CVE-2024-34551

CVE-2024-34551 is an unauthenticated path traversal leading to PHP Local File Inclusion in the WordPress theme Stockholm (Stockholm Core) up to version 9.6. Multiple connected sources (NVD and CVE records) confirm: affected product is the Stockholm theme; vulnerability type is path traversal enab...

CVE-2024-34384

CVE-2024-34384 affects Sina Extension for Elementor (WordPress plugin) and is a path traversal that enables PHP Local File Inclusion. Affected versions: up to 3.5.1. Root cause: improper limitation of pathname to restricted directories, allowing local file access via authenticated use (Contributo...

CVE-2024-33628

CVE-2024-33628 is an authenticated local file inclusion vulnerability in the WordPress XforWooCommerce plugin. Affected plugin range: up to and including version 2.0.2; exploitation requires authentication. CVSS 3.1 base score 8.8 (high impact on confidentiality, integrity, and availability). Rem...

CVE-2024-33568

CVE-2024-33568 affects the WordPress plugin BdThemes Element Pack Pro. According to the CVE and corroborating sources, it enables Path Traversal and deserialization of untrusted data, allowing an attacker with at least Contributor+ privileges to perform an arbitrary file read and PHAR deserializa...

CVE-2024-33560

CVE-2024-33560 affects 8theme XStore (WordPress theme). The vulnerability is described as an improper limitation of a pathname to a restricted directory, enabling PHP Local File Inclusion (LFI). The issue impacts XStore versions from n/a up to 9.3.8 (per initial doc) and is echoed in multiple CVE...

CVE-2024-33557

CVE-2024-33557 describes a path traversal vulnerability in 8theme XStore Core (WordPress plugin) that enables PHP Local File Inclusion. Affected range: XStore Core from n/a through 5.3.8. The CVSS metrics indicate high impact (C/H, I/H, A/H) with network attack vector and low attack complexity; p...

CVE-2024-33541

CVE-2024-33541 (Better Elementor Addons) is a Path Traversal flaw in the Better Elementor Addons plugin for WordPress, allowing PHP Local File Inclusion. Affected versions are up to 1.4.1. Root cause: improper limitation of a pathname to restricted directories, enabling access to local files. Imp...

CVE-2024-36800

CVE-2024-36800: A SQL injection vulnerability in SEMCMS v4.8 allows a remote attacker to disclose sensitive information via the ID parameter in Download.php. Root cause: improper handling of the ID parameter enables unauthorized database access. Impact is information disclosure; no exploitation d...

CVE-2024-36801

CVE-2024-36801 affects SEMCMS v4.8. The issue is a SQL injection in the Download.php lgid parameter, stemming from unprotected SQL query structure, enabling a remote attacker to access sensitive information. Affected component is the Download.php handling lgid; root cause is lack of input sanitiz...

CVE-2023-52176

CVE-2023-52176 describes an Authentication Bypass by Spoofing in the Miniorange Malware Scanner (WordPress plugin). Affected products: Malware Scanner from n/a through version 4.7.1. Root cause per entry: bypasses access controls (ACLs) through spoofed authentication, enabling access to functiona...

CVE-2023-52147

CVE-2023-52147 concerns the WordPress plugin All In One WP Security & Firewall (AIOS)

CVE-2023-51667

CVE-2023-51667 affects the Rate my Post – WP Rating System WordPress plugin (

CVE-2023-51543

CVE-2023-51543 describes an Authentication Bypass by Spoofing in the WordPress plugin RegistrationMagic (Metagauss) that allows bypassing ACL constraints to access restricted functionality. Affected versions are RegistrationMagic up to 5.2.5.0 (version range stated as n/a through 5.2.5.0). The vu...

CVE-2023-51542

CVE-2023-51542 concerns Branda (WordPress White Label plugin by WPMU DEV). Affected versions are Branda: from n/a through 3.4.14. The issue is an authentication bypass by spoofing, allowing access to functionality not properly constrained by ACLs. The CVSS 3.1 vector yields a base score of 5.3 (M...

CVE-2023-51511

CVE-2023-51511 involves Booster Elite for WooCommerce (Pluggabl LLC) with an improper authentication vulnerability that allows accessing functionality not properly constrained by ACLs. Affected software: Booster Elite for WooCommerce prior to version 7.1.3. Public references indicate a base CVSS ...

CVE-2024-29170

Dell PowerScale OneFS versions 8.2.x–9.8.0.x are affected by a trust-management issue caused by hard-coded credentials. An adjacent-network, unauthenticated attacker could disclose network-traffic information and trigger a denial of service. The advisory/patch guidance in the connected documents ...

CVE-2024-37065

CVE-2024-37065 : The vulnerability affects the Python library skops (version 0.6 and later). It stems from unsafe/deserialization of untrusted data, allowing a maliciously crafted model to trigger arbitrary code execution when loaded on a user system. The available documents confirm the affected ...

CVE-2024-37064

The CVE-2024-37064 entry concerns a vulnerability in the ydata-profiling open-source library where insecure deserialization of untrusted data in versions 3.7.0 and newer can allow a malicious dataset to execute arbitrary code on an end user’s system when loaded. The issue is associated with Ydata...

CVE-2024-37063

CVE-2024-37063 is a cross-site scripting (XSS) vulnerability affecting the open-source library ydata-profiling (versions 3.7.0 and newer). The root cause, as cited by multiple sources, is insufficient sanitization of user-supplied inputs in reports, allowing malicious payloads to execute when a c...

CVE-2024-37062

The CVE-2024-37062 entry concerns deserialization of untrusted data in the ydata-profiling library. Affected software: ydata-profiling versions 3.7.0 and newer. Root cause: inadequate input validation in the loads function within serialize_report.py, enabling arbitrary code execution when loading...