CVE-2024-5315 Multiple vulnerabilities in DOLIBARR's ERP CMS

Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters viewstatut in...

CVE-2024-5314 Multiple vulnerabilities in DOLIBARR's ERP CMS

Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters sortorder y sortfield in...

CVE-2024-5314 Multiple vulnerabilities in DOLIBARR's ERP CMS

Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters sortorder y sortfield in...

CVE-2024-5314 Multiple vulnerabilities in DOLIBARR's ERP CMS

Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters sortorder y sortfield in...

Debezium UI 2.5 Credential Disclosure

Exploit Title: Debezium UI - Credential Leakage Google Dork: N/A Date: 2024-03-11 Exploit Author: Ihsan Cetin, Hamza Kaya Toprak Vendor Homepage: https://debezium.io/ Software Link: N/A Version: 2.5 REQUIRED Tested on: N/A CVE : CVE-2024-28736 Proof of concept: Details Debezium-ui version 2.5 is...

CVE-2024-5085

The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.0 via deserialization of untrusted input in the 'processentry' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No...

CVE-2024-4471

CVE-2024-4471 affects the 140+ Widgets | Xpro Addons For Elementor – FREE (WordPress). It is a PHP Object Injection vulnerability via deserialization in export_content, exploitable by authenticated users with contributor-level permissions or higher. The description notes no POP chain in the vulne...

kernel: ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode

In the Linux kernel, the following vulnerability has been resolved: ext4: add EXT4IGETBAD flag to prevent unexpected bad inode There are many places that will get unhappy and crash when ext4iget returns a bad inode. However, if iget the boot loader inode, allows a bad inode to be returned, becaus...

Latrodectus Malware Loader Emerges as IcedID's Successor in Phishing Campaigns

Cybersecurity researchers have observed a spike in email phishing campaigns starting early March 2024 that delivers Latrodectus, a nascent malware loader believed to be the successor to the IcedID malware. "These campaigns typically involve a recognizable infection chain involving oversized...

CVE-2024-35877

In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: fix VMPAT handling in COW mappings PAT handling won't do the right thing in COW mappings: the first PTE or, in fact, all PTEs can be replaced during write faults to point at anon folios. Reliably recovering the correc...

CVE-2024-4826

CVE-2024-4826 : SQL injection in the open-source PHP Shopping Cart (version 0.9) due to improper sanitisation of the category_id parameter in category.php. The issue enables an attacker to exfiltrate data from the database. CVSS metrics in the sources show a CRITICAL impact (CVSS v3.1/AV:N/AC:L/P...

CVE-2024-4992

CVE-2024-4992 : Vulnerability in SiAdmin 1.1 allows SQL injection via the nim parameter in the endpoint /modul/mod_kuliah/aksi_kuliah.php (also noted as /modul/mod kuliah/aksi kuliah.php). This could enable a remote attacker to craft SQL queries and retrieve all stored information. The connected ...

CVE-2024-4991

CVE-2024-4991 concerns SiAdmin 1.1, where an SQL injection arises from the parameter handling in the endpoint “/modul/mod_pass/aksi_pass.php” via the nama_lengkap input. The root cause is unsafely constructed SQL queries that can be manipulated by an attacker, enabling retrieval of data from the ...

CVE-2024-3750

The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to unauthorized modification and retrieval of data due to a missing capability check on the getQueryData function in all versions up to, and including, 3.10.15. This makes it possible for authenticated...

CVE-2024-3750

CVE-2024-3750 affects Visualizer: Tables and Charts Manager for WordPress. Root cause: missing capability check in getQueryData() across all versions up to 3.10.15, enabling authenticated users with subscriber-level access and above to run arbitrary SQL queries, with potential privilege escalatio...

CVE-2024-3750 Visualizer: Tables and Charts Manager for WordPress <= 3.10.15 - Missing Authorization to Arbitrary SQL Execution

The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to unauthorized modification and retrieval of data due to a missing capability check on the getQueryData function in all versions up to, and including, 3.10.15. This makes it possible for authenticated...

SiAdmin SQL注入漏洞

SiAdmin is an application. SiAdmin version 1.1 suffers from a SQL injection vulnerability that stems from the presence of a SQL injection vulnerability that allows a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in it...

CVE-2024-4199 Bulk Posts Editing For WordPress <= 4.2.3 - Authenticated (Subscriber+) Missing Authorization

The Bulk Posts Editing For WordPress plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on the plugin's AJAX actions in all versions up to, and including, 4.2.3. This makes it possible for authenticated attackers, with subscriber access an...

CVE-2024-4199

CVE-2024-4199 concerns the Bulk Posts Editing For WordPress plugin (all versions up to 4.2.3) with a missing capability check on AJAX actions, allowing authenticated users with subscriber+ privileges to invoke plugin functions. The Wordfence entry states unauthorized access could enable post crea...

GitHub: Information Leakage via Clicked Link in GitHub Repository (Fingerprinting)

A vulnerability was identified in GitHub Enterprise Server that allowed an attacker to retrieve metadata information of a user who clicks on an uploaded malicious asset URL. The vulnerability affected all versions prior to 3.14 and was fixed in later versions...