NetBox Cross-Site Scripting Vulnerability (CNVD-2024-37580)

NetBox is a Django, PostgreSql based tool for IP Address Management IPAM and Data Center Infrastructure Management DCIM from the NetBox community. A cross-site scripting vulnerability exists in NetBox v4.0.3, which stems from the lack of effective filtering and escaping of user-supplied data in t...

CVE-2024-5792

CVE-2024-5792 affects Houzez CRM (WordPress) plugin up to version 1.4.2, exposing a time-based SQL Injection via the notes parameter bel ong_to, exploitable by authenticated users with Custom-level (seller) access or higher. Root cause: insufficient escaping/parameter handling in the existing SQL...

CVE-2024-4866

CVE-2024-4866 affects the UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS, Woo Widget, Menu Builder, Anywhere Elementor Shortcode) for WordPress. According to Red Hat and Wordfence data, all versions up to 1.1.6 are vulnerable to a Stored Cross-Site Scripting condit...

CVE-2024-39881

Delta Electronics CNCSoft-G2 lacks proper validation of user-supplied data, which can result in a memory corruption condition. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execute code in the context of the current process...

CVE-2024-39883 Heap-based Buffer Overflow in Delta Electronics CNCSoft-G2

Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execute code in the context of the current...

CVE-2024-39882

Delta Electronics CNCSoft-G2 is affected by CVE-2024-39882 (and related DPAX parsing flaws) causing an out-of-bounds read that can lead to remote code execution in the context of the current process. The vulnerability arises from insufficient validation when parsing DPAX files and can be triggere...

CVE-2024-39882 Out-of-bounds Read in Delta Electronics CNCSoft-G2

Delta Electronics CNCSoft-G2 lacks proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execute code in the context of the current proce...

CVE-2024-39880 Stack-based Buffer Overflow in Delta Electronics CNCSoft-G2

Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execute code in the context of the curren...

CVE-2024-3603 OSM – OpenStreetMap <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The OSM – OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'osmmap' shortcode in all versions up to, and including, 6.0.3 due to insufficient input sanitization and output escaping on user supplied attributes such as 'theme'. This makes it possible...

CVE-2024-5881

CVE-2024-5881 affects the Webico Slider Flatsome Addons plugin for WordPress. It enables a Stored Cross-Site Scripting (XSS) flaw in the plugin’s wbc_image shortcode due to insufficient input sanitization and output escaping. The vulnerability impacts all versions up to and including 2.0.1 . Expl...

SimpCMS Cross-Site Scripting Vulnerability

SimpCMS is an easy-to-use CMS based on PureEdit. A cross-site scripting vulnerability exists in SimpCMS version 0.1, which stems from the application's lack of effective filtering and escaping of user-supplied data, and can be exploited by an attacker to execute arbitrary web script or HTML via a...

CVE-2024-2926

The CVE-2024-2926 entry concerns the Elementor Addons by Livemesh WordPress plugin (versions up to and including 8.3.7). A Stored Cross-Site Scripting (XSS) vulnerability exists due to insufficient input sanitization and output escaping on user-supplied attributes in the plugin’s widgets. Exploit...

CVE-2024-3638

CVE-2024-3638 affects Elementor Addons by Livemesh (WordPress). Stored XSS via Marquee Text, Testimonials, and Testimonial Slider widgets in all versions

CVE-2024-6340

The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 4.10.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-6363

The Stock Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's stockticker shortcode in all versions up to, and including, 3.24.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

Apache Allura Cross-Site Scripting Vulnerability (CNVD-2024-39155)

Apache Allura is a set of open source project hosting platform of the U.S. Apache Apache Foundation. The platform supports the management of source code repositories, bug reports, wiki pages and blogs. A cross-site scripting vulnerability exists in Apache Allura versions 1.4.0 through 1.17.0, whi...

Moodle Cross-Site Scripting Vulnerability (CNVD-2024-48100)

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. Moodle suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied...

CVE-2024-6262

The Portfolio Gallery – Image Gallery Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'PFG' shortcode in all versions up to, and including, 1.6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

CVE-2024-5601

The Create by Mediavine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Schema Meta shortcode in all versions up to, and including, 1.9.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

Server-Side Request Forgery (SSRF)

vrana/adminer is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to the improper handling of user-supplied input in database connection fields. This allows an unauthenticated remote attacker to enumerate or access systems they would not otherwise have access to...