[CVE_SUBSCRIPTIONS]

Receive alerts for specific vendors, products, or severities
📡 [FLUX RSS CVE]

Subscribe to the CVE feed

7 derniers jours

> FILTERS

> Last 7 Days

STATISTIQUES

Total CVE: 424789
> CVE-2024-39641 [MEDIUM 4.3]
[PUBLISHED: 2024-08-26] [EPSS 0.20%]
Cross-Site Request Forgery (CSRF) vulnerability in ThimPress LearnPress.This issue affects LearnPress: from n/a through 4.2.6.8.2.
AFFECTED_PRODUCTS: Thimpress Learnpress
> CVE-2024-39628 [MEDIUM 5.4]
[PUBLISHED: 2024-08-26] [EPSS 0.20%]
Cross-Site Request Forgery (CSRF) vulnerability in Saturday Drive Ninja Forms allows Cross Site Request Forgery.This issue affects Ninja Forms: from n/a through 3.8.6.
AFFECTED_PRODUCTS: Ninjaforms Ninja Forms
> CVE-2024-8188
[PUBLISHED: 2024-08-26]
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
> CVE-2024-8105 [MEDIUM 6.4]
[PUBLISHED: 2024-08-26] [EPSS 0.27%]
A vulnerability related to the use an insecure Platform Key (PK) has been discovered. An attacker with the compromised PK private key can create malicious UEFI software that is signed with a trusted key that has been compromised.
> CVE-2024-44797 [MEDIUM 6.1]
[PUBLISHED: 2024-08-26] [EPSS 0.33%]
A cross-site scripting (XSS) vulnerability in the component /managers/enable_requests.php of Gazelle commit 63b3370 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the view parameter.
AFFECTED_PRODUCTS: Gazelle Project Gazelle
> CVE-2024-44796 [MEDIUM 6.1]
[PUBLISHED: 2024-08-26] [EPSS 0.40%]
A cross-site scripting (XSS) vulnerability in the component /auth/AzureRedirect.php of PicUploader commit fcf82ea allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the error_description parameter.
AFFECTED_PRODUCTS: Xiebruce Picuploader
> CVE-2024-44795 [MEDIUM 6.1]
[PUBLISHED: 2024-08-26] [EPSS 0.30%]
A cross-site scripting (XSS) vulnerability in the component /login/disabled.php of Gazelle commit 63b3370 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter.
AFFECTED_PRODUCTS: Gazelle Project Gazelle
> CVE-2024-44794 [MEDIUM 6.1]
[PUBLISHED: 2024-08-26] [EPSS 0.30%]
A cross-site scripting (XSS) vulnerability in the component /master/auth/OnedriveRedirect.php of PicUploader commit fcf82ea allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the error_description parameter.
AFFECTED_PRODUCTS: Xiebruce Picuploader
> CVE-2024-44793 [MEDIUM 6.1]
[PUBLISHED: 2024-08-26] [EPSS 0.30%]
A cross-site scripting (XSS) vulnerability in the component /managers/multiple_freeleech.php of Gazelle commit 63b3370 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the torrents parameter.
AFFECTED_PRODUCTS: Gazelle Project Gazelle
> CVE-2024-42906 [MEDIUM 6.1]
[PUBLISHED: 2024-08-26] [EPSS 0.35%]
TestLink before v.1.9.20 is vulnerable to Cross Site Scripting (XSS) via the pop-up on upload file. When uploading a file, the XSS payload can be entered into the file name.
AFFECTED_PRODUCTS: Testlink Testlink
> CVE-2024-28077 [HIGH 7.5]
[PUBLISHED: 2024-08-26] [EPSS 0.43%]
A denial-of-service issue was discovered on certain GL-iNet devices. Some websites can detect devices exposed to the external network through DDNS, and consequently obtain the IP addresses and ports of devices that are exposed. By using special usernames and special characters (such as half parenthe...
AFFECTED_PRODUCTS: Gl-Inet Mt6000 Firmware, Gl-Inet Xe3000 Firmware, Gl-Inet X3000 Firmware ... (+15)
> CVE-2024-43806 [MEDIUM 6.5]
[PUBLISHED: 2024-08-26] [EPSS 0.48%]
Rustix is a set of safe Rust bindings to POSIX-ish APIs. When using `rustix::fs::Dir` using the `linux_raw` backend, it's possible for the iterator to "get stuck" when an IO error is encountered. Combined with a memory over-allocation issue in `rustix::fs::Dir::read_more`, this can cause quick and u...
