Archive
September 2024
Vulnerabilities first published in this month (UTC), newest first.
2,542 results · Feed
-
Medium 5.4
Ultimate Blocks < 3.2.2 - Contributor+ Stored XSS
The Ultimate Blocks WordPress plugin before 3.2.2 does not validate and escape some of its block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cros…
-
Medium 4.8
Slider by 10Web < 1.2.59 - Admin+ Stored XSS
The Slider by 10Web WordPress plugin before 1.2.59 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (f…
-
Medium 5.4
Starbox < 3.5.3 - Contributor+ Stored XSS
The Starbox WordPress plugin before 3.5.3 does not properly render social media profiles URLs in certain contexts, like the malicious user's profile or pages where the starbox shortcode is used, which may be abused by users with at least the contributor role …
-
Medium 4.8
The Post Grid < 7.5.0 - Editor+ Stored XSS via Grid Creation
The Post Grid WordPress plugin before 7.5.0 does not sanitise and escape some of its Grid settings, which could allow high privilege users such as Editor and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disa…
-
Medium 4.3
An Information Disclosure vulnerability in the Telemetry component in TP-Link Kasa KP125M V1.0.0 and Tapo P125M 1.0.0 B…
-
Medium 6.6
An issue was discovered in Infinera hiT 7300 5.60.50. Sensitive information inside diagnostic files (exported by the @C…
-
Medium 6.5
An issue was discovered in Infinera hiT 7300 5.60.50. Cleartext storage of sensitive information in the memory of the @…
-
Low 2.7
An issue was discovered in Infinera hiT 7300 5.60.50. Hidden functionality in the web interface allows a remote authent…
-
High 8.8
An issue was discovered in Infinera hiT 7300 5.60.50. A hidden SSH service (on the local management network interface) …
-
Low 3.3
An issue was discovered in Infinera hiT 7300 5.60.50. A web application allows a remote privileged attacker to execute …
-
High 8.4
An issue was discovered in Infinera hiT 7300 5.60.50. Undocumented privileged functions in the @CT management applicati…
-
High 8.8
An issue was discovered in Infinera hiT 7300 5.60.50. Cleartext storage of sensitive password in firmware update packag…
-
Critical 9.8
Sourcecodester Online Medicine Ordering System 1.0 is vulnerable to Incorrect Access Control. There is a lack of author…
-
High 7.6
An issue in the TP-Link MQTT Broker and API gateway of TP-Link Kasa KP125M v1.0.3 allows attackers to establish connect…
-
High 7.5
LoadZilla LLC LoadLogic v1.4.3 was discovered to contain insecure permissions vulnerability which allows a remote attac…
-
High 8.8
PIX-LINK LV-WR22 RE3002-P1-01_V117.0 is vulnerable to Improper Access Control. The TELNET service is enabled with weak …
-
Medium 4.8
A reflected cross-site scripting (XSS) vulnerability on the homepage of Metronic Admin Dashboard Template v2.0 allows a…
-
Medium 6.3
A remote code execution (RCE) vulnerability in the component /admin/store.php of Emlog Pro before v2.3.15 allows attack…
-
Medium 5.9CVE-2024-46635 Public exploit
An issue in the API endpoint /AccountMaster/GetCurrentUserInfo of INROAD before v202402060 allows attackers to access s…
-
High 8.0
TP-Link WR941ND V6 has a stack overflow vulnerability in the ssid parameter in /userRpm/popupSiteSurveyRpm.htm.
-
Medium 6.3
TP-Link Tapo P125M and Kasa KP125M v1.0.3 was discovered to improperly validate certificates, allowing attackers to eav…
-
High 7.6
ESAFENET CDG v5 was discovered to contain a SQL injection vulnerability via the id parameter in the NavigationAjax inte…
-
Medium 6.5
Giflib Project v5.2.2 is vulnerable to a heap buffer overflow via gif2rgb.
