Archive
28 March 2024
Vulnerabilities first published on this day (UTC), newest first.
85 results · Clear filters · Feed
-
Medium 5.4
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Emap.Delete webap…
-
Medium 5.4
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Alert.Enum webapi…
-
Medium 5.4
Improper validation of array index vulnerability in UserPrivilege.Enum webapi component in Synology Surveillance Statio…
-
Medium 5.4
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in SnapShot.CountByC…
-
Medium 5.3
WordPress Community by PeepSo plugin <= 6.2.7.0 - Sensitive Data Exposure via Log File vulnerability
Insertion of Sensitive Information into Log File vulnerability in PeepSo Community by PeepSo.This issue affects Community by PeepSo: from n/a through 6.2.7.0.
-
Medium 5.4
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Layout.LayoutSave…
-
Medium 5.4
WordPress Max Mega Menu plugin <= 3.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in Megamenu Max Mega Menu.This issue affects Max Mega Menu: from n/a through 3.3.
-
Medium 5.4
WordPress Colibri Page Builder plugin <= 1.0.248 - Broken Access Control vulnerability
Missing Authorization vulnerability in ExtendThemes Colibri Page Builder.This issue affects Colibri Page Builder: from n/a through 1.0.248.
-
Medium 6.8
WordPress AI Engine plugin <= 2.1.4 - Server Side Request Forgery (SSRF) vulnerability
Server-Side Request Forgery (SSRF) vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 2.1.4.
-
Medium 5.4
WordPress Sunshine Photo Cart plugin <= 3.1.1 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through <= 3.1.1.
-
Medium 5.1
Pz-LinkCard <= 2.5.1 - Contributor+ SSRF
The Pz-LinkCard WordPress plugin through 2.5.1 does not prevent users from pinging arbitrary hosts via some of its shortcodes, which could allow high privilege users such as contributors to perform SSRF attacks.
-
Medium 6.1
Pz-LinkCard <= 2.5.1 - Admin+ Stored XSS
The Pz-LinkCard WordPress plugin through 2.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
-
Medium 5.4
Elementor Addon Elements <= 1.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 1.13.2 due to insufficient input sanitization and output escaping on user supplied attributes. This m…
-
Medium 4.3
Events Manager <= 6.4.7.1 - Cross-Site Request Forgery
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.4.7.1. This is due to missing or incorrect nonce validation on several actions. This makes it …
-
Medium 6.4
Events Manager <= 6.4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the physical location value in all versions up to, and including, 6.4.7.1 due to insufficient input sanitization and output escap…
-
Medium 5.3
appneta tcpreplay get.c get_layer4_v6 heap-based overflow
A vulnerability was found in appneta tcpreplay up to 4.4.4. It has been classified as problematic. This affects the function get_layer4_v6 of the file /tcpreplay/src/common/get.c. The manipulation leads to heap-based buffer overflow. Attacking locally is a re…
-
Medium 6.3
SourceCodester Simple Subscription Website manage_plan.php sql injection
A vulnerability classified as critical was found in SourceCodester Simple Subscription Website 1.0. Affected by this vulnerability is an unknown functionality of the file manage_plan.php. The manipulation of the argument id leads to sql injection. The attack …
-
Medium 6.3
SourceCodester Simple Subscription Website Actions.php sql injection
A vulnerability classified as critical has been found in SourceCodester Simple Subscription Website 1.0. Affected is an unknown function of the file Actions.php. The manipulation of the argument title leads to sql injection. It is possible to launch the attac…
-
Medium 5.3
Use of Insufficiently Random Values vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, …
-
Medium 6.0
Improper Access Controlvulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG…
-
Medium 5.3
Improper authentication vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, W…
-
Medium 4.7
Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-MS), WG1200HS, WG…
-
Medium 6.3CVE-2024-3013 EPSS 23%
Teledyne FLIR AX8 User Registration test_login.php improper authorization
A flaw has been found in Teledyne FLIR AX8 up to 1.46.16. The impacted element is an unknown function of the file /tools/test_login.php?action=register of the component User Registration. Executing manipulation can lead to improper authorization. The attack m…
-
Medium 6.1
halo v1.6.0 is vulnerable to Cross Site Scripting (XSS).
-
Medium 6.5
A Directory Traversal vulnerability in ladle dev server 2.5.1 and earlier allows an attacker on the same network to rea…
-
Medium 5.4
Technicolor TC8715D TC8715D-01.EF.04.38.00-180405-S-FF9-D RSE-TC8717T devices allow a remote attacker within Wi-Fi prox…
-
Medium 6.1
Technicolor TC8715D TC8715D-01.EF.04.38.00-180405-S-FF9-D RSE-TC8717T devices allow a remote attacker within Wi-Fi prox…
-
Medium 6.3
Incorrect Access Control in NodeBB
NodeBB 3.6.7 is vulnerable to Incorrect Access Control, e.g., a low-privileged attacker can access the restricted tabs for the Admin group via "isadmin":true.
-
Medium 5.5
Jerryscript 2.4.0 has SEGV at ./jerry-core/ecma/base/ecma-helpers.c:238:58 in ecma_get_object_type.
-
Medium 6.1
Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute…
-
Medium 6.3
Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute…
-
Medium 6.1
Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute…
-
Medium 6.4
Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute…
-
Medium 6.1
Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute…
-
Medium 5.3
SQL Injection vulnerability in Best Courier management system v.1.0 allows a remote attacker to obtain sensitive inform…
-
Medium 6.1
A cross site scripting (XSS) vulnerability in rems FAQ Management System v.1.0 allows a remote attacker to obtain sensi…
-
Medium 6.5
Tenda FH1203 v2.0.1.6 firmware has a stack overflow vulnerability in the security_5g parameter of the formWifiBasicSet …
-
Medium 6.5
Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the deviceId parameter of the saveParentControlInfo f…
-
Medium 6.5
Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the deviceMac parameter of the addWifiMacFilter funct…
-
Medium 6.5
Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the schedEndTime parameter of the setSchedWifi functi…