2,625 results · Clear filters · Feed
-
Medium 5.5CVE-2024-26475 Public exploit
An issue in radareorg radare2 v.0.9.7 through v.5.8.6 and fixed in v.5.8.8 allows a local attacker to cause a denial of…
-
Medium 6.1CVE-2024-2242 Public exploit
Contact Form 7 <= 5.9 - Reflected Cross-Site Scripting
The Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘active-tab’ parameter in all versions up to, and including, 5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthentic…
-
Medium 4.5CVE-2024-2432 Public exploit
GlobalProtect App: Local Privilege Escalation (PE) Vulnerability
A privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a local user to execute programs with elevated privileges. However, execution requires that the local user is able to successfully exploit a race …
-
Medium 5.3
Relevanssi – A Better Search <= 4.22.0 (Free) and <= 2.25.0 (Premium) - Missing Authorization to Unauthenticated Query Log Export
The Relevanssi – A Better Search plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the relevanssi_export_log_check() function in all versions up to, and including, 4.22.0 (Free) and 2.25.0 (Premium). This m…
-
Medium 6.4CVE-2024-1234 Public exploit
Exclusive Addons for Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via data attribute in all versions up to, and including, 2.6.9 due to insufficient input sanitization and output escaping. This makes it possible for authenti…
-
Medium 6.1
RiteCMS v3.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component main_menu/edit_se…
-
Medium 5.5
Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability
Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability
-
Medium 6.3CVE-2024-1304 Public exploit
Multiple Vulnerabilities in Badger Meter's Monitool
Cross-site scripting vulnerability in Badger Meter Monitool that affects versions up to 4.6.3 and earlier. This vulnerability allows a remote attacker to send a specially crafted javascript payload to an authenticated user and partially hijack their browser s…
-
Medium 6.5CVE-2024-1303 Public exploit
Multiple Vulnerabilities in Badger Meter's Monitool
Incorrectly limiting the path to a restricted directory vulnerability in Badger Meter Monitool that affects versions up to 4.6.3 and earlier. This vulnerability allows an authenticated attacker to retrieve any file from the device using the download-file func…
-
Medium 4.8CVE-2024-26521 Public exploit
HTML Injection vulnerability in CE Phoenix v1.0.8.20 and before allows a remote attacker to execute arbitrary code, esc…
-
Medium 5.3
Seriously Simple Podcasting < 3.0.0 - Unauthenticated Administrator Email Disclosure
The Seriously Simple Podcasting WordPress plugin before 3.0.0 discloses the Podcast owner's email address (which by default is the admin email address) via an unauthenticated crafted request.
-
Medium 5.5CVE-2024-1441 Public exploit
Libvirt: off-by-one error in udevlistinterfacesbystatus()
An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number of interfaces exceeds the size of the `names` array. This issue can be reproduced by sending specially crafted data to the libvirt daemon, allowing an u…
-
Medium 6.2
Numbas editor before 7.3 mishandles editing of themes and extensions.
-
Medium 5.4CVE-2023-51281 Public exploit
Cross Site Scripting vulnerability in Customer Support System v.1.0 allows a remote attacker to escalate privileges via…
-
Medium 5.4CVE-2023-49987 Public exploit
A cross-site scripting (XSS) vulnerability in the component /management/term of School Fees Management System v1.0 allo…
-
Medium 4.7CVE-2023-49986 Public exploit
A cross-site scripting (XSS) vulnerability in the component /admin/parent of School Fees Management System 1.0 allow at…
-
Medium 6.1CVE-2024-24035 Public exploit
Cross Site Scripting (XSS) vulnerability in Setor Informatica SIL 3.1 allows attackers to run arbitrary code via the hm…
-
Medium 6.5CVE-2023-49985 Public exploit
A cross-site scripting (XSS) vulnerability in the component /management/class of School Fees Management System v1.0 all…
-
Medium 4.7CVE-2023-49971 Public exploit
A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scri…
-
Medium 6.1CVE-2023-49973 Public exploit
A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scri…
-
Medium 6.1CVE-2023-49974 Public exploit
A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scri…
-
Medium 6.1CVE-2023-49984 Public exploit
A cross-site scripting (XSS) vulnerability in the component /management/settings of School Fees Management System v1.0 …
-
Medium 6.8CVE-2023-49983 Public exploit
A cross-site scripting (XSS) vulnerability in the component /management/class of School Fees Management System v1.0 all…
-
Medium 5.4CVE-2023-49976 Public exploit
A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scri…
-
Medium 5.4CVE-2023-49977 Public exploit
A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scri…
-
Medium 5.8
pictureproxy.php in the dirk1983 mm1.ltd source code f9f4bbc allows SSRF via the url parameter. NOTE: the references se…
-
Medium 5.5CVE-2024-22889 Public exploit
Phone information disclosure vulnerability
Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a crafted request.
-
Medium 4.3CVE-2023-49969 Public exploit
Customer Support System v1 was discovered to contain a SQL injection vulnerability via the id parameter at /customer_su…
-
Medium 6.3CVE-2024-2074 Public exploit
Mini-Tmall 1 sql injection
A vulnerability was found in Mini-Tmall up to 20231017 and classified as critical. This issue affects some unknown processing of the file ?r=tmall/admin/user/1/1. The manipulation of the argument orderBy leads to sql injection. The attack may be initiated rem…
-
Medium 6.1CVE-2023-49539 Public exploit
Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/inde…
-
Medium 6.1CVE-2023-49540 Public exploit
Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/inde…
-
Medium 4.9CVE-2023-49544 Public exploit
A local file inclusion (LFI) in Customer Support System v1 allows attackers to include internal PHP files and gain unau…
-
Medium 6.1CVE-2024-27743 Public exploit
Cross Site Scripting vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code…
-
Medium 6.1CVE-2024-27744 Public exploit
Cross Site Scripting vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code…
-
Medium 6.1CVE-2023-51800 Public exploit
Cross Site Scripting (XSS) vulnerability in School Fees Management System v.1.0 allows a remote attacker to execute arb…
-
Medium 6.1CVE-2023-51802 Public exploit
Cross Site Scripting (XSS) vulnerability in the Simple Student Attendance System v.1.0 allows a remote attacker to exec…
-
Medium 6.1CVE-2024-25202 Public exploit
Cross Site Scripting vulnerability in Phpgurukul User Registration & Login and User Management System 1.0 allows attack…
-
Medium 6.5CVE-2024-22532 Public exploit
Buffer Overflow vulnerability in XNSoft NConvert 7.163 (for Windows x86) allows attackers to cause a denial of service …
-
Medium 5.3CVE-2024-26144 Public exploit
Possible Sensitive Session Information Leak in Active Storage
Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also …
-
Medium 6.5CVE-2024-25082 Public exploit
Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.