CVE-2024-3370 SQLi in Egebilgi Software's Website Template

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Egebilgi Software Website Template allows SQL Injection. This issue affects Website Template: before 29.04.2024...

CVE-2024-48962

Improper Control of Generation of Code 'Code Injection', Cross-Site Request Forgery CSRF, : Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.17. Users are recommended to upgrade to version 18.12.17,...

CVE-2024-48962 Apache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE)

Improper Control of Generation of Code 'Code Injection', Cross-Site Request Forgery CSRF, : Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.17. Users are recommended to upgrade to version 18.12.17,...

Egebilgi Software Website Template SQL注入漏洞

Egebilgi Software Website Template is a series of website templates from Egebilgi Software. A SQL injection vulnerability exists in versions of Egebilgi Software Website Template prior to 29.04.2024, which stems from the use of incorrect special element neutralization, which can lead to SQL...

CVE-2024-8673

creationtimestamp| type| source ---|---|--- 2024-11-16 18:17:28+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2024/CVE-2024-8673.yaml...

CVE-2024-8856

creationtimestamp| type| source ---|---|--- 2024-11-16 06:52:51+00:00| seen| https://t.me/cvedetector/11225 2024-11-17 06:17:37+00:00| seen| https://t.me/CyberBulletin/26463 2024-11-17 06:17:37+00:00| seen| https://t.me/CyberBulletin/1490 2024-11-22 10:05:08+00:00| published-proof-of-concept|...

CVE-2024-10795 Popularis Extra <= 1.2.7 - Authenticated (Contributor+) Post Disclosure

The Popularis Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.7 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with...

CVE-2024-10795

CVE-2024-10795 affects the WordPress plugin Popularis Extra (versions

PT-2024-8602 · Apache · Apache Ofbiz

Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions prior to 18.12.17 Description: The issue is related to improper control of code generation, allowing for code injection, and also involves cross-site request forgery CSRF and improper neutralization of special elements...

CVE-2021-1484

A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to inject arbitrary commands on an affected system and cause a denial of service DoS condition. This vulnerability is due to improper input validation of user-supplied input to the device...

CVE-2024-10582

The Music Player for Elementor – Audio Player & Podcast Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the importmpfetemplate function in all versions up to, and including, 2.4.1. This makes it possible for authenticated...

CVE-2024-10582

The Music Player for Elementor – Audio Player & Podcast Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the importmpfetemplate function in all versions up to, and including, 2.4.1. This makes it possible for authenticated...

CVE-2024-10582 Music Player for Elementor – Audio Player & Podcast Player <= 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Template Import

The Music Player for Elementor – Audio Player & Podcast Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the importmpfetemplate function in all versions up to, and including, 2.4.1. This makes it possible for authenticated...

Fedora 37 : php-twig (2022-c6fe3ebd94)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-c6fe3ebd94 advisory. Version 1.44.7 2022-09-28 Fix a security issue on filesystem loader possibility to load a template outside a configured directory Tenable has extracted the...

PT-2024-16381 · WordPress · The Music Player For Elementor – Audio Player & Podcast Player

Name of the Vulnerable Software and Affected Versions: The Music Player for Elementor – Audio Player & Podcast Player plugin for WordPress versions up to, and including, 2.4.1 Description: The issue is related to unauthorized modification of data due to a missing capability check on the import mp...

Rejetto HTTP File Server 2.x <= 2.3m RCE (CVE-2024-23692) (direct check)

Binary data rejettohfsrceCVE-2024-23692.nbin...

WordPress Music Player for Elementor plugin <= 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Template Import vulnerability

Missing Authorization to Authenticated Subscriber+ Template Import vulnerability discovered by WordFence in WordPress Plugin Music Player for Elementor – Audio Player & Podcast Player versions = 2.4.1...

CVE-2024-52393

Deserialization of Untrusted Data vulnerability in Eric Teubert Podlove Podcast Publisher podlove-podcasting-plugin-for-wordpress.This issue affects Podlove Podcast Publisher: from n/a through = 4.1.15...

CVE-2024-52393 WordPress Podlove Podcast Publisher plugin <= 4.1.15 - Admin+ Remote Code Execution (RCE) vulnerability

Deserialization of Untrusted Data vulnerability in Eric Teubert Podlove Podcast Publisher podlove-podcasting-plugin-for-wordpress.This issue affects Podlove Podcast Publisher: from n/a through = 4.1.15...

CVE-2024-52393

CVE-2024-52393 affects the WordPress Podlove Podcast Publisher plugin up to version 4.1.15, with an Admin+ Remote Code Execution (RCE) vector due to Improper Neutralization of Special Elements Used in a Template Engine . Multiple sources (including Patchstack) corroborate the RCE impact and refer...