CVE-2024-36548

CVE-2024-36548 affects idccms v1.35, with a CSRF vulnerability reachable at admin/vpsCompany_deal.php?mudi=del. The issue is documented across multiple feeds (NVD/Red Hat/CVE pages and PT-2024-27066) and is not accompanied by public exploit details in the provided documents. PT-2024-27066 suggest...

CVE-2024-36547

CVE-2024-36547 affects idccms V1.35 with a Cross-Site Request Forgery (CSRF) in the admin/vpsClass_deal.php?mudi=add component. The CVSS baseline from NVD (ATT&CK not stated) indicates high impact on confidentiality, integrity, and availability with network attack vector and user interaction requ...

CVE-2024-32871

Pimcore’s vulnerability CVE-2024-32871 concerns the thumbnail generation endpoint. Attackers can cause server resource exhaustion by requesting thumbnails whose file extension or scale factor yields files much larger than the original, enabling a Denial of Service-like impact. The fixed version i...

CVE-2024-0756

CVE-2024-0756 concerns the WordPress plugin Insert or Embed Articulate Content into WordPress, affected through v4.3000000023. The issue stems from insufficient URL validation when adding iframes, enabling an attacker to inject an iframe and load arbitrary content from any page. Public references...

CVE-2024-35649

CVE-2024-35649 describes a Stored XSS in the Pdfcrowd Save as PDF plugin for WordPress. The initial description indicates vulnerability in the plugin from versions up to 3.2.3 (inclusive). Connected CVE data confirm that this is a stored XSS in web page generation via user input, with remediation...

CVE-2024-35651

CVE-2024-35651 concerns the WP Flow Plus WordPress plugin (Spiffy Plugins) withStored Cross-Site Scripting (XSS) vulnerability in versions

CVE-2024-35652

CVE-2024-35652 is a reflected XSS in the WordPress plugin Event Tickets with Ticket Scanner. According to the description, the vulnerability arises from Improper Neutralization of Input During Web Page Generation and affects Event Tickets with Ticket Scanner versions from n/a up to 2.3.1. The inc...

CVE-2024-36400

CVE-2024-36400 (nano-id, Rust) : Affected nano-id versions incorrectly generated IDs by using a reduced character set in base62 (32 symbols instead of 62) and base58 (16 symbols instead of 58), substantially reducing entropy. The nano_id::gen macro is also affected when a non-power-of-two charact...

CVE-2024-35653

Technical details for CVE-2024-35653 are not publicly provided in the connected documents. No explicit affected product/version, root cause, impact, or fixes are described here. Monitor for updates.

CVE-2024-35654

CVE-2024-35654 is a Stored XSS in the Responsive WordPress Theme by CyberChimps, affecting versions up to 5.0.3. The connected Wordfence entry confirms the issue is authenticated (Contributor+) and patched; remediation is to upgrade to a later version. No exploit details are provided in the conne...

CVE-2024-35655

The CVE-2024-35655 entry affects Brave Popup Builder (WordPress Brave Popup Builder plugin) with a Stored XSS vulnerability due to improper input neutralization during web page generation. PT-2024-26601 details Brave Popup Builder versions 0.6.8–0.6.9 as affected and confirms Stored XSS risk. The...

CVE-2024-35664

CVE-2024-35664 affects the WordPress plugin WPvivid Backup for MainWP up to version 0.9.32, with a Reflected XSS due to improper input neutralization during web page generation. Affected component is the plugin itself; root cause is input handling that allows reflected script execution. Impact is...

CVE-2024-35666

CVE-2024-35666 affects the WordPress plugin Themesflat Addons For Elementor up to version 2.1.2. The issue is a Stored XSS via widget tags caused by insufficient input sanitization and output escaping. Exploitation context: authenticated attackers with contributor-level access can inject scripts ...

CVE-2024-35668

CVE-2024-35668 describes a Reflected XSS vulnerability in the Brevo (Newsletter, SMTP, Email marketing and Subscribe forms by Brevo) plugin for WordPress. The issue arises from improper input neutralization during web page generation, enabling reflected cross-site scripting. Affected versions are...

CVE-2024-35782

The CVE-2024-35782 issue affects WordPress plugin Cowidgets – Elementor Addons (versions

CVE-2024-35700

CVE-2024-35700 affects the WordPress plugin “UserPro” (DeluxeThemes) up to version 5.1.8. The issue is described as Improper Privilege Management enabling Unauthenticated Account Takeover with privilege escalation. Impact as stated: confidential and integrity/availability impact; CVSS v3.1 base s...

CVE-2024-35634

CVE-2024-35634 affects the Woocommerce – Recent Purchases plugin for WordPress (versions ≤ 1.0.1). It is a Local File Inclusion due to improper pathname limitation, enabling an authenticated Administrator to include arbitrary server files via path traversal. The Wordfence entry indicates this vul...

CVE-2024-34792

CVE-2024-34792 affects Dextaz Ping (WordPress plugin) up to version 0.65, with an improper neutralization of command elements that enables Command Injection and Remote Code Execution. Connected sources (Red Hat, NVD/WordPress listings) confirm the issue and identify the root cause as improper han...

CVE-2024-34554

CVE-2024-34554 is an authenticated Local File Inclusion (LFI) in Stockholm Core (WordPress plugin) that affects Stockholm Core up to version 2.4.1. Public references confirm the issue and that a patch is available (Stockholm Core patched). Affected product is WordPress Stockholm Core; root cause ...

CVE-2024-34552

CVE-2024-34552 is a Local File Inclusion (path traversal) issue in the WordPress Stockholm theme, affecting Stockholm up to version 9.6. The vulnerability arises from improper pathname limitation, enabling unauthenticated LFI and, in some cases, authenticated LFI against restricted files. The Red...