PT-2024-15149 · WordPress · The Pods – Custom Content Types/Fields

Name of the Vulnerable Software and Affected Versions: The Pods – Custom Content Types and Fields plugin for WordPress versions prior to 3.0.11, excluding versions 2.7.31.2, 2.8.23.2, and 2.9.19.2 Description: The issue arises from insufficient escaping on the user supplied parameter and lack of...

PT-2024-20323 · Canimaan Software · Clamav

Name of the Vulnerable Software and Affected Versions: Canimaan Software LTD ClamXAV versions 3.1.2 through 3.6.1 Description: An issue in Canimaan Software LTD ClamXAV allows a local attacker to escalate privileges via the ClamXAV helper tool component. Recommendations: For versions 3.1.2 throug...

PT-2024-18487 · Kadence Blocks · The Gutenberg Blocks By Kadence Blocks

Name of the Vulnerable Software and Affected Versions: The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress versions prior to 3.2.26 Description: The issue is related to Stored Cross-Site Scripting via the Testimonial Widget's anchor style parameter due to...

PT-2024-15147 · WordPress · The Pods – Custom Content Types/Fields

Name of the Vulnerable Software and Affected Versions: The Pods – Custom Content Types and Fields plugin for WordPress versions prior to 3.0.11, excluding versions 2.7.31.2, 2.8.23.2, and 2.9.19.2. Description: The issue is related to Missing Authorization, which allows authenticated attackers wi...

PT-2024-24250 · Apache · Apache Zeppelin

Name of the Vulnerable Software and Affected Versions: Apache Zeppelin versions 0.10.1 through 0.10.x before 0.11.0 Description: The issue is related to an Improper Input Validation vulnerability in Apache Zeppelin when creating a new note from Zeppelin's UI. Users are recommended to upgrade to a...

PT-2024-24248 · Apache · Apache Zeppelin

Name of the Vulnerable Software and Affected Versions: Apache Zeppelin versions 0.9.0 through 0.10.x Description: The issue is related to improper input validation, allowing attackers to access files in the filesystem by adding relative path indicators e.g ... This enables them to see the content...

PT-2024-19889 · WordPress · Gum Elementor Addon

Name of the Vulnerable Software and Affected Versions: Gum Elementor Addon plugin for WordPress versions up to, and including, 1.3.2 Description: The issue is related to Stored Cross-Site Scripting via the Post Meta widget due to insufficient input sanitization and output escaping. This allows...

PT-2024-24014 · Pencidesign · Pencidesign Soledad

Name of the Vulnerable Software and Affected Versions: PenciDesign Soledad versions through 8.4.2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended actions on a web application...

PT-2024-24252 · Apache · Apache Zeppelin

Name of the Vulnerable Software and Affected Versions: Apache Zeppelin versions prior to 0.11.1 Description: The issue is related to improper control of code generation, allowing an attacker to inject sensitive configuration or malicious code when connecting to a MySQL database via a JDBC driver...

PT-2024-18360 · WordPress · Wp Customer Reviews

Name of the Vulnerable Software and Affected Versions: WP Customer Reviews versions prior to 3.7.1 Description: The issue concerns the WP Customer Reviews WordPress plugin, where a parameter is not validated, allowing contributor and above users to redirect a page to a malicious URL. This poses a...

PT-2024-3290 · WordPress · Herd Effects

Name of the Vulnerable Software and Affected Versions: Herd Effects WordPress plugin versions prior to 5.2.7 Description: The issue is related to a lack of CSRF checks in some bulk actions of the Herd Effects WordPress plugin, which could allow attackers to make logged-in admins perform unwanted...

PT-2024-24223 · Totolink · Totolink Ex200

Name of the Vulnerable Software and Affected Versions: TOTOLINK EX200 version 4.0.3c.7314 B20191204 Description: An attacker can obtain the configuration file without authorization through the "/cgi-bin/ExportSettings.sh" API endpoint. Recommendations: For TOTOLINK EX200 version 4.0.3c.7314...

PT-2024-18452 · WordPress · Wpb Show Core

Name of the Vulnerable Software and Affected Versions: WPB Show Core WordPress plugin versions prior to 2.7 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page...

PT-2024-23934 · Unknown · Rapidload Power-Up For Autoptimize

Name of the Vulnerable Software and Affected Versions: RapidLoad Power-Up for Autoptimize versions 2.2.11 and earlier Description: The issue is a Server-Side Request Forgery SSRF vulnerability. This means an attacker can potentially trick the server into making unauthorized requests, leading to...

PT-2024-23550 · Unknown · Ros Melodic Morenia

Name of the Vulnerable Software and Affected Versions: ROS Robot Operating System Melodic Morenia versions 1 Description: An issue was discovered where the system transmits messages in plaintext, exposing sensitive information and making it vulnerable to man-in-the-middle MitM attacks. This allow...

PT-2024-23926

Name of the Vulnerable Software and Affected Versions Church Admin versions n/a through 4.1.5 Description The issue is related to an Unrestricted Upload of File with Dangerous Type vulnerability in Andy Moyle Church Admin. This allows for the upload of files with potentially dangerous types, whic...

PT-2024-23938 · Metagauss · Metagauss Profilegrid

Name of the Vulnerable Software and Affected Versions: Metagauss ProfileGrid versions through 5.7.6 Description: The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability. This allows for potential unauthorized access. Recommendations: For versions through 5.7.6,...

PT-2024-20707 · Ibm +1 · Ibm Personal Communications +1

Name of the Vulnerable Software and Affected Versions: IBM Personal Communications versions 14.0.6 through 15.0.1 Description: The vulnerability allows any unprivileged user with network access to a target computer to run commands with full privileges in the context of NT AUTHORITYSYSTEM. This...

PT-2024-23631 · Unknown · Sourcecodester Complete E-Commerce Site

Name of the Vulnerable Software and Affected Versions: Sourcecodester Complete E-Commerce Site version 1.0 Description: The issue allows remote attackers to execute arbitrary code via the filename parameter in the "admin/products photo.php" endpoint. This is an arbitrary file upload vulnerability...

WordPress MasterStudy LMS Plugin <= 3.3.3 is vulnerable to Local File Inclusion

Software MasterStudy LMS Type Plugin Vulnerable versions = 3.3.3 Fixed in 3.3.4 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-3136 Patch priority High CVSS severity High 9 Developer Claim ownership PSID 0e613f9f337e Credits Hiroho Shimada Required privilege...