[CVE_SUBSCRIPTIONS]

Receive alerts for specific vendors, products, or severities
📡 [FLUX RSS CVE]

Subscribe to the CVE feed

7 derniers jours

> FILTERS

> Last 7 Days

STATISTIQUES

Total CVE: 424268
> CVE-2024-54996 [HIGH 8.8]
[PUBLISHED: 2025-01-10] [EPSS 0.82%]
MonicaHQ v4.1.2 was discovered to contain multiple authenticated Client-Side Injection vulnerabilities via the title and description parameters at /people/ID/reminders/create.
AFFECTED_PRODUCTS: Monicahq Monica
> CVE-2024-54994 [MEDIUM 6.5]
[PUBLISHED: 2025-01-10] [EPSS 0.32%]
MonicaHQ v4.1.2 was discovered to contain multiple Client-Side Injection vulnerabilities via the first_name and last_name parameters in the Add a new relationship feature.
AFFECTED_PRODUCTS: Monicahq Monica
> CVE-2024-6437 [MEDIUM 5.8]
[PUBLISHED: 2025-01-10] [EPSS 0.53%]
On affected platforms running Arista EOS with one of the following features configured to redirect IP traffic to a next hop: policy-based routing (PBR), BGP Flowspec, or interface traffic policy -- certain IP traffic such as IPv4 packets with IP options may bypass the feature's set nexthop action an...
> CVE-2024-33299 [MEDIUM 4.7]
[PUBLISHED: 2025-01-10] [EPSS 1.16%]
Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the First Name and Last Name parameters in the endpoint /admin/module/view?type=users
AFFECTED_PRODUCTS: Microweber Microweber
> CVE-2024-33298 [MEDIUM 6.1]
[PUBLISHED: 2025-01-10] [EPSS 0.88%]
Microweber Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the create new backup function in the endpoint /admin/module/view?type=admin__backup
AFFECTED_PRODUCTS: Microweber Microweber
> CVE-2024-33297 [MEDIUM 4.7]
[PUBLISHED: 2025-01-10] [EPSS 1.16%]
Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the campaign Name (Internal Name) field in the Add new campaign function
AFFECTED_PRODUCTS: Microweber Microweber
> CVE-2024-12847 [CRITICAL 9.8]
[PUBLISHED: 2025-01-10] [⚡ EPSS 30.4%]
NETGEAR DGN1000 before 1.1.00.48 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated attacker can execute arbitrary operating system commands as root by sending crafted HTTP requests to the setup.cgi endpoint. This vulnerability has been exploited in the wild since...
> CVE-2025-23079 [MEDIUM 6.1]
[PUBLISHED: 2025-01-10] [EPSS 0.24%]
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - ArticleFeedbackv5 extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - ArticleFeedbackv5 extension: from 1.42.X before 1.42.2.
> CVE-2024-54910 [MEDIUM 4.7]
[PUBLISHED: 2025-01-10] [EPSS 0.42%]
Hasleo Backup Suite Free v4.9.4 and before is vulnerable to Insecure Permissions via the File recovery function.
> CVE-2025-23078 [MEDIUM 6.5]
[PUBLISHED: 2025-01-10] [EPSS 0.26%]
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Breadcrumbs2 extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Breadcrumbs2 extension: from 1.39.X before 1.39.11, from 1.41.X before...
> CVE-2024-6880
[PUBLISHED: 2025-01-10] [EPSS 0.52%]
During MegaBIP installation process, a user is encouraged to change a default path to administrative portal, as keeping it secret is listed by the author as one of the protection mechanisms.  Publicly available source code of "/registered.php" discloses that path, allowing an attacker to attempt fur...
> CVE-2024-6662
[PUBLISHED: 2025-01-10] [EPSS 0.30%]