> CVE-2024-43802 [MEDIUM 4.5]
[PUBLISHED: 2024-08-26] [EPSS 0.30%]
Vim is an improved version of the unix vi text editor. When flushing the typeahead buffer, Vim moves the current position in the typeahead buffer but does not check whether there is enough space left in the buffer to handle the next characters. So this may lead to the tb_off position within the typ...
> CVE-2024-45265 [CRITICAL 9.8]
[PUBLISHED: 2024-08-26] [EPSS 1.05%]
A SQL injection vulnerability in the poll component in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to execute arbitrary SQL commands via the psid parameter.
AFFECTED_PRODUCTS: Skyss Arfa Cms
> CVE-2024-42913 [CRITICAL 9.8]
[PUBLISHED: 2024-08-26] [EPSS 0.38%]
RuoYi CMS v4.7.9 was discovered to contain a SQL injection vulnerability via the job_id parameter at /sasfs1.
AFFECTED_PRODUCTS: Ruoyi Ruoyi
> CVE-2024-8174 [MEDIUM 4.3]
[PUBLISHED: 2024-08-26] [EPSS 0.58%]
A vulnerability has been found in code-projects Blood Bank System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /login.php of the component Login Page. The manipulation of the argument user leads to cross site scripting. The attack can be l...
AFFECTED_PRODUCTS: Blood Bank System Project Blood Bank System
> CVE-2024-7401 [HIGH 7.5]
[PUBLISHED: 2024-08-26] [EPSS 0.77%]
Netskope was notified about a security gap in Netskope Client enrollment process where NSClient is using a static token “Orgkey” as authentication parameter. Since this is a static token, if leaked, cannot be rotated or revoked. A malicious actor can use this token to enroll NSClient from a customer...
AFFECTED_PRODUCTS: Netskope Netskope
> CVE-2024-42792 [LOW 3.5]
[PUBLISHED: 2024-08-26] [EPSS 0.20%]
A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Music Management System v1.0 via /music/ajax.php?action=delete_playlist page.
AFFECTED_PRODUCTS: Lopalopa Music Management System
> CVE-2024-42790 [MEDIUM 5.4]
[PUBLISHED: 2024-08-26] [EPSS 0.49%]
A Reflected Cross Site Scripting (XSS) vulnerability was found in "/music/index.php?page=test" in Kashipara Music Management System v1.0. This vulnerability allows remote attackers to execute arbitrary code via the "page" parameter.
AFFECTED_PRODUCTS: Lopalopa Music Management System
> CVE-2024-41444 [CRITICAL 9.8]
[PUBLISHED: 2024-08-26] [EPSS 0.49%]
SeaCMS v12.9 has a SQL injection vulnerability in the key parameter of /js/player/dmplayer/dmku/index.php?ac=so.
AFFECTED_PRODUCTS: Seacms Seacms
> CVE-2024-8173 [HIGH 7.3]
[PUBLISHED: 2024-08-26] [EPSS 0.67%]
A vulnerability, which was classified as critical, was found in code-projects Blood Bank System 1.0. Affected is an unknown function of the file /login.php of the component Login Page. The manipulation of the argument user leads to sql injection. It is possible to launch the attack remotely. The exp...
AFFECTED_PRODUCTS: Blood Bank System Project Blood Bank System
> CVE-2024-8172 [LOW 3.5]
[PUBLISHED: 2024-08-26] [EPSS 0.45%]
A vulnerability, which was classified as problematic, has been found in SourceCodester QR Code Attendance System 1.0. This issue affects some unknown processing of the file /endpoint/delete-student.php. The manipulation of the argument student/attendance leads to cross site scripting. The attack may...
AFFECTED_PRODUCTS: Rems Qr Code Attendance System
> CVE-2024-8171 [MEDIUM 6.3]
[PUBLISHED: 2024-08-26] [EPSS 0.52%]
