Sql injection

code-projects.org Online Job Portal 1.0 is vulnerable to SQL Injection via the Username parameter for "Employer."...

CVE-2024-0917

PaddlePaddle vulnerability CVE-2024-0917 affects paddlepaddle/paddle 2.6.0. Root cause: code injection due to improper filtering of special elements in constructed code segments, enabling remote code execution. Impact is described as remote code execution with high confidentiality/integrity/avail...

CVE-2024-1419

The Plus Addons for Elementor Page Builder for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the Header Meta Content widget via the _id attribute, affecting all versions up to and including 5.4.0. Exploitation requires authenticated access at contributor level or higher,...

CVE-2024-1506

CVE-2024-1506 concerns the WordPress plugin “Prime Slider – Addons For Elementor.” The vulnerability is a Stored Cross-Site Scripting issue via the Fiestar widget’s title_tags attribute, present in all versions up to 3.13.1. An attacker with contributor-level access or higher could inject arbitra...

CVE-2024-1377

CVE-2024-1377 affects Happy Addons for Elementor on WordPress. A stored XSS exists in the Author Meta widget’s author_meta_tag attribute in all versions up to 3.10.3 due to insufficient input sanitization/output escaping. Exploitation requires authenticated access at contributor level or higher, ...

CVE-2024-1500

CVE-2024-1500 concerns the Royal Elementor Addons and Templates plugin for WordPress. It describes Stored Cross-Site Scripting via the Logo Widget in all versions up to 1.3.91, caused by insufficient input sanitization and output escaping on user-supplied URLs. The vulnerability allows authentica...

CVE-2024-1720

CVE-2024-1720: WordPress Plugin—User Registration (Custom Registration Form, Login Form, User Profile). Stored XSS via the Display Name parameter affects all versions up to 3.1.4. Exploitation requires social engineering and a user to login, per description; Wordfence/Red Hat entries align with t...

CVE-2024-1366

CVE-2024-1366 affects Happy Addons for Elementor (WordPress). A stored XSS via the Archive Title widget’s archive_title_tag in all versions up to 3.10.3 can be triggered by authenticated users with contributor-level access and above, allowing injection of scripts executed on page load. Impact is ...

Deserialization of untrusted data

nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute arbitrary code via unsafe Java objects deserialization...

CVE-2024-28215

CVE-2024-28215 affects nGrinder prior to 3.5.9. The issue arises from lack of access control, allowing an attacker to create or update webhook configurations, which could lead to information disclosure and limited Server-Side Request Forgery. Affected installations should upgrade to version 3.5.9...

CVE-2024-28214

The CVE describes a vulnerability in nGrinder before 3.5.9 where the delay setting can be configured without an upper limit, enabling a remote attacker to cause a Denial of Service. Affected software: nGrinder (prior to 3.5.9). Root cause: unbounded delay configuration leading to DoS. Impact: Den...

CVE-2024-28212

CVE-2024-28212 affects nGrinder prior to 3.5.9, where an outdated SnakeYAML version enables unsafe deserialization that could let a remote attacker run arbitrary code. The vulnerability stems from deserializing untrusted data via SnakeYAML within nGrinder’s stack. Affected software: nGrinder vers...

CVE-2024-28211

CVE-2024-28211 affects nGrinder prior to 3.5.9. It allows a remote attacker to connect to a malicious JMX/RMI server by default, potentially enabling arbitrary code execution via the RMI registry. Red Hat/NVD entries corroborate a default-JMX/RMI connection leading to remote code execution. Impac...

Cross site scripting

News functionality in Schoolbox application before version 23.1.3 is vulnerable to stored cross-site scripting allowing authenticated attacker to perform security actions in the context of the affected users...

Cross site scripting

Class functionality in Schoolbox application before version 23.1.3 is vulnerable to stored cross-site scripting allowing authenticated attacker to perform security actions in the context of the affected users...

Sql injection

Chat functionality in Schoolbox application before version 23.1.3 is vulnerable to blind SQL Injection enabling the authenticated attackers to read, modify, and delete database records...

Command injection

Command injection in paddle.utils.download.wgetdownload bypass filter in paddlepaddle/paddle 2.6.0...

CVE-2024-28097

The CVE-2024-28097 issue affects Schoolbox before version 23.1.3, with stored XSS in the calendar functionality that can be exploited by an authenticated attacker to perform security actions in the context of affected users. The root cause is a cross-site scripting flaw in the calendar feature, a...

CVE-2024-28096

CVE-2024-28096 affects Schoolbox: stored cross-site scripting in the Class functionality before version 23.1.3. An authenticated attacker can perform security actions in the context of affected users due to the vulnerability in the Class feature. Mitigation: update to version 23.1.3 or later (rec...

CVE-2024-28095

CVE-2024-28095 affects Schoolbox: stored cross-site scripting in the News functionality for versions prior to 23.1.3. The flaw originates in News where user input can be stored and executed in an authenticated user’s context, enabling the attacker to perform security actions. A patch is available...