CVE-2024-26471

CVE-2024-26471 describes a reflected cross-site scripting (XSS) vulnerability in the zhimengzhe iBarn v1.5, exploitable via the search parameter in offer.php. The documented risk is that an attacker could inject malicious JavaScript into a victim’s browser, enabling script execution in the contex...

CVE-2024-27356

CVE-2024-27356 affects GL.iNet devices (examples include MT6000 4.5.5, XE3000 4.4.4, X3000 4.4.5, MT3000 4.5.0, MT2500 4.5.0, and others listed). The issue allows an attacker to trigger commands that download files (e.g., logread.tar) from the device, potentially exposing critical user informatio...

CVE-2024-22543

CVE-2024-22543 affects Linksys Router E1700, version 1.0.04 (build 3). An authenticated attacker can escalate privileges by sending a crafted request to the "/goform/" URI or via the ExportSettings function. The linked PT Security advisory recommends disabling access to the "/goform/ " URI and re...

CVE-2023-41506

CVE-2023-41506 affects the Student Enrollment In PHP software (v1.0). The vulnerability is an arbitrary file upload in the Update/Edit Student’s Profile Picture function, enabling code execution by uploading a crafted PHP file. Public sources describe it as a critical issue (CVSS v3.1: 9.8, high ...

CVE-2024-25166

CVE-2024-25166 affects 71CMS v1.0.0. A Cross Site Scripting flaw allows a remote attacker to execute arbitrary code via the uploadfile action parameter in controller.php. The Red Hat/NVD/CVE reports and related vendors confirm the vulnerability; no official patch/version is provided in the suppli...

CVE-2024-27508

Atheme 7.2.12 is affected by CVE-2024-27508, describing a memory leak in /atheme/src/crypto-benchmark/main.c. The vulnerability is characterized with CVSS v3.1 base score 7.5 (HIGH), attack vector NETWORK, impact on availability. The connected Red Hat, SUSE, Ubuntu, Debian, and other advisories a...

CVE-2024-26472

KLiK SocialMediaWebsite v1.0.1 (msaad1999) is vulnerable to a reflected cross-site scripting (XSS) flaw. The issue arises when a malicious payload is supplied in the selector or validator parameters of create-new-pwd.php, enabling an attacker to execute arbitrary JavaScript in a user’s browser. T...

CVE-2024-25840

CVE-2024-25840 affects the PrestaShop module "Account Manager | Sales Representative & Dealers | CRM" (prestasalesmanager) for Prestashop, with versions up to 9.0. A path traversal flaw allows a guest to download personal information without restriction, exposing confidentiality. The root cause a...

CVE-2024-24323

CVE-2024-24323 is a SQL injection vulnerability affecting linlinjava litemall v.1.8.0. The issue arises in AdminOrdercontroller.java where the nickname, consignee, orderSN, and orderStatusArray parameters can be exploited by an attacker to access sensitive information. Multiple sources (NVD, Red ...

WordPress Comments Like Dislike 1.2.0 Missing Authorization

Exploit Title: POC-CVE-2023-3244 Date: 9/12/2023 Exploit Author: Diaa Hanna Software Link: download link if available Version: = 1.2.0 comments-like-dislike Tested on: 1.1.6 comments-like-dislike CVE : CVE-2023-3244 References https://nvd.nist.gov/vuln/detail/CVE-2023-3244 The Comments Like Disli...

CVE-2024-27507

Summary of CVE-2024-27507 : A memory leak vulnerability in libLAS 1.8.1 affecting the component/file /libLAS/apps/ts2las.cpp. The issue is linked to the package libLAS 1.8.1 (LiDAR LAS format library). Fedora advisories indicate that updating to the git commit f1da555 (liblas-1.8.2-0.12.gitf1da55...

CVE-2024-26473

The CVE-2024-26473 entry concerns a reflected XSS in SocialMediaWebsite v1.0.1, exploitable via the poll parameter in poll.php. The vulnerability allows attackers to inject JavaScript into a victim’s browser, with the impact described as browser-side script execution. Affected component is the po...

CVE-2024-24095

CVE-2024-24095 affects Code-projects Simple Stock System 1.0 and is a reported SQL Injection vulnerability. The entry is rated with a high/critical impact (CVSSv3.1 base score 9.8; NETWORK exploitability, no user interaction required; confidentiality, integrity, and availability are all at high i...

CVE-2024-25723

CVE-2024-25723 affects ZenML Server in the ZenML Python package (prior to 0.46.7). The REST endpoint /api/v1/users/{user_name_or_id}/activate allows remote privilege escalation by authenticating with a valid username and a new password in the request body, enabling total compromise of the account...

CVE-2024-24027

CVE-2024-24027 affects Likeshop versions prior to 2.5.7, where a SQL injection vulnerability exists in DistributionMemberLogic::getFansLists. The root cause is improper handling of input in that function, enabling arbitrary SQL commands to be executed against the database. Impact is consistent wi...

CVE-2024-26542

Bonitasoft S.A. has a Cross-Site Scripting vulnerability (CVE-2024-26542) in the Groups Display name field. The flaw affects versions prior to 7.14.8, 7.15.7, 8.0.3, and 9.0.2, with remediation by upgrading to 7.14.8, 7.15.7, 8.0.3, or 9.0.2 respectively. The issue allows attackers to execute arb...

Sql injection

SQL Injection vulnerability in /app/api/controller/Store.php in Niushop B2B2C V5 allows attackers to run arbitrary SQL commands via latitude and longitude parameters...

CVE-2024-27093

The CVE-2024-27093 issue affects Minder (github.com/stacklok/minder) where client-provided mapping from repository name to upstream ID is trusted. In versions up to 0.0.31, an attacker could register a repository with an invalid or mismatched upstream ID, causing Minder to mark the repo as regist...

Open redirect

Rejected reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not in the allowed scope of that CNA's CVE ID assignments...

CVE-2024-24564

Vyper CVE-2024-24564 describes a memory-safety issue with extract32(b, start): if the start argument can mutate b, extracting 32 bytes may read and return dirty memory. The defect affects older Vyper versions (e.g., 0.3.10 and earlier) and is fixed in 0.4.0. Red Hat and other sources list the sam...