Websites managed by MegaBIP in versions below 5.15 are vulnerable to Cross-Site Request Forgery (CSRF) as the form available under "/edytor/index.php?id=7,7,0" lacks protection mechanisms. A user could be tricked into visiting a malicious website, which would send POST request to this endpoint. If t...
> CVE-2024-57228 [HIGH 8.0]
[PUBLISHED: 2025-01-10] [EPSS 1.23%]
Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the iface parameter in the vif_disable function.
AFFECTED_PRODUCTS: Linksys E7350 Firmware
> CVE-2024-57227 [HIGH 8.0]
[PUBLISHED: 2025-01-10] [EPSS 1.23%]
Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pbc_wps function.
AFFECTED_PRODUCTS: Linksys E7350 Firmware
> CVE-2024-57226 [HIGH 8.0]
[PUBLISHED: 2025-01-10] [EPSS 1.23%]
Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the iface parameter in the vif_enable function.
AFFECTED_PRODUCTS: Linksys E7350 Firmware
> CVE-2024-57225 [CRITICAL 9.8]
[PUBLISHED: 2025-01-10] [EPSS 1.73%]
Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the devname parameter in the reset_wifi function.
AFFECTED_PRODUCTS: Linksys E7350 Firmware
> CVE-2024-57224 [CRITICAL 9.8]
[PUBLISHED: 2025-01-10] [EPSS 1.73%]
Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pin_wps function.
AFFECTED_PRODUCTS: Linksys E7350 Firmware
> CVE-2024-57223 [CRITICAL 9.8]
[PUBLISHED: 2025-01-10] [EPSS 1.73%]
Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_wps_gen_pincode function.
AFFECTED_PRODUCTS: Linksys E7350 Firmware
> CVE-2024-57222 [MEDIUM 6.3]
[PUBLISHED: 2025-01-10] [EPSS 0.84%]
Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_cancel_wps function.
AFFECTED_PRODUCTS: Linksys E7350 Firmware
> CVE-2024-54687 [MEDIUM 6.1]
[PUBLISHED: 2025-01-10] [EPSS 0.37%]
Vtiger CRM v.6.1 and before is vulnerable to Cross Site Scripting (XSS) via the Documents module and function uploadAndSaveFile in CRMEntity.php.
AFFECTED_PRODUCTS: Vtiger Vtiger Crm
> CVE-2024-57214 [MEDIUM 6.3]
[PUBLISHED: 2025-01-10] [EPSS 0.72%]
TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the devname parameter in the reset_wifi function.
AFFECTED_PRODUCTS: Totolink A6000r Firmware
> CVE-2024-57213 [MEDIUM 6.3]
[PUBLISHED: 2025-01-10] [EPSS 0.72%]
TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the newpasswd parameter in the action_passwd function.
AFFECTED_PRODUCTS: Totolink A6000r Firmware
> CVE-2024-57212 [MEDIUM 5.1]
[PUBLISHED: 2025-01-10] [EPSS 0.76%]
TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the opmode parameter in the action_reboot function.
AFFECTED_PRODUCTS: Totolink A6000r Firmware
> CVE-2024-57211 [HIGH 8.0]
[PUBLISHED: 2025-01-10] [EPSS 1.28%]
TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the modifyOne parameter in the enable_wsh function.
AFFECTED_PRODUCTS: Totolink A6000r Firmware
> CVE-2024-54849 [MEDIUM 5.9]
[PUBLISHED: 2025-01-10] [EPSS 0.38%]
An issue in CP Plus CP-VNR-3104 B3223P22C02424 allows attackers to obtain the second RSA private key and access sensitive data or execute a man-in-the-middle attack.
AFFECTED_PRODUCTS: Cpplusworld Cp Vnr 3104 Firmware
> CVE-2024-54848 [HIGH 7.4]
[PUBLISHED: 2025-01-10] [EPSS 0.31%]
Improper handling and storage of certificates in CP Plus CP-VNR-3104 B3223P22C02424 allow attackers to decrypt communications or execute a man-in-the-middle attacks.
AFFECTED_PRODUCTS: Cpplusworld Cp Vnr 3104 Firmware
> CVE-2024-54847 [MEDIUM 5.9]
[PUBLISHED: 2025-01-10] [EPSS 0.47%]
