2024

The Ultimate Membership Pro plugin for WordPress is vulnerable to Authentication Bypass in versions between, and includi

The SiteGround Optimizer plugin for WordPress is vulnerable to authorization bypass leading to Remote Code Execution and

The Advanced Access Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read in versions up to,

The File Manager plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the /i

The Kento Post View Counter plugin for WordPress is vulnerable to SQL Injection via the 'kento_pvc_geo' parameter in ver

Improper permission control in the mobile application (com.transsion.aivoiceassistant) can lead to the launch of any une

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all

The UltimateAI plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.8.3. This

Opening an external link to an HTTP website when Firefox iOS was previously closed and had an HTTPS tab open could in so

A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enable

File Upload vulnerability in DYCMS Open-Source Version v2.0.9.41 allows a remote attacker to execute arbitrary code via

An issue in Wanxing Technology Yitu Project Management Kirin Edition 2.3.6 allows a remote attacker to execute arbitrary

An issue in Wanxing Technology's Yitu project Management Software 3.2.2 allows a remote attacker to execute arbitrary co

itsourcecode Online Tours and Travels Management System v1.0 is vulnerable to SQL Injection (SQLI) via a crafted payload

Mbed TLS 3.5.x through 3.6.x before 3.6.2 has a buffer underrun in pkwrite when writing an opaque key pair

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t

Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Opera Servlet).

Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's as

Phpgurukul User Registration & Login and User Management System 3.2 is vulnerable to SQL Injection in /admin//search-res

Sensitive information manipulation due to improper authorization. The following products are affected: Acronis Cyber Pro

The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker

An unauthenticated remote attacker can execute OS commands via UDP on the device due to missing authentication.

The devices are vulnerable to session hijacking due to insufficient entropy in its session ID generation algorithm. The

Enterprise Cloud Database from Ragic does not properly validate the file type for uploads. Attackers with regular privil

Enterprise Cloud Database from Ragic does not authenticate access to specific functionality, allowing unauthenticated re

SQL injection vulnerability in TAI Smart Factory's QPLANT SF version 1.0. Exploitation of this vulnerability could allow

The firmware upgrade function in the admin web interface of the Rittal IoT Interface & CMC III Processing Unit devices c

AIM LINE Marketing Platform from Esi Technology does not properly validate a specific query parameter. When the LINE Cam

Property Management System from ChanGate has a SQL Injection vulnerability, allowing unauthenticated remote attackers to

Local file inclusion in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a r

Nagios XI before 2024R1 was discovered to improperly handle API keys generation (randomly-generated), allowing attackers

A stack overflow vulnerability exists in the sub_402280 function of the HNAP service of D-Link DCS-960L 1.09, allowing a

Jepaas v7.2.8 was discovered to contain a SQL injection vulnerability via the orderSQL parameter at /homePortal/loadUser

DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary comm

D-Link DIR-820L 1.05B03 has a stack overflow vulnerability in the sub_451208 function.

Wavelog 1.8.5 allows Oqrs_model.php get_worked_modes station_id SQL injectioin.

Wavelog 1.8.5 allows Activated_gridmap_model.php get_band_confirmed SQL injection via band, sat, propagation, or mode.

Cloudlog 2.6.15 allows Oqrs.php get_station_info station_id SQL injection.

Cloudlog 2.6.15 allows Oqrs.php delete_oqrs_line id SQL injection.

The affected product lacks an authentication check when sending commands to the server via the Moxa service. This vulner

The fix for CVE-2024-26261 was incomplete, and and the specific package for OAKlouds from Hgiga remains at risk. Unauthe

The Team+ from TEAMPLUS TECHNOLOGY does not properly validate specific page parameter, allowing unauthenticated remote a

netease-youdao/qanything version 1.4.1 contains a vulnerability where unsafe data obtained from user input is concatenat

The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.2

An issue in C-CHIP (com.cchip.cchipamaota) v.1.2.8 allows a remote attacker to obtain sensitive information via the firm

An issue in Revic Optics Revic Ops (us.revic.revicops) 1.12.5 allows a remote attacker to obtain sensitive information v

An issue in SWITCHBOT INC SwitchBot (com.theswitchbot.switchbot) 5.0.4 allows a remote attacker to obtain sensitive info

An Incorrect Access Control issue in SAMPMAX com.sampmax.homemax 2.1.2.7 allows a remote attacker to obtain sensitive in

An issue in GIANT MANUFACTURING CO., LTD RideLink (tw.giant.ridelink) 2.0.7 allows a remote attacker to obtain sensitive

An issue in BURG-WCHTER KG de.burgwachter.keyapp.app 4.5.0 allows a remote attacker to obtain sensitve information via t