A vulnerability classified as critical was found in itsourcecode Tailoring Management System 1.0. This vulnerability affects unknown code of the file staffcatedit.php. The manipulation of the argument title leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed...
AFFECTED_PRODUCTS: Angeljudesuarez Tailoring Management System
> CVE-2024-8170 [LOW 3.5]
[PUBLISHED: 2024-08-26] [EPSS 0.77%]
A vulnerability classified as problematic has been found in SourceCodester Zipped Folder Manager App 1.0. This affects an unknown part of the file /endpoint/add-folder.php. The manipulation of the argument folder leads to unrestricted upload. It is possible to initiate the attack remotely. The explo...
AFFECTED_PRODUCTS: Rems Zipped Folder Manager App
> CVE-2024-44557 [CRITICAL 9.8]
[PUBLISHED: 2024-08-26] [EPSS 0.61%]
Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function setIptvInfo.
AFFECTED_PRODUCTS: Tenda Ax1806 Firmware
> CVE-2024-44555 [CRITICAL 9.8]
[PUBLISHED: 2024-08-26] [EPSS 0.73%]
Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function setIptvInfo.
AFFECTED_PRODUCTS: Tenda Ax1806 Firmware
> CVE-2024-44553 [CRITICAL 9.8]
[PUBLISHED: 2024-08-26] [EPSS 0.63%]
Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function formGetIptv.
AFFECTED_PRODUCTS: Tenda Ax1806 Firmware
> CVE-2024-44552 [CRITICAL 9.8]
[PUBLISHED: 2024-08-26] [EPSS 0.38%]
Tenda AX1806 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function formGetIptv.
AFFECTED_PRODUCTS: Tenda Ax1806 Firmware
> CVE-2024-44551 [CRITICAL 9.8]
[PUBLISHED: 2024-08-26] [EPSS 0.63%]
Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function formGetIptv.
AFFECTED_PRODUCTS: Tenda Ax1806 Firmware
> CVE-2024-44550 [CRITICAL 9.8]
[PUBLISHED: 2024-08-26] [EPSS 0.63%]
Tenda AX1806 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function formGetIptv.
AFFECTED_PRODUCTS: Tenda Ax1806 Firmware
> CVE-2024-44549 [CRITICAL 9.8]
[PUBLISHED: 2024-08-26] [EPSS 0.38%]
Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function formGetIptv.
AFFECTED_PRODUCTS: Tenda Ax1806 Firmware
> CVE-2024-43967 [MEDIUM 5.9]
[PUBLISHED: 2024-08-26] [EPSS 0.28%]
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Stark Digital WP Testimonial Widget allows Stored XSS.This issue affects WP Testimonial Widget: from n/a through 3.1.
AFFECTED_PRODUCTS: Starkdigital Wp Testimonial Widget
> CVE-2024-43319 [MEDIUM 4.3]
[PUBLISHED: 2024-08-26] [EPSS 0.35%]
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in bPlugins LLC Flash & HTML5 Video.This issue affects Flash & HTML5 Video: from n/a through 2.5.31.
> CVE-2024-43289 [HIGH 7.5]
[PUBLISHED: 2024-08-26] [EPSS 0.45%]
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in gVectors Team wpForo Forum.This issue affects wpForo Forum: from n/a through 2.3.4.
AFFECTED_PRODUCTS: Gvectors Wpforo Forum
> CVE-2024-43283 [MEDIUM 5.3]
[PUBLISHED: 2024-08-26] [EPSS 1.10%]
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Contest Gallery.This issue affects Contest Gallery: from n/a through 23.1.2.
AFFECTED_PRODUCTS: Contest-Gallery Contest Gallery
> CVE-2024-42818 [MEDIUM 6.1]
[PUBLISHED: 2024-08-26] [EPSS 0.29%]
A cross-site scripting (XSS) vulnerability in the Config-Create function of fastapi-admin pro v0.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Name parameter.
> CVE-2024-42816 [MEDIUM 6.1]
[PUBLISHED: 2024-08-26] [EPSS 0.29%]
A cross-site scripting (XSS) vulnerability in the Create Product function of fastapi-admin pro v0.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Name parameter.
> CVE-2024-42791 [HIGH 8.8]
[PUBLISHED: 2024-08-26] [EPSS 0.62%]
A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Music Management System v