-
Medium 6.3CVE-2024-45200 Public exploit
In Nintendo Mario Kart 8 Deluxe before 3.0.3, the LAN/LDN local multiplayer implementation allows a remote attacker to …
-
Medium 5.4
A Stored Cross-Site Scripting (XSS) vulnerability in Solvait 24.4.2 allows remote attackers to inject malicious scripts…
-
Critical 10.0
An issue was discovered in Atos Eviden iCare 2.7.1 through 2.7.11. The application exposes a web interface locally. In …
-
Medium 6.3
SourceCodester Advocate Office Management System edit_client.php sql injection
A vulnerability was found in SourceCodester Advocate Office Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /control/edit_client.php. The manipulation of the argument id leads to sql injection. The …
-
Medium 6.3
code-projects Blood Bank System forgot.php sql injection
A vulnerability was found in code-projects Blood Bank System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /forgot.php. The manipulation of the argument useremail leads to sql injection. The attack can be initiated…
-
High 7.3CVE-2024-9326 Public exploit
PHPGurukul Online Shopping Portal Admin Panel index.php sql injection
A vulnerability classified as critical was found in PHPGurukul Online Shopping Portal 2.0. This vulnerability affects unknown code of the file /shopping/admin/index.php of the component Admin Panel. The manipulation of the argument username leads to sql injec…
-
High 7.8
Intelbras InControl incontrol-service-watchdog.exe unquoted search path
A vulnerability classified as critical has been found in Intelbras InControl up to 2.21.56. This affects an unknown part of the file C:\Program Files (x86)\Intelbras\Incontrol Cliente\incontrol_webcam\incontrol-service-watchdog.exe. The manipulation leads to …
-
Medium 6.3
Intelbras InControl Relatório de Operadores Page operador code injection
A vulnerability was found in Intelbras InControl up to 2.21.57. It has been rated as critical. Affected by this issue is some unknown functionality of the file /v1/operador/ of the component Relatório de Operadores Page. The manipulation of the argument field…
-
Low 3.5
SourceCodester Inventory Management System add_staff.php cross site scripting
A vulnerability was found in SourceCodester Inventory Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /app/action/add_staff.php. The manipulation leads to cross site scripting.…
-
Medium 6.3
code-projects Supply Chain Management edit_manufacturer.php sql injection
A vulnerability was found in code-projects Supply Chain Management 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/edit_manufacturer.php. The manipulation of the argument id leads to sql injection. It is possible to…
-
Medium 5.3
SourceCodester Online Railway Reservation System view_details.php access control
A vulnerability was found in SourceCodester Online Railway Reservation System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/inquiries/view_details.php. The manipulation of the argument id leads to improper acces…
-
Low 3.5
SourceCodester Online Timesheet App Add Timesheet Form add-timesheet.php cross site scripting
A vulnerability has been found in SourceCodester Online Timesheet App 1.0 and classified as problematic. This vulnerability affects unknown code of the file /endpoint/add-timesheet.php of the component Add Timesheet Form. The manipulation of the argument day/…
-
Medium 6.3
SourceCodester Online Timesheet App delete-timesheet.php sql injection
A vulnerability, which was classified as critical, was found in SourceCodester Online Timesheet App 1.0. This affects an unknown part of the file /endpoint/delete-timesheet.php. The manipulation of the argument timesheet leads to sql injection. It is possible…
-
Medium 6.3
SourceCodester Advocate Office Management System activate.php sql injection
A vulnerability, which was classified as critical, has been found in SourceCodester Advocate Office Management System 1.0. Affected by this issue is some unknown functionality of the file /control/activate.php. The manipulation of the argument id leads to sql…
-
Medium 6.3
SourceCodester Online Eyewear Shop Master.php delete_category sql injection
A vulnerability classified as critical was found in SourceCodester Online Eyewear Shop 1.0. Affected by this vulnerability is the function delete_category of the file /classes/Master.php?f=delete_category. The manipulation of the argument id leads to sql inje…
-
Medium 6.3
code-projects Blood Bank Management System B+.php sql injection
A vulnerability classified as critical has been found in code-projects Blood Bank Management System 1.0. Affected is an unknown function of the file /admin/blood/update/B+.php. The manipulation of the argument Bloodname leads to sql injection. It is possible …
-
Medium 6.3
SourceCodester Employee and Visitor Gate Pass Logging System manage_department.php sql injection
A vulnerability was found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/maintenance/manage_department.php. The manipulation of the argument id …