CVE-2024-38764

Cross-Site Request Forgery CSRF vulnerability in Marsian allows Cross Site Request Forgery.This issue affects i-transform: from n/a through 3.0.9...

CVE-2024-37937

Cross-Site Request Forgery CSRF vulnerability in raratheme Rara Business rara-business allows Cross Site Request Forgery.This issue affects Rara Business: from n/a through = 1.2.5...

CVE-2024-37518

CVE-2024-37518 is a CSRF vulnerability in The Events Calendar plugin for WordPress, affecting The Events Calendar versions up to 6.5.1.4. The issue is mitigated by upgrading to version 6.5.1.4 or later (the patched release). The connected sources confirm the vulnerability class as Cross-Site Requ...

CVE-2024-37426

CVE-2024-37426 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the WordPress plugin/theme combo “Elegant Pink” (Rara Theme) up to version 1.3.0. Public records consistently describe it as a CSRF issue in Elegant Pink; CVSS from NVD assigns 4.3 (Medium) with network attack vector, l...

CVE-2024-56036

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ondrej Donek odPhotogallery od-photogallery-plugin allows Reflected XSS.This issue affects odPhotogallery: from n/a through = 0.5.3...

PT-2025-26768 · Debian · Debian

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: General information about the issue is not available. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability...

CVE-2024-56044

Authentication Bypass Using an Alternate Path or Channel vulnerability in VibeThemes WPLMS wplmsplugin allows Authentication Bypass.This issue affects WPLMS: from n/a through = 1.9.9...

CVE-2024-56068

Deserialization of Untrusted Data vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup.This issue affects WP SuperBackup: from n/a through = 2.3.3...

CVE-2024-56039

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in VibeThemes VibeBP vibebp allows SQL Injection.This issue affects VibeBP: from n/a through 1.9.9.7.7...

CVE-2024-56229

Cross-Site Request Forgery CSRF vulnerability in Searchiq SearchIQ.This issue affects SearchIQ: from n/a through 4.6...

CVE-2024-56508

LinkAce is a self-hosted archive to collect links of your favorite websites. Prior to 1.15.6, a file upload vulnerability exists in the LinkAce. This issue occurs in the "Import Bookmarks" functionality, where malicious HTML files can be uploaded containing JavaScript payloads. These payloads...

CVE-2024-56351

In JetBrains TeamCity before 2024.12 access tokens were not revoked after removing user roles...

GHSA-C9F5-29F6-C35W Browsershot Improper Input Validation vulnerability

Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input Validation due to improper URL validation through the setUrl method. An attacker can exploit this vulnerability by utilizing view-source:file://, which allows for arbitrary file reading on a local file. Note:...

CVE-2024-4995 Protocol Downgrade in Wapro ERP Desktop

Wapro ERP Desktop is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data interception and modification. This issue affects Wapro ERP Desktop versions before 9.00.0...

Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability

Time-of-check Time-of-use TOCTOU Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write non-default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from...

CVE-2024-8972

CVE-2024-8972 describes an SQL injection in Mobil365 Informatics’ Saha365 App caused by improper neutralization of special elements in SQL commands. Affected: Saha365 App prior to 30.09.2024. Root cause: improper neutralization of dynamic SQL. Impact as per sources: high confidentiality, integrit...

CVE-2024-35230

CVE-2024-35230 affects GeoServer (Java) where the welcome and about pages disclose version and revision information of the server and components. This information exposure can aid fingerprinting of the running software. The issue has been patched in version 2.26.0; users should upgrade to 2.26.0 ...

CVE-2024-35230 Welcome and About GeoServer pages communicate version and revision information

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. In affected versions the welcome and about page includes version and revision information about the software in use including library and components used. This information is sensitive...

CVE-2024-54382

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in boldthemes Bold Page Builder bold-page-builder allows Path Traversal.This issue affects Bold Page Builder: from n/a through = 5.1.5...

CVE-2024-54250

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in prodigycommerce Prodigy Commerce prodigy-commerce allows DOM-Based XSS.This issue affects Prodigy Commerce: from n/a through = 3.0.8...