CVE-2024-25251

CVE-2024-25251 affects code-projects Agro-School Management System 1.0 with an Incorrect Access Control flaw. Connected sources consistently reference the product and version, describing improper access control as the issue. The CVSS v3.1 vector indicates high impact to confidentiality, integrity...

CVE-2024-25801

SKINsoft S-Museum 7.02.3 is affected by CVE-2024-25801: an XSS vulnerability where the attack payload is delivered in the filename of an uploaded file (not its content). Product: SKINsoft S-Museum; Vulnerable component: filename handling during upload via Add Media. Impact: stored/ reflected XSS ...

CVE-2024-25802

Affected software: SKINsoft S-Museum 7.02.3. Vulnerability: Unrestricted file upload via the Add Media function. The attack payload, in this case, is the file content (not the filename). Root cause / nature: Arbitrary file upload capability exists in the Add Media workflow. Impact (as stated): Hi...

CVE-2024-26352

CVE-2024-26352 affects flusity-CMS v2.33. The vulnerability is a Cross-Site Request Forgery (CSRF) in the component /core/tools/add_places.php. The consolidated data describes a CSRF that can impact multiple security properties, with a CVSS 3.1 base score of 8.8 (HIGH) and UI required for exploit...

CVE-2024-25369

This CVE concerns FUEL CMS 1.5.2, where a reflected XSS flaw exists in the group_id parameter that can allow an attacker to execute arbitrary code. The descriptions consistently attribute the issue to FUEL CMS 1.5.2 and do not provide concrete mitigation steps or a confirmed patched version withi...

CVE-2024-25850

CVE-2024-25850 affects Netis WF2780 firmware v2.1.40144. The vulnerability is a command-injection issue exploitable via the wps_ap_ssid5g parameter, with an apparent impact on confidentiality, integrity, and availability. CVSS v3.1 metrics indicate a 9.8 (CRITICAL) base score, network attack vect...

CVE-2024-26350

Summary: CVE-2024-26350 applies to flusity-CMS v2.33, where a Cross-Site Request Forgery (CSRF) was discovered in the component /core/tools/update_contact_form_settings.php. The issue is reported across multiple feeds (RH, NVD, OSV, CVE lists) with a CVSS v3.1 base score of 8.8 (HIGH; AV:N/AC:L/P...

CVE-2023-52160

CVE-2023-52160 – wpa_supplicant PEAP bypass : The issue occurs in the PEAP implementation through wpa_supplicant up to version 2.10, allowing an authentication bypass when Phase 1 TLS certificate verification is disabled. An attacker can abuse an eap_peap_decrypt vulnerability and send an EAP-TLV...

CVE-2024-25828

CMSEasy v7.7.7.9 has an arbitrary file deletion vulnerability in lib/admin/template_admin.php. From the documents: vulnerable component is the file lib/admin/template_admin.php; impact is arbitrary file deletion with no confidentiality impact but potential integrity/availability effects; attack v...

CVE-2024-26445

CVE-2024-26445 concerns flusity-CMS v2.33, where a Cross-Site Request Forgery (CSRF) vulnerability is exposed via the component /core/tools/delete_place.php. Multiple connected sources (Red Hat, NVD, OSV, CVE lists) corroborate that the issue involves CSRF in the affected application path, with t...

CVE-2024-26351

Flusity-CMS v2.33 contains a Cross-Site Request Forgery (CSRF) in the /core/tools/update_place.php component. The issue stems from CSRF in the update_place workflow, enabling state-changing requests under the attacker’s context when a user is tricked to interact with the CMS. Per CVSS 3.1 metrics...

CVE-2024-25873

Enhavo v0.13.1 contains an HTML injection vulnerability in the Blockquote module’s Author text field that can execute arbitrary code via a crafted payload. Public sources identify the affected component (Author field in Blockquote) and the impact (arbitrary code execution). No explicit patches ar...

CVE-2024-25851

Netis WF2780 (v2.1.40144) is affected by a command injection vulnerability in cgitest.cgi, exploitable via the config_sequence parameter in other_para. Root cause is not expanded beyond the parameter path in the sources; no exploit specifics or patch/version fix details are provided in the connec...

CVE-2024-25423

MAXON CINEMA 4D R2024.2.0 is affected. A local attacker can execute arbitrary code via a crafted c4d_base.xdl64 file, as described in multiple sources (PT-2024-20936, NVD/Red Hat entries). No patch details are provided in the connected docs; a temporary workaround suggested by PT-2024-20936 is to...

CVE-2022-25377

Summary : Multiple sources (Red Hat, Veracode, OSV, GHSA, NVD mirrors) confirm a directory-traversal flaw in Appwrite’s ACME-challenge endpoint. Affected versions : Appwrite 0.5.0 through 0.12.x before 0.12.2. The vulnerability requires the path APP_STORAGE_CERTIFICATES/.well-known/acme-challenge...

CVE-2024-22547

CVE-2024-22547 affects WayOS IBR-7150 firmware prior to version 17.06.23. The vulnerability is Cross Site Scripting (XSS). Based on the connected sources, the affected product is WayOS IBR-7150 and versions earlier than 17.06.23 are implicated; no explicit root-cause details are provided beyond t...

CVE-2024-26484

Kirby CMS 4.1.0 has a stored XSS in the Edit Content Layout module, exploitable via crafted payload in the Link field. Root cause: lack of proper filtering/escaping in the Link field. Impact described in sources as potentially arbitrary web script execution; however, vendor notes the issue did no...

CVE-2024-25876

Enhavo CMS v0.13.1’s Header module is vulnerable to Cross‑Site Scripting (XSS) via a crafted payload injected into the Title field. The root cause is inadequate sanitization of user-supplied input in Title, enabling execution of arbitrary scripts in the affected context. Public advisories and vul...

CVE-2024-25875

CVE-2024-25875 is an XSS vulnerability in the Header module of Enhavo CMS v0.13.1, exploitable via crafted input in the Undertitle text field. Affected component: Undertitle handling in the Header module; root cause: insufficient input validation/escaping in Undertitle processing as described acr...

CVE-2024-23094

Summary: CVE-2024-23094 affects Flusity-CMS v2.33 through a Cross-Site Request Forgery (CSRF) vulnerability in the component /cover/addons/info_media_gallery/action/edit_addon_post.php. Affected software: Flusity-CMS 2.33. Root cause: CSRF vulnerability in the specified PHP action path. Impact (a...