PT-2024-7979 · Nvidia · Nvidia Nemo

Name of the Vulnerable Software and Affected Versions: NVIDIA NeMo versions up to r2.0.0rc0 Description: The issue is related to the SaveRestoreConnector function in NVIDIA NeMo, which is associated with incorrect restriction of the directory path name with limited access. Exploitation of this...

CVE-2024-9201

The SEUR plugin, in its versions prior to 2.5.11, is vulnerable to time-based SQL injection through the use of the ‘idorder’ parameter of the ‘/modules/seur/ajax/saveCodFee.php’ endpoint...

PT-2024-32450

Name of the Vulnerable Software and Affected Versions Gradio versions prior to 5 Description This issue relates to Server-Side Request Forgery SSRF in the "/queue/join" endpoint. Gradio’s async save url to cache function allows attackers to force the Gradio server to send HTTP requests to...

PT-2024-39065 · WordPress · Qa Analytics – Web Analytics Tool With Heatmaps & Session Replay Across All Pages

Name of the Vulnerable Software and Affected Versions: QA Analytics – Web Analytics Tool with Heatmaps & Session Replay Across All Pages plugin for WordPress versions up to, and including, 4.1.0.0 Description: The issue is related to a missing capability check on the ajax save plugin config...

vscode -- Visual Studio Code for Linux Remote Code Execution Vulnerability

VSCode developers report: Visual Studio Code for Linux Remote Code Execution Vulnerability A remote code execution vulnerability exists in VS Code 1.94.0 and earlier versions in the elevated save flow...

CVE-2024-9572

Cross-Site Scripting XSS vulnerability in SOPlanning 1.45, due to lack of proper validation of user input via /soplanning/www/process/groupesave.php, in the groupeid parameter. This could allow a remote user to send a specially crafted query to an authenticated user and steal their session detail...

PT-2024-7161 · Unknown · Soplanning

Name of the Vulnerable Software and Affected Versions: SOPlanning versions prior to 1.45 Description: The issue is a Cross-Site Scripting XSS vulnerability due to the lack of proper validation of user input. This could allow a remote user to send a specially crafted query to an authenticated user...

Simple Music Management System 1.0 Add Administrator / Cross Site Request Forgery

============================================================================================================================================= | Title : Simple Music Management System v1.0 CSRF Add ADmin Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla...

CVE-2024-7714

The AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 lacks sufficient access controls allowing an unauthenticated user to disconnect the AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 from OpenAI, thereby disabling the AI ChatB...

PT-2024-39549 · Unknown · Dingfanzu Cms

Name of the Vulnerable Software and Affected Versions: dingfanzu CMS up to 29d67d9044f6f93378e6eb6ff92272217ff7225c Description: A critical issue has been found in the software, affecting some unknown functionality of the file saveNewPwd.php. The manipulation of the username argument leads to sql...

PT-2024-38530 · Ays · Ai Chatbot With Chatgpt/Content Generator

Name of the Vulnerable Software and Affected Versions: AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin versions prior to 2.1.0 Description: The issue is related to insufficient access controls in the AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin,...

VulnCheck KEV: CVE-2024-4325

A Server-Side Request Forgery SSRF vulnerability exists in the gradio-app/gradio version 4.21.0, specifically within the /queue/join endpoint and the saveurltocache function. The vulnerability arises when the path value, obtained from the user and expected to be a URL, is used to make an HTTP...

CVE-2024-8432

The Appointment & Event Booking Calendar Plugin – Webba Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveappearance function in all versions up to, and including, 5.0.48. This makes it possible for authenticated attackers...

PT-2024-39009 · WordPress · Webba Booking

Name of the Vulnerable Software and Affected Versions: The Appointment & Event Booking Calendar Plugin – Webba Booking plugin for WordPress versions up to, and including, 5.0.48 Description: The issue allows authenticated attackers with Subscriber-level access and above to modify the booking form...

CVE-2024-9082

A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /classes/Users.php?f=save of the component User Creation Handler. The manipulation of the argument Type with the input 1 leads to...

CVE-2024-9082 SourceCodester Online Eyewear Shop User Creation Users.php improper authorization

A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /classes/Users.php?f=save of the component User Creation Handler. The manipulation of the argument Type with the input 1 leads to...

PT-2024-39416

Name of the Vulnerable Software and Affected Versions SourceCodester Online Eyewear Shop version 1.0 Description A critical issue affects some unknown functionality of the file /Users.phpf=save of the component User Creation Handler. The manipulation of the type argument with the input 1 leads to...

CVE-2024-9082: Improper Authorization

A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /classes/Users.php?f=save of the component User Creation Handler. The manipulation of the argument Type with the input 1 leads to...

CVE-2024-9033

A vulnerability has been found in SourceCodester Best House Rental Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=savecategory. The manipulation of the argument name leads to cross site scripting. The...

SourceCodester Best House Rental Management System 跨站脚本漏洞

SourceCodester Best House Rental Management System is a house rental management system from SourceCodester. A cross-site scripting vulnerability exists in SourceCodester Best House Rental Management System version 1.0, which originates from a cross-site scripting vulnerability in the name paramet...