An issue in CP Plus CP-VNR-3104 B3223P22C02424 allows attackers to access the Diffie-Hellman (DH) parameters and access sensitive data or execute a man-in-the-middle attack.
AFFECTED_PRODUCTS: Cpplusworld Cp Vnr 3104 Firmware
> CVE-2024-54846 [MEDIUM 5.9]
[PUBLISHED: 2025-01-10] [EPSS 0.47%]
An issue in CP Plus CP-VNR-3104 B3223P22C02424 allows attackers to obtain the EC private key and access sensitive data or execute a man-in-the-middle attack.
AFFECTED_PRODUCTS: Cpplusworld Cp Vnr 3104 Firmware
> CVE-2025-22949 [CRITICAL 9.8]
[PUBLISHED: 2025-01-10] [EPSS 1.98%]
Tenda ac9 v1.0 firmware v15.03.05.19 is vulnerable to command injection in /goform/SetSambaCfg, which may lead to remote arbitrary code execution.
AFFECTED_PRODUCTS: Tenda Ac9 Firmware
> CVE-2025-22600 [MEDIUM 6.5]
[PUBLISHED: 2025-01-10] [EPSS 0.43%]
WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the configuracao_doacao.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the avulso parameter. This vulnerability is fix...
AFFECTED_PRODUCTS: Wegia Wegia
> CVE-2025-22599 [MEDIUM 6.5]
[PUBLISHED: 2025-01-10] [EPSS 0.43%]
WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the home.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the msg_c parameter. This vulnerability is fixed in 3.2.8.
AFFECTED_PRODUCTS: Wegia Wegia
> CVE-2025-22598 [HIGH 8.3]
[PUBLISHED: 2025-01-10] [EPSS 0.36%]
WeGIA is a web manager for charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the cadastrarSocio.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the local_recepcao parameter. The injected scripts ar...
AFFECTED_PRODUCTS: Wegia Wegia
> CVE-2025-22597 [HIGH 8.3]
[PUBLISHED: 2025-01-10] [EPSS 0.36%]
WeGIA is a web manager for charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the CobrancaController.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the local_recepcao parameter. The injected script...
AFFECTED_PRODUCTS: Wegia Wegia
> CVE-2025-22596 [MEDIUM 6.5]
[PUBLISHED: 2025-01-10] [EPSS 0.31%]
WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the modulos_visiveis.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the msg_c parameter. This vulnerability is fixed i...
AFFECTED_PRODUCTS: Wegia Wegia
> CVE-2025-22152 [CRITICAL 9.1]
[PUBLISHED: 2025-01-10] [EPSS 0.65%]
Atheos is a self-hosted browser-based cloud IDE. Prior to v600, the $path and $target parameters are not properly validated across multiple components, allowing an attacker to read, modify, or execute arbitrary files on the server. These vulnerabilities can be exploited through various attack vector...
> CVE-2024-56511 [CRITICAL 9.8]
[PUBLISHED: 2025-01-10] [⚡ EPSS 50.3%]
DataEase is an open source data visualization analysis tool. Prior to 2.10.4, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter class, which can be bypassed and cause the risk of unauthorized access. In the io.dataease.auth.filter.TokenFilter class, ”request.getRequest...
AFFECTED_PRODUCTS: Dataease Dataease
> CVE-2024-50807 [MEDIUM 6.1]
[PUBLISHED: 2025-01-10] [EPSS 0.30%]
Trippo Responsive Filemanager 9.14.0 is vulnerable to Cross Site Scripting (XSS) via file upload using the svg and pdf extensions.
> CVE-2024-46210 [HIGH 7.2]
[PUBLISHED: 2025-01-10] [EPSS 0.59%]
An arbitrary file upload vulnerability in the MediaPool module of Redaxo CMS v5.17.1 allows attackers to execute arbitrary code via uploading a crafted file.
