PT-2024-5278 · Phpipam · Phpipam

Name of the Vulnerable Software and Affected Versions: phpipam version 1.6 Description: The issue is related to a Cross Site Scripting XSS vulnerability. It exists due to insufficient protection of the web page structure in the appadmingroupsedit-group.php script of the phpipam web application fo...

CVE-2024-41355

phpipam 1.6 is vulnerable to Cross Site Scripting XSS via /app/tools/request-ip/index.php...

Sidekiq XSS

The vulnerability of the Sidekiq framework for handling background tasks in web applications is related to the lack of security measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

CVE-2024-6553

The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.3.This is due to the plugin utilizing wpdesk and leaving test files with displayerrors on. This makes it possible for unauthenticated attackers to...

CVE-2024-6571

CVE-2024-6571 affects the WordPress plugin that optimizes image ALT text and names for SEO using AI. The issue is a Full Path Disclosure in versions up to and including 3.1.1 caused by the plugin not preventing direct access to generate-default.php, enabling unauthenticated retrieval of the web a...

CVE-2024-6571 Optimize Images ALT Text (alt tag) & names for SEO using AI <= 3.1.1 - Unauthenticated Full Path Disclosure

The Optimize Images ALT Text alt tag & names for SEO using AI plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.1.1. This is due the plugin utilizing cocur and not preventing direct access to the generate-default.php file. This makes it possible fo...

CVE-2024-6553 WP Meteor Website Speed Optimization Addon <= 3.4.3 - Unauthenticated Full Path Disclosure

The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.3.This is due to the plugin utilizing wpdesk and leaving test files with displayerrors on. This makes it possible for unauthenticated attackers to...

CVE-2024-6553

Summary of CVE-2024-6553 : The WP Meteor Website Speed Optimization Addon for WordPress is vulnerable to Full Path Disclosure in all versions up to and including 3.4.3. Root cause: the plugin uses wpdesk and leaves test files with display_errors enabled, allowing unauthenticated access to the web...

CVE-2024-41665

Ampache, a web based audio/video streaming application and file manager, has a stored cross-site scripting XSS vulnerability in versions prior to 6.6.0. This vulnerability exists in the "Playlists - Democratic - Configure Democratic Playlist" feature. An attacker with Content Manager permissions...

CVE-2024-41661

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-50094. Reason: This candidate is a duplicate of CVE-2023-50094. Notes: All CVE users should reference CVE-2023-50094 instead of this candidate...

reNgine 安全漏洞

reNgine is an automated reconnaissance framework for web applications from the individual developer Yogesh Ojha. Focused on a highly configurable streamlined scouting process supported by an engine, scouting data correlation and organization, continuous monitoring, supported by a database and a...

LimeSurvey < 6.6.2-240827 SQLi Vulnerability

LimeSurvey is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:limesurvey:limesurvey...

Candy Redis 2.1.2 Admin Page Disclosure

==================================================================================================================================== | Title : Candy Redis V2.1.2 HTML Form in redirect page Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 125.0.1 64...

CVE-2024-6560

The CVE-2024-6560 entry concerns Addonify – Quick View For WooCommerce for WordPress. Affected versions: all up to 1.2.16. Root cause: the plugin uses mobiledetect without preventing direct access to its files, enabling unauthenticated full path disclosure. Impact: disclosed server path informati...

CVE-2024-6560 Addonify – Quick View For WooCommerce <= 1.2.16 - Unauthenticated Full Path Dislcosure

The Addonify – Quick View For WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2.16. This is due the plugin utilizing mobiledetect without preventing direct access to the files. This makes it possible for unauthenticated attackers to...

ROS-20240719-05

A vulnerability in the ejs web application development pattern for Node.Js is related to incorrect neutralization of special elements in the output data used by the input component. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code by injecting...

Hospital Management System Project In ASP.Net MVC 1 SQL Injection

Exploit Title: Hospital Management System Project in ASP.Net MVC - SQL Injection / Authentication Bypass Date: 07/16/2024 Exploit Author: 0xMykull Vendor Hompage: https://itsourcecode.com/free-projects/asp/hospital-management-system-project-in-asp-net-mvc-with-source-code/ Software Link:...

CVE-2024-6570

The Glossary plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.2.26. This is due the plugin utilizing wpdesk and not preventing direct access to the test files along with displayerrors being enabled. This makes it possible for unauthenticated...

CVE-2024-6559 XCloner <= 4.7.3 - Unauthenticated Full Path Disclosure

The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 4.7.3. This is due the plugin utilizing sabre without preventing direct access to the files. This makes it possible for...

CVE-2024-6557 SchedulePress <= 5.1.3 - Unauthenticated Full Path Disclosure

The SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 5.1.3. This is due the plugin utilizing the wpdeveloper library and...