CVE-2024-50442

CVE-2024-50442 is an XML External Entity (XXE) vulnerability in WordPress plugin Royal Elementor Addons and Templates (

PT-2024-34248 · Unknown · Checklist Trip Plan

Name of the Vulnerable Software and Affected Versions: Checklist Trip Plan versions n/a through 1.0.10 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations: For...

PT-2024-34236 · Unknown · Firelight Lightbox

Name of the Vulnerable Software and Affected Versions: Firelight Lightbox versions 2.3.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations: For...

PT-2024-33016 · Unknown · Dingfanzu Cms

Name of the Vulnerable Software and Affected Versions: dingfanzu CMS version 1.0 Description: The issue is related to a Cross-Site Request Forgery CSRF in the component /admin/doAdminAction.php?act=delAdmin&id=17. This allows for unauthorized actions to be performed. Recommendations: For dingfanz...

ROS-20241028-02

The vulnerability of the net-netip component of Golang programming language is related to incorrect operation of Is methods IsPrivate, IsLoopback, etc. methods. Exploitation of the vulnerability can allow an intruder to bypass the existing access restriction policy...

PT-2024-34221 · Unknown · Futurio Extra

Name of the Vulnerable Software and Affected Versions: Futurio Extra versions 2.0.11 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations: For...

PT-2024-16252 · Code Projects · Code-Projects Blood Bank Management

Name of the Vulnerable Software and Affected Versions: code-projects Blood Bank Management version 1.0 Description: A critical issue affects the processing of the file /file/accept.php, where the manipulation of the reqid argument leads to SQL injection. The attack can be initiated remotely...

PT-2024-16251 · Unknown · Code-Projects Blood Bank Management

Name of the Vulnerable Software and Affected Versions: code-projects Blood Bank Management versions up to 1.0 Description: A critical issue has been found in the code, affecting the file /abs.php. The manipulation of the search argument leads to SQL injection. This issue can be exploited remotely...

PT-2024-10120

Name of the Vulnerable Software and Affected Versions libexpat versions prior to 2.6.4 Description The issue is related to the XML ResumeParser function in the libexpat library, which can cause a crash due to insufficient checking of unusual or exceptional states. This can be exploited by a remot...

PT-2024-16263 · Unknown · Code-Projects Blood Bank Management System

Name of the Vulnerable Software and Affected Versions: code-projects Blood Bank Management System version 1.0 Description: A problematic issue was found in the system, affecting some unknown functionality of the file /bloodrequest.php. The manipulation of the msg argument leads to cross-site...

CVE-2024-49753 Denied Host Validation Bypass in Zitadel Actions

Zitadel is open-source identity infrastructure software. Versions prior to 2.64.1, 2.63.6, 2.62.8, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 have a flaw in the URL validation mechanism of Zitadel actions allows bypassing restrictions intended to block requests to localhost 127.0.0.1. The isHostBlocked...

PT-2024-39702 · WordPress · Image Map Pro

Name of the Vulnerable Software and Affected Versions: Image Map Pro plugin for WordPress versions up to, and including, 6.0.20 Description: The issue is related to Stored Cross-Site Scripting via the save project function, allowing authenticated attackers with contributor-level and above...

PT-2024-11553 · Ovaledge · Ovaledge

Name of the Vulnerable Software and Affected Versions: OvalEdge versions 5.2.8.0 and earlier Description: The issue allows for an Account Takeover via a POST request to "/profile/updateProfile" using the userId and email parameters. Authentication is required to exploit this issue. Recommendation...

PT-2024-27780 · Mangoos · Mangoos

Name of the Vulnerable Software and Affected Versions: MangoOS versions prior to 5.2.0 Description: The issue is related to a Client-Side Template Injection CSTI vulnerability. This vulnerability can be exploited via the Platform Management Edit page. Recommendations: For versions prior to 5.2.0,...

PT-2024-33085 · Unknown · Esafenet Cdg

Name of the Vulnerable Software and Affected Versions: ESAFENET CDG versions 5 and earlier Description: A SQL Injection issue allows an attacker to execute arbitrary code via the id parameter of the "dataSearch.jsp" page. Recommendations: For versions 5 and earlier, update to a version that...

PT-2024-11555 · Ovaledge · Ovaledge

Name of the Vulnerable Software and Affected Versions: OvalEdge versions 5.2.8.0 and earlier Description: The issue allows for an Account Takeover via a POST request to "/profile/updateProfile" using the userId and email parameters. Authentication is required to exploit this issue. Recommendation...

PT-2024-11552 · Ovaledge · Ovaledge

Name of the Vulnerable Software and Affected Versions: OvalEdge versions 5.2.8.0 and earlier Description: The issue allows for Sensitive Data Exposure through a GET request to "/user/getUserWithTeam". This requires authentication and discloses information associated with all registered user ID...

PT-2024-33494 · Plenti +1 · Plenti +1

Name of the Vulnerable Software and Affected Versions: Plenti versions prior to 0.7.2 Description: The issue is related to an arbitrary file write vulnerability. The /postLocal endpoint is vulnerable, which may lead to Remote Code Execution when a Plenti user serves their website. Recommendations...

OpenRefine has a path traversal in LoadLanguageCommand

The load-language command expects a lang parameter from which it constructs the path of the localization file to load, of the form translations-$LANG.json. When doing so, it does not check that the resulting path is in the expected directory, which means that this command could be exploited to re...

PT-2024-16194 · Janto · Janto

Name of the Vulnerable Software and Affected Versions: Janto version 4.3r11 Description: A Cross-Site Scripting issue has been found, allowing an attacker to execute JavaScript code in a victim's browser. This is achieved by sending a malicious URL using the endpoint...