2024

Relative Path Traversal vulnerability in ZkTeco-based OEM devices allows an attacker to write any file on the system w

Relative Path Traversal vulnerability in ZkTeco-based OEM devices allows an attacker to access any file on the system.

The mobile application (com.transsion.videocallenhancer) interface has improper permission control, which can lead to th

The WP Table Builder – WordPress Table Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the

The Move Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the

When storing unbounded types in a BTreeMap, a node is represented as a linked list of "memory chunks". It was discovered

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in ZkTeco-base

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ZkTeco-based OEM

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to unauthorized modification of data|loss

The ShopLentor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check

The ShopLentor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's woolentorsearch shortc

The UberMenu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ubermenu-col, ubermenu_m

The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the pl

The Salon booking system plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and includ

The Carousel Slider WordPress plugin before 2.2.11 does not sanitise and escape some parameters, which could allow users

The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could all

The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape various parameters before outputting

The Survey Maker WordPress plugin before 4.2.9 does not sanitise and escape some of its settings, which could allow hig

The Social Icons Widget & Block by WPZOOM WordPress plugin before 4.2.18 does not sanitise and escape some of its Widget

The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘has_field_link_rel’ parameter in a

The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPre

The buffer overflow vulnerability in the DX3300-T1 firmware version V5.50(ABVY.4)C0 could allow an authenticated local a

The buffer overflow vulnerability in the CGI program of the VMG3625-T50B firmware version V5.50(ABPM.8)C0 could allow an

A vulnerability was found in SourceCodester Vehicle Management System up to 1.0 and classified as critical. This issue a

An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when utilizing SAML single sig

Wiki.js is al wiki app built on Node.js. Client side template injection was discovered, that could allow an attacker to

Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is

Minder is a software supply chain security platform. Prior to version 0.0.50, Minder engine is susceptible to a denial o

Trivy is a security scanner. Prior to 0.51.2, if a malicious actor is able to trigger Trivy to scan container images fro

Formie is a Craft CMS plugin for creating forms. Prior to 2.1.6, users with access to a form's settings can include mali

Issue in KeePassXC 2.7.7 allows an attacker (who has the privileges of the victim) to recover some passwords stored in t

KeePassXC 2.7.7 allows an attacker (who has the privileges of the victim) to recover cleartext credentials via a memory

The SolarWinds Platform was determined to be affected by a reflected cross-site scripting vulnerability affecting the we

Tenda AX1806 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function formSetIptv.

Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function formSetIptv.

Tenda AX1806 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function formSetIptv.

Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function formSetIptv.

Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function formSetIptv.

SQL injection vulnerability in Likeshop before 2.5.7 allows attackers to run abitrary SQL commands via the function Orde

smanga 3.2.7 does not filter the file parameter at the PHP/get file flow.php interface, resulting in a path traversal vu

Buffer Overflow vulnerability in Waxlab wax v.0.9-3 and before allows an attacker to cause a denial of service via the L

A Prototype Pollution issue in API Dev Tools json-schema-ref-parser v.11.0.0 and v.11.1.0 allows a remote attacker to ex

A Prototype Pollution issue in MiguelCastillo @bit/loader v.10.0.3 allows an attacker to execute arbitrary code via the

Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection while getting file server details.

Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while exporting a full summary report.

Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection in the dashboard graph feature.

Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection while adding file shares.

Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection in the aggregate reports search option.

An issue in Quanxun Huiju Network Technology(Beijing) Co.,Ltd IK-Q3000 3.7.10 x64 Build202401261655 allows attackers to