PT-2024-27316 · Unknown · Biplob Adhikari Tabs

Name of the Vulnerable Software and Affected Versions: Biplob Adhikari Tabs versions n/a through 4.0.6 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations: For...

WordPress CM Pop-Up banners Plugin < 1.6.6 is vulnerable to Cross Site Scripting (XSS)

Software CM Pop-Up banners Type Plugin Vulnerable versions 1.6.6 Fixed in 1.6.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5004 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 2c09d4a685e6 Credits Felipe Caon Required...

PT-2024-37951 · Perkinelmer · Perkinelmer Processplus

Name of the Vulnerable Software and Affected Versions: PerkinElmer ProcessPlus versions through 1.11.6507.0 Description: The issue is related to a local file inclusion in PerkinElmer ProcessPlus, allowing files on the Windows system to be accessible without authentication to external parties...

CVE-2024-37488

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in HelloAsso allows Stored XSS.This issue affects HelloAsso: from n/a through 1.1.9...

PT-2024-37982 · Zhongbangkeji · Crmeb

Name of the Vulnerable Software and Affected Versions: ZhongBangKeJi CRMEB versions up to 5.4.0 Description: A critical issue has been found, affecting the function downloadImage of the file app/services/product/product/CopyTaobaoServices.php. This issue leads to deserialization and can be...

PT-2024-37983 · Zhongbangkeji · Crmeb

Name of the Vulnerable Software and Affected Versions: ZhongBangKeJi CRMEB versions up to 5.4.0 Description: A critical issue was found in the function get image base64 of the file PublicController.php. The manipulation of the argument file leads to deserialization. This issue can be exploited...

WordPress Leaflet Maps Marker plugin <= 3.12.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin Leaflet Maps Marker versions = 3.12.9...

WordPress CTX Feed plugin <= 6.5.6 - Arbitrary Options Update vulnerability

Arbitrary Options Update vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin CTX Feed versions = 6.5.6...

WordPress Security Optimizer plugin <= 1.5.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin SiteGround Security versions = 1.5.0...

CVE-2024-6338

The FV Flowplayer Video Player plugin for WordPress is vulnerable to time-based SQL Injection via the ‘exclude’ parameter in all versions up to, and including, 7.5.46.7212 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Thi...

VulnCheck KEV: CVE-2024-38771

Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration.This issue affects Atarim: from n/a through = 4.0...

CVE-2024-6808

A vulnerability was found in itsourcecode Simple Task List 1.0. It has been classified as critical. This affects the function insertUserRecord of the file signUp.php. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has...

PT-2024-28618 · WordPress · Cooked

Name of the Vulnerable Software and Affected Versions: Cooked plugin for WordPress versions up to, and including, 1.7.15.4 Description: The issue is related to Cross-Site Request Forgery CSRF due to missing or incorrect nonce validation on the AJAX action handler. This could allow an attacker to...

PT-2024-28617 · WordPress · Cooked

Name of the Vulnerable Software and Affected Versions: Cooked versions up to, and including, 1.7.15.4 Description: The Cooked plugin for WordPress is affected by a Cross-Site Request Forgery CSRF issue due to missing or incorrect nonce validation on the AJAX action handler. This could allow an...

AZL-50565 CVE-2024-21127 affecting package mysql for versions less than 8.0.40-1

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DDL. Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

WordPress The Pack Elementor addons plugin <= 2.0.8.6 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro Soares de Alcântara Kinorth in WordPress Plugin The Pack Elementor addons versions = 2.0.8.6...

WordPress HUSKY plugin <= 1.3.6 - Unauthenticated Time-Based SQL Injection vulnerability

Unauthenticated Time-Based SQL Injection vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin HUSKY versions = 1.3.6...

CVE-2024-38706

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in HasThemes HT Mega allows Path Traversal.This issue affects HT Mega: from n/a through 2.5.7...

WordPress Matomo Analytics plugin <= 5.1.1 - Cross Site Request Forgery (CSRF) leading to Notice Dismissal vulnerability

Cross Site Request Forgery CSRF leading to Notice Dismissal vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin Matomo Analytics versions = 5.1.1...

CVE-2024-6353

The Wallet for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'searchvalue' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...