CVE-2024-26313

Archer Platform 6.x before 6.14 P2 HF2 (6.14.0.2.2) contains a stored Cross-Site Scripting (XSS) vulnerability. A remote authenticated Archer user could store malicious HTML/JavaScript in a trusted data store, causing victim users’ browsers to execute code in the context of the vulnerable applica...

CVE-2019-6268

Summary : CVE-2019-6268 affects RAD SecFlow-2 devices (Hardware 0202; Firmware 4.1.01.63; U-Boot 2010.12). The vulnerability is a directory traversal via URIs starting with /.., allowing access to OS files (demonstrated reading /etc/shadow). Public docs report CVSS v3.1 base score 7.5 (HIGH) and ...

Fedora: Security Advisory for golang-github-tdewolff-argp (FEDORA-2024-0d4d9925a2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-27613

CVE-2024-27613 affects the Numbas editor prior to version 7.3, where the issue is a mishandling of reading themes and extensions in the editor. The CVE has a CVSS v3.1 base score of 7.3 (HIGH), with network attack vector, no privileges required, and no user interaction. Impact is described as low...

CVE-2024-28754

CVE-2024-28754 affects RaspAP (raspap-webgui) up to version 3.0.9. A remote attacker can trigger a crafted request to cause a persistent denial of service (bricking). The issue is documented across multiple sources (including Red Hat and OSV/GHSA/NVD entries). Remediation available in at least on...

CVE-2024-25849

CVE-2024-25849 affects PrestaToolKit Make an offer module for PrestaShop (version ≤ 1.7.1). The vulnerability is a SQL injection in guest-accessible flows via MakeOffers::checkUserExistingOffer() and MakeOffers::addUserOffer(), leading to potential unauthorized data access or modification. Affect...

CVE-2024-26309

CVE-2024-26309 affects Archer Platform 6.x before 6.14 P2 HF2 (6.14.0.2.2). An unauthenticated attacker could disclose sensitive information via an internal URL due to a vulnerability in Archer Platform. Impact is described as information disclosure; attack vector is network with no privileges re...

CVE-2024-25848

CVE-2024-25848 concerns the Ever Ultimate SEO (everpsseo) module for PrestaShop. Affected versions are 8.1.2 and earlier. The Red Hat/NVD/NVD-enriched data and related sources confirm a guest can perform an SQL injection in these versions due to the vulnerable module, i.e., the vulnerability invo...

CVE-2024-2270

The CVE-2024-2270 entry concerns keerti1924 Online-Book-Store-Website 1.0. A cross-site scripting vulnerability exists in the signup.php file, caused by manipulation of the argument name. The flaw is described as exploitable remotely and the exploit has been disclosed publicly. Multiple connected...

CVE-2024-2269

CVE-2024-2269 affects keerti1924 Online-Book-Store-Website 1.0. The vulnerability is in the /search.php file where the search parameter is manipulated to cause SQL injection. It can be exploited remotely, and the exploit has been disclosed publicly. The CVSS metrics across sources indicate high s...

CVE-2024-2268

CVE-2024-2268 affects the keerti1924 Online-Book-Store-Website 1.0. The vulnerability is tied to an unrestricted upload via the file /product_update.php?update=1, specifically manipulating the argument update_image. This leads to remote execution potential. Public exploit information is present; ...

CVE-2024-2267

CVE-2024-2267 affects the keerti1924 Online-Book-Store-Website, version 1.0. The issue is a logic error in the processing of the file /shop.php, caused by manipulating the argument product_price which leads to business logic errors. A remote attacker could exploit this, and public disclosures exi...

CVE-2024-2266

CVE-2024-2266 affects keerti1924 Secret-Coder-PHP-Project 1.0, specifically the Login Page file /login.php. The vulnerability is caused by improper handling of the parameters emailcookie and passwordcookie, enabling remote cross-site scripting (XSS) . Exploitation is possible remotely and the exp...

CVE-2024-2265

CVE-2024-2265 affects the keerti1924 PHP-MYSQL-User-Login-System 1.0. The issue is in an unknown part of login.sql and results in inclusion of sensitive information in the source code, exposing confidential data. Attacks are described as remote, with the exploit publicly disclosed. Multiple conne...

Spoofing

Microsoft Edge for Android Spoofing Vulnerability...

Input validation

The Booster Elite for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wcaddnewproduct function in all versions up to, and including, 7.1.7. This makes it possible for customer-level attackers, and above, to upload arbitrary files...

Sql injection

A vulnerability, which was classified as critical, has been found in keerti1924 PHP-MYSQL-User-Login-System 1.0. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The...

Server side request forgery (ssrf)

Server Side Request Forgery SSRF vulnerability in hcengineering Huly Platform v.0.6.202 allows attackers to run arbitrary code via upload of crafted SVG file...

Code injection

FreeRTOS is a real-time operating system for microcontrollers. FreeRTOS Kernel versions through 10.6.1 do not sufficiently protect against local privilege escalation via Return Oriented Programming techniques should a vulnerability exist that allows code injection and execution. These issues affe...

Code injection

IBM DS8900F HMC 89.21.19.0, 89.21.31.0, 89.30.68.0, 89.32.40.0, and 89.33.48.0 could allow an authenticated user to arbitrarily read files after enumerating file names. IBM X-Force ID: 269407...