CVE-2024-54764

ipTIME A2004 is affected by CVE-2024-54764 due to an access control flaw in /login/hostinfo2.cgi (firmware v12.17.0). Unauthenticated attackers can read sensitive information and device configuration. Root cause: improper access control. Affected: ipTIME A2004, firmware 12.17.0. Impact: informati...

CVE-2024-54763

The CVE-2024-54763 entry concerns the ipTIME A2004 router (v12.17.0). The issue is an access-control flaw in the /login/hostinfo.cgi component that allows unauthenticated attackers to obtain sensitive device information. The Nuclei template and related sources corroborate unauthenticated access t...

CVE-2024-12912

CVE-2024-12912 describes an improper input insertion vulnerability in ASUS AiCloud on certain router models that may lead to arbitrary command execution. The vulnerability is documented with a network attack vector, requiring high privileges and no user interaction, and it has a high impact on co...

CVE-2025-22214

CVE-2025-22214 relates to Landray EIS versions 2001–2006 and describes a SQL injection vulnerability in the message handling path at Message/fi_message_receiver.aspx?replyid= . The available connected documents confirm the affected product and the injection vector but do not provide explicit expl...

CVE-2024-56064

CVE-2024-56064 affects the WordPress plugin WP SuperBackup (indeed-wp-superbackup)

CVE-2024-13030

CVE-2024-13030 affects D-Link DIR-823G devices (firmware 1.0.2B05 20181207) via the Web Management Interface /HNAP1/ by manipulating SetAutoRebootSettings, SetClientInfo, SetDMZSettings, SetFirewallSettings, SetParentsControlInfo, SetQoSSettings, and SetVirtualServerSettings, leading to improper ...

CVE-2024-12856

CVE-2024-12856 affects Four-Faith router models F3x24 and F3x36. The OS command-injection vulnerability exists in the adjust_sys_time functionality exposed via /apply.cgi, allowing an authenticated user to modify system time and execute arbitrary OS commands over HTTP. In firmware v2.0, default c...

CVE-2024-12987

CVE-2024-12987 affects DrayTek Vigor2960 and Vigor300B running firmware 1.5.1.4, where the Web Management Interface endpoint /cgi-bin/mainfunction.cgi/apmcfgupload processes the session parameter in an insecure way, enabling OS command injection. The issue is exploitable remotely and has public e...

CVE-2024-53197

CVE-2024-53197 is an Linux kernel vulnerability in the USB audio driver (ALSA usb-audio). A malformed USB device can report a bNumConfigurations value larger than the initial allocation in usb_get_configuration, enabling out-of-bounds accesses later (e.g., during usb_destroy_configuration). The i...

CVE-2024-3393

CVE-2024-3393 affects Palo Alto Networks PAN-OS DNS Security: a vulnerability in parsing/logging malicious DNS packets allows an unauthenticated attacker to reboot the firewall via a crafted packet, with repeated attempts forcing maintenance mode. Connected sources indicate active exploitation an...

CVE-2024-53150

The CVE-2024-53150 issue affects the Linux kernel USB-audio (ALSA: usb-audio). The root cause is that the driver does not validate the bLength field of descriptors while traversing clock-related descriptors, allowing a bogus shorter descriptor to cause out-of-bounds reads. The public patch adds s...

CVE-2024-11349

The CVE-2024-11349 entry concerns the AdForest WordPress theme (≤5.1.6). The vulnerability is an authentication bypass caused by the plugin not properly verifying a user's identity before authenticating via sb_login_user_with_otp_fun(). As a result, unauthenticated attackers can log in as arbitra...

CVE-2024-56159

Astro CVE-2024-56159 describes an information-disclosure vulnerability where sourcemap files for server code are published publicly during build, enabling unauthenticated access to server source. Affected: server-output (SSR) projects on Astro 5.x from 5.0.3–5.0.7 with sourcemaps enabled; fix rel...

CVE-2024-11740

The CVE-2024-11740 entry concerns the WordPress Download Manager plugin (versions up to and including 3.3.03). The root cause is improper validation before executing do_shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes via an action. This results in an unauthenticated ...

CVE-2024-56145

Craft CMS is affected by CVE-2024-56145 due to a code execution vector triggered when php.ini register_argc_argv is enabled. Reports indicate an RCE vulnerability exists in affected versions, with remediation via upgrading to Craft CMS 3.9.14, 4.13.2, or 5.5.2. If upgrading is not possible, the r...

CVE-2024-12686

CVE-2024-12686 affects BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS); it is an OS command-injection vulnerability that can be exploited by an attacker with existing administrative privileges to upload a malicious file and execute OS commands as the site user. Public sources (...

CVE-2024-12025

The WordPress Collapsing Categories plugin (versions

CVE-2024-12356

CVE-2024-12356 describes a critical, unauthenticated command injection vulnerability in BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS). The issue allows an attacker to inject commands that execute with the site user’s privileges, potentially impacting confidentiality, integrit...

CVE-2024-55890

D‑Tale (Python package for Visualizing Pandas objects) prior to v3.16.1 is vulnerable to remote code execution when hosted publicly. The issue stems from the update-settings endpoint allowing an attacker to modify the enable_custom_filters flag, enabling arbitrary code execution on the server. Th...

CVE-2024-55956

CVE-2024-55956 affects Cleo Harmony, VLTrader, and LexiCom prior to version 5.8.0.24. The vulnerability allows unauthenticated attackers to import and execute arbitrary Bash or PowerShell commands on the host by abusing the default Autorun directory, effectively a remote code execution via an una...