CVE-2024-56452

Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2024-56437

Vulnerability of input parameters not being verified in the widget framework module Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2024-56437

Vulnerability of input parameters not being verified in the widget framework module Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2024-56437

Vulnerability of input parameters not being verified in the widget framework module Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2024-56437

Vulnerability of input parameters not being verified in the widget framework module Impact: Successful exploitation of this vulnerability may affect availability...

PT-2025-3300 · Unknown · 3D Engine Module

Name of the Vulnerable Software and Affected Versions: 3D engine module affected versions not specified Description: The issue concerns the vulnerability of input parameters not being verified during the loading of glTF models in the 3D engine module. Successful exploitation of this vulnerability...

PT-2025-3281 · Unknown · Widget Framework Module

Name of the Vulnerable Software and Affected Versions: Widget framework module affected versions not specified Description: The issue concerns a vulnerability of input parameters not being verified in the widget framework module. Successful exploitation of this vulnerability may affect...

RedisTimeSeries 安全漏洞

RedisTimeSeries is a time series data structure for Redis from the RedisTimeSeries open source. A security vulnerability exists in RedisTimeSeries that originates from the execution of one of the TS.QUERYINDEX, TS.MGET, TS.MRAGE, or TS.MREVRANGE commands with specially crafted command parameters ...

CVE-2024-48245

Vehicle Management System 1.0 is vulnerable to SQL Injection. A guest user can exploit vulnerable POST parameters in various administrative actions, such as booking a vehicle or confirming a booking. The affected parameters include "Booking ID", "Action Name", and "Payment Confirmation ID", which...

CVE-2024-8855 WordPress Auction <= 3.7 - Editor+ SQL Injection

The WordPress Auction Plugin WordPress plugin through 3.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing editors and above to perform SQL injection attacks...

WordPress plugin Store credit / Gift cards for woocommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerability...

WordPress plugin User Profile Builder 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2024-48245

CVE-2024-48245 concerns Vehicle Management System (versions 1.0–1.3) with a SQL Injection via vulnerable POST parameters in administrative actions. A guest user can exploit parameters such as Booking ID , Action Name , and Payment Confirmation ID located in /newvehicle.php and /newdriver.php to e...

CVE-2024-48245

Vehicle Management System 1.0 is vulnerable to SQL Injection. A guest user can exploit vulnerable POST parameters in various administrative actions, such as booking a vehicle or confirming a booking. The affected parameters include "Booking ID", "Action Name", and "Payment Confirmation ID", which...

IceWarp Server 跨站脚本漏洞

IceWarp Server is a mailing server from the Czech company IceWarp. A security vulnerability exists in IceWarp Server version 10.2.1, which stems from insufficient handling of meta parameters, resulting in vulnerability to cross-site scripting attacks...

CVE-2024-48245

Vehicle Management System 1.0 is vulnerable to SQL Injection. A guest user can exploit vulnerable POST parameters in various administrative actions, such as booking a vehicle or confirming a booking. The affected parameters include "Booking ID", "Action Name", and "Payment Confirmation ID", which...

CVE-2024-11356 Tourmaster < 5.3.4 - Unauthenticated Stored XSS via Room Booking

The tourmaster WordPress plugin before 5.3.4 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks...

Code-Projects Travel Management System 注入漏洞

Code-Projects Travel Management System is a Code-Projects open source travel management system. An injection vulnerability exists in Code-Projects Travel Management System version 1.0, which originates from the pid/t1/t2/t3/t4/t5/t6/t7 parameters in the /enquiry.php page containing a SQL injectio...

CVE-2024-11974

The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘smcsettingstab', 'unattachfixit-action', and 'woofixit-action’ parameters in all versions up to, and including, 3.23 due to insufficient input sanitization and output escaping. This makes it...

CVE-2024-11974

The CVE-2024-11974 vulnerability affects the Media Library Assistant WordPress plugin. It enables Reflected Cross-Site Scripting via the smc_settings_tab, unattachfixit-action, and woofixit-action parameters in all versions up to and including 3.23, due to insufficient input sanitization and outp...