CVE-2024-2533

CVE-2024-2533 affects MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0. The issue is a cross-site scripting (XSS) vulnerability in the file /admin/update-users.php caused by unsafely handling the id parameter. Remote exploitation is possible and the exploit has been disclosed publicly....

CVE-2024-2532

CVE-2024-2532 affects MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0. The vulnerability is a SQL injection in the file /admin/update-users.php caused by manipulating the argument id. It can be exploited remotely and has public disclosure. Several connected sources confirm the issue a...

CVE-2024-2530

The CVE-2024-2530 entry describes a Cross-Site Scripting vulnerability in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0, triggered by manipulating the id parameter in /admin/update-rooms.php. Root cause: unsanitized or improperly validated input leading to XSS. Impact: potential cli...

CVE-2024-2529

The CVE-2024-2529 entry concerns MAGESH-K21 Online-College-Event-Hall-Reservation-System v1.0, with a vulnerability in /admin/rooms.php that allows unrestricted file upload. This remote issue could enable arbitrary uploads and potential compromise; the exploit has been publicly disclosed. Multipl...

CVE-2024-2528

CVE-2024-2528 affects MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0, with a SQL injection in the /admin/update-rooms.php file caused by unsafely handling the room_id parameter. Remote exploitation is possible; exploit information has been disclosed publicly. Affected impact and CVSS...

CVE-2024-2525

CVE-2024-2525 affects MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0. The vulnerability is in an unknown function within /admin/receipt.php , where manipulating the parameter id enables cross-site scripting. The issue can be exploited remotely, and public proof-of-concept/materials e...

CVE-2024-2521

CVE-2024-2521 affects MAGESH-K21 Online-College-Event-Hall-Reservation-System v1.0. The vulnerability lies in the file /admin/bookdate.php where manipulating the id parameter triggers cross-site scripting. Exploitation can be performed remotely; the exploit has been publicly disclosed. Publicly a...

CVE-2024-2520

CVE-2024-2520 affects MAGESH-K21 Online-College-Event-Hall-Reservation-System v1.0. The vulnerability is a SQL injection in /admin/bookdate.php triggered by manipulating the room_id parameter. It is exploitable remotely and has been publicly disclosed. Public sources corroborate an unknown functi...

CVE-2024-2518

The CVE-2024-2518 entry concerns MAGESH-K21 Online-College-Event-Hall-Reservation-System v1.0. A reflected Cross-Site Scripting flaw exists in the book_history.php file where manipulating the id parameter enables script execution in a victim’s browser. Some sources state the attack could be initi...

CVE-2024-2517

CVE-2024-2517 affects MAGESH-K21 Online-College-Event-Hall-Reservation-System v1.0. The vulnerability is a SQL injection in the book_history.php file, triggered by manipulating the del_id parameter. It can be exploited remotely and the exploit has been disclosed publicly. Multiple sources corrobo...

CVE-2024-1857

CVE-2024-1857 affects the WordPress plugin “Ultimate Gift Cards for WooCommerce – Create, Redeem & Manage Digital Gift Certificates with Personalized Templates.” All versions up to 2.6.6 are affected. Root cause: Sensitive Information Exposure via wps_wgm_preview_email_template(), enabling unauth...

CVE-2024-1685

CVE-2024-1685 affects the Social Media Share Buttons plugin for WordPress. It is vulnerable to PHP Object Injection in all versions up to 2.1.0 via deserialization of untrusted input through the attachmentUrl parameter. Authenticated attackers with subscriber-level access or higher can inject a P...

CVE-2024-1733

CVE-2024-1733 exists in Word Replacer Pro for WordPress (all versions up to 1.0). A missing capability check in word_replacer_ultra() permits unauthenticated attackers to modify arbitrary content on the site. Public details from Red Hat and Wordfence corroborate unauthorized content modification ...

CVE-2024-22259

CVE-2024-22259 affects Spring Framework’s UriComponentsBuilder when parsing an externally provided URL and validating its host, potentially enabling open redirect or SSRF if the URL is used after validation. The CVE has CVSS 3.1 base score 8.1 (HIGH). Connected advisories from Atlassian/Broadcom ...

CVE-2024-1239

CVE-2024-1239 affects ElementsKit Elementor addons for WordPress and is a Stored XSS vulnerability present in all versions up to 3.0.4 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor access or higher can inject arbitrary script that executes in...

CVE-2024-2308

CVE-2024-2308 affects the ElementInvader Addons for Elementor WordPress plugin. The vulnerability is a Stored XSS via the EliSlider button link in all versions up to 1.2.2, caused by insufficient input sanitization and output escaping. Affected: ElementInvader Addons for Elementor (WordPress plug...

CVE-2024-27194

CVE-2024-27194 affects Fontific | Google Fonts (WordPress plugin) up to version 0.1.6. The vulnerability is a CSRF flaw that enables Stored XSS via ajax_fontific_save_all. Public documentation in connected sources confirms the issue and notes an unpatched status for Fontific

CVE-2024-27195

CVE-2024-27195 is a CSRF to Stored XSS vulnerability in Watermark RELOADED for WordPress, affecting Watermark RELOADED versions up to 1.3.5. The available connected sources confirm the issue and affected version range, with a CVSS v3.1 base score of 7.1 (HIGH). There is no published patch or miti...

CVE-2024-27197

CVE-2024-27197 is a CSRF-to-Stored XSS vulnerability in the WordPress BeePress plugin (Beepress) affecting versions through 6.9.8. Exploitation details in connected sources indicate the issue can be triggered via beepress-pro.php, enabling stored XSS. Remediation/recommendations are not consisten...

CVE-2023-51474

CVE-2023-51474 : Cross-Site Request Forgery in the TerraClassifieds WordPress plugin (TerraClassifieds) affecting versions up to 2.0.3, enabling CSRF to account takeover. Affected: TerraClassifieds – Simple Classifieds Plugin. Impact: potential account takeover as described. Mitigation: upgrade t...