. The vulnerability involves the Rate Product Handler component, where the manipulation of the Your Name/Comment argument leads to cross-site scripting. It is possible to exploit remotely, and the exploit has been disclosed publ...

CVE-2024-2547

CVE-2024-2547 affects Tenda AC18, version 15.03.05.05, specifically the R7WebsSecurityHandler. The issue is a stack‑based buffer overflow triggered by manipulating the password argument, and the attack is network‑based with the potential for remote exploitation. Publicly disclosed exploit informa...

CVE-2024-2535

MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0 is affected by a Cross-Site Scripting vulnerability in the /admin/users.php script, triggered by a manipulated id parameter. The issue is a reflected XSS affecting unknown code paths, with remote exploitation possible and public disclosu...