AFFECTED_PRODUCTS: Redaxo Redaxo
> CVE-2024-29971 [CRITICAL 9.8]
[PUBLISHED: 2025-01-10] [EPSS 0.47%]
Scontain SCONE 5.8.0 has an interface vulnerability that leads to state corruption via injected signals.
> CVE-2024-29970 [CRITICAL 9.8]
[PUBLISHED: 2025-01-10] [EPSS 0.47%]
Fortanix Enclave OS 3.36.1941-EM has an interface vulnerability that leads to state corruption via injected signals.
> CVE-2024-25371 [HIGH 7.5]
[PUBLISHED: 2025-01-10] [EPSS 0.59%]
Gramine before a390e33e16ed374a40de2344562a937f289be2e1 suffers from an Interface vulnerability due to mismatching SW signals vs HW exceptions.
> CVE-2025-23022 [MEDIUM 4.0]
[PUBLISHED: 2025-01-10] [EPSS 0.24%]
FreeType 2.8.1 has a signed integer overflow in cf2_doFlex in cff/cf2intrp.c.
AFFECTED_PRODUCTS: Freetype FreeType
> CVE-2025-22946 [CRITICAL 9.8]
[PUBLISHED: 2025-01-10] [EPSS 0.92%]
Tenda ac9 v1.0 firmware v15.03.05.19 contains a stack overflow vulnerability in /goform/SetOnlineDevName, which may lead to remote arbitrary code execution.
AFFECTED_PRODUCTS: Tenda Ac9 Firmware
> CVE-2024-57687 [CRITICAL 9.8]
[PUBLISHED: 2025-01-10] [EPSS 2.64%]
An OS Command Injection vulnerability was found in /landrecordsys/admin/dashboard.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the "Cookie" GET request parameter.
AFFECTED_PRODUCTS: Phpgurukul Land Record System
> CVE-2024-57686 [CRITICAL 9.8]
[PUBLISHED: 2025-01-10] [EPSS 1.69%]
A Cross Site Scripting (XSS) vulnerability was found in /landrecordsys/admin/contactus.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the "pagetitle" parameter.
AFFECTED_PRODUCTS: Phpgurukul Land Record System
> CVE-2024-41787 [CRITICAL 9.8]
[PUBLISHED: 2025-01-10] [EPSS 1.11%]
IBM Engineering Requirements Management DOORS Next 7.0.2 and 7.0.3 could allow a remote attacker to bypass security restrictions, caused by a race condition. By sending a specially crafted request, an attacker could exploit this vulnerability to remotely execute code.
AFFECTED_PRODUCTS: IBM Doors Next, IBM Doors Next
> CVE-2024-57823 [CRITICAL 9.3]
[PUBLISHED: 2025-01-10] [EPSS 0.35%]
In Raptor RDF Syntax Library through 2.0.16, there is an integer underflow when normalizing a URI with the turtle parser in raptor_uri_normalize_path().
AFFECTED_PRODUCTS: Red Hat Red Hat Enterprise Linux 8, Red Hat Red Hat Enterprise Linux 9, Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support ... (+11)
> CVE-2024-57822 [MEDIUM 4.0]
[PUBLISHED: 2025-01-10] [EPSS 0.29%]
In Raptor RDF Syntax Library through 2.0.16, there is a heap-based buffer over-read when parsing triples with the nquads parser in raptor_ntriples_parse_term_internal().
AFFECTED_PRODUCTS: Librdf Raptor Rdf Syntax Library
> CVE-2025-23016 [CRITICAL 9.3]
[PUBLISHED: 2025-01-10] [EPSS 0.61%]
FastCGI fcgi2 (aka fcgi) 2.x through 2.4.4 has an integer overflow (and resultant heap-based buffer overflow) via crafted nameLen or valueLen values in data to the IPC socket. This occurs in ReadParams in fcgiapp.c.
> CVE-2024-13318 [MEDIUM 5.3]
[PUBLISHED: 2025-01-10] [EPSS 0.35%]
The Essential WP Real Estate plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the cl_delete_listing_func() function in all versions up to, and including, 1.1.3. This makes it possible for unauthenticated attackers to delete arbitrary pages and posts.
AFFECTED_PRODUCTS: Smartdatasoft Essential Wp Real Estate