PT-2024-20275 · Unknown · Crmeb Java

Name of the Vulnerable Software and Affected Versions: crmeb java versions prior to 1.3.4 Description: The issue allows attackers to execute arbitrary SQL commands by sending a crafted GET request to the "api/front/spread/people" endpoint. This enables attackers to manipulate the database,...

PT-2024-18627 · Zhicms · Zhicms

Name of the Vulnerable Software and Affected Versions: ZhiCms version 4.0 Description: A critical issue has been found in ZhiCms, affecting the getindexdata function of the file app/index/controller/mcontroller.php. The manipulation of the key argument leads to SQL injection. The attack may be...

PT-2024-18497 · Unknown · Cockpit Cms

Name of the Vulnerable Software and Affected Versions: Cockpit CMS version 2.7.0 Description: A Cross-Site Scripting issue in Cockpit CMS could allow an authenticated user to upload an infected PDF file and store a malicious JavaScript payload to be executed when the file is uploaded...

PT-2024-18628 · Zhicms · Zhicms

Name of the Vulnerable Software and Affected Versions: ZhiCms version 4.0 Description: A critical vulnerability was found in the function index of the file app/manage/controller/setcontroller.php. The manipulation of the argument sitename leads to code injection. It is possible to launch the atta...

PT-2024-18665 · Session · Session

Name of the Vulnerable Software and Affected Versions: Session version 1.17.5 Description: The application is vulnerable to Local File Read via chat attachments, allowing internal application files and public files from the user's device to be obtained without the user's consent. Recommendations:...

PT-2024-20556

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 3.0.4 Apache Superset versions 3.1.0 through 3.1.0 Description The issue allows users with custom roles that include can write on dataset and without all data access permissions to create virtual datasets to...

PT-2024-20504 · Unknown · W3Speedster

Name of the Vulnerable Software and Affected Versions: W3SPEEDSTER versions prior to 7.20 Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For versions prior to 7.20, update to version 7....

PT-2024-21380 · Piwigo · Piwigo

Name of the Vulnerable Software and Affected Versions: Piwigo versions prior to 14.2.0 Description: An issue exists within Piwigo allowing a malicious user to take over the application. This exploit involves chaining a Cross Site Request Forgery vulnerability to issue a Stored Cross Site Scriptin...

PT-2024-6047

Name of the Vulnerable Software and Affected Versions Clojure versions 1.12.0-alpha5 through 1.20 Clojure versions 1.7.0 through 1.11.1 Description The issue is related to the deserialization of untrusted data, which can allow an attacker to cause a denial of service DoS via the...

PT-2024-19632

Name of the Vulnerable Software and Affected Versions Projectworlds Visitor Management System version 1.0 Description A SQL injection issue allows a remote attacker to escalate privileges via the name parameter in the "myform.php" endpoint. This enables the attacker to potentially gain unauthoriz...

PT-2024-15123 · WordPress · Acurax

Name of the Vulnerable Software and Affected Versions: Acurax plugin for WordPress versions up to, and including, 2.6 Description: The issue allows authenticated attackers to extract sensitive data, such as names and email addresses of subscribed visitors, due to Sensitive Information Exposure...

PT-2024-21168 · Blesta · Blesta

Name of the Vulnerable Software and Affected Versions: Blesta versions prior to 5.9.2 Description: A path traversal vulnerability in the "/path/to/uploads/" directory allows attackers to takeover user accounts and execute arbitrary code. Recommendations: For versions prior to 5.9.2, update to...

PT-2024-14283 · Apache · Apache James

Name of the Vulnerable Software and Affected Versions: Apache James versions prior to 3.8.1 and 3.7.5 Description: A lenient behavior in line delimiter handling might create a difference of interpretation between the sender and the receiver, which can be exploited by an attacker to forge an SMTP...

PT-2024-21152 · Unknown · Prestasalesmanager +1

Name of the Vulnerable Software and Affected Versions: PrestaShop module "Account Manager | Sales Representative & Dealers | CRM" prestasalesmanager versions up to 9.0 Description: A guest can download personal information without restriction by performing a path traversal attack in the affected...

Improving Security with Wallarm’s NIST CSF 2.0 Dashboard

Ensuring the security of web applications and APIs is more critical than ever. With threats becoming increasingly prevalent and sophisticated, organizations need to employ comprehensive security measures to protect their digital assets. The NIST Cybersecurity Framework CSF 2.0 stands at the...

PT-2024-19593 · Tencent · Tencent Blueking Cmdb

Name of the Vulnerable Software and Affected Versions: Tencent Blueking CMDB versions 3.2.x through 3.9.x Description: The issue is related to Server-Side Request Forgery SSRF via the event subscription function, located at the /service/subscription.go endpoint. This allows attackers to access...

PT-2024-13841 · Indo Sol · Indo-Sol Profinet-Inspektor Nt

Name of the Vulnerable Software and Affected Versions: Indo-Sol PROFINET-INspektor NT versions 2.4.0 and earlier Description: A command injection issue in the gedtupdater service of the firmware allows remote attackers to execute arbitrary system commands with root privileges. This is achieved vi...

PT-2024-21413 · Unknown · School Task Manager

Name of the Vulnerable Software and Affected Versions: School Task Manager version 1.0 Description: A SQL Injection issue allows a remote attacker to obtain sensitive information via a crafted payload to the "delete-task.php" component. This enables unauthorized access to data. Recommendations: F...

PT-2024-12943

Name of the Vulnerable Software and Affected Versions Student Enrollment In PHP version 1.0 Description An arbitrary file upload vulnerability in the Update/Edit Student's Profile Picture function allows attackers to execute arbitrary code via uploading a crafted PHP file. This issue enables...

PT-2024-21200 · Joomunited · Joomunited Wp Media Folder

Name of the Vulnerable Software and Affected Versions: JoomUnited WP Media folder versions n/a through 5.7.2 Description: The issue is related to an Unrestricted Upload of File with Dangerous Type vulnerability in the JoomUnited WP Media folder. This vulnerability allows for the upload of files...