CVE-2024-25288

SLiMS 9 Bulian v9.6.1 is vulnerable to SQL Injection in the pop-scope-vocabolary.php script. Root cause: unsafe SQL construction in that file. Impact: confidentiality of data could be exposed (C:H) with network exposure (AV:N, UI:N; PR:H). No exploit status or patch details are provided in the co...

CVE-2023-24331

Affected device: D-Link DIR-816 router, firmware DIR-816_A2_v1.10CNB04. Issue: Command Injection via the urlAdd parameter that enables attackers to execute arbitrary commands. Documents do not specify exploit details beyond this vector or a concrete remediation; no explicit exploit availability i...

Design/Logic Flaw

An issue discovered in Unisys Stealth 5.3.062.0 allows attackers to view sensitive information via the Enterprise ManagementInstallermsi.log file...

Sql injection

SQL Injection vulnerability in MRCMS v3.1.2 allows attackers to run arbitrary system commands via the status parameter...

Design/Logic Flaw

com.yetanalytics/lrs is the Yet Analytics Core LRS Library. Prior to version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS, a maliciously crafted xAPI statement could be used to perform script or other tag injection in the LRS Statement Browser. The problem is patched in version 1.2.17 o...

CVE-2024-26136

CVE-2024-26136 — kedi ElectronCord is a Discord bot-management tool. The issue arises from a commit that exposes an account access token in the config.json file, enabling potential unauthorized access or actions on behalf of the repository owner. Several connected sources corroborate token exposu...

Cross site scripting

Cross Site Scripting vulnerability in the sanitize function in Enhancesoft osTicket 1.18.0 allows a remote attacker to escalate privileges via a crafted support ticket...

Design/Logic Flaw

When ssl was enabled for Mongo Hook, default settings included "allowinsecure" which caused that certificates were not validated. This was unexpected and undocumented. Users are recommended to upgrade to version 4.0.0, which fixes this issue...

Open redirect

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

Cross site scripting

Cross Site Scripting XSS vulnerability in ProjeQtOr 11.0.2 allows a remote attacker to execute arbitrary code via a crafted script to thecheckvalidHtmlText function in the ack.php and security.php files...

CVE-2024-25141

The CVE-2024-25141 issue concerns Apache Airflow Mongo Hook/Provider components where, when SSL is enabled, the default setting allow_insecure caused certificates not to be validated. This undermines TLS trust and can enable man-in-the-middle scenarios. Affected components are described across mu...

CVE-2024-1058

The CVE-2024-1058 entry concerns the WordPress SiteOrigin Widgets Bundle plugin. Affected component: the onclick parameter, with stored cross-site scripting (XSS) via input sanitization/escaping in versions up to 1.58.3. Exploitation requires attacker credentials at Contributor level or higher; i...

CVE-2024-1043

CVE-2024-1043 affects the WordPress plugin AMP for WP – Accelerated Mobile Pages. A missing capability check in the function amppb_remove_saved_layout_data in all versions up to 1.0.93.1 allows authenticated users with contributor access and above to delete arbitrary posts. Affected versions:

CVE-2024-1171

The CVE-2024-1171 entry concerns the WordPress plugin Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders. A Stored Cross-Site Scripting (XSS) vulnerability exists in the Filterable Gallery Widget for versions up to and including 5.9.8, caused by insuff...

CVE-2024-1090

CVE-2024-1090 affects the ImageRecycle pdf & image compression WordPress plugin up to version 3.1.13. The issue is a missing capability check in stopOptimizeAll, allowing authenticated users with subscriber-level access and above to modify image optimization settings. Root cause: broken access co...

CVE-2024-1172

CVE-2024-1172 Fluently affects the WordPress plugin Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders. A Stored Cross-Site Scripting flaw exists in the Accordion widget due to insufficient input sanitization and output escaping, enabling authenticated...

CVE-2024-1218

CVE-2024-1218 affects the Kali Forms WordPress plugin prior to 2.3.42. The issue is an inconsistent capability check on several REST endpoints, enabling an authenticated user with Contributor+ privileges to access and/or modify forms and form entries via the plugin API. Impact described in source...

CVE-2024-1133

The Tutor LMS WordPress plugin (versions up to and including 2.6.0) is vulnerable to unauthorized access of restricted Q&A content due to a missing capability check when interacting with questions.Authenticated users with subscriber access or higher can interact with questions in courses they are...

CVE-2024-0838

CVE-2024-0838 affects the Happy Addons for Elementor WordPress plugin. It allows Stored XSS via the Age Gate’s side image URL parameter in all versions up to 3.10.1, exploitable by authenticated users with contributor access or higher. The root cause is insufficient input sanitization and output ...

CVE-2024-1294

The Sunshine Photo Cart: Free Client Galleries for Photographers WordPress plugin (up to version 3.0.24) is vulnerable to unauthenticated Sensitive Information Exposure via the invoices feature, exposing customer emails and physical addresses. A fix exists in version 3.1+; update to 3.1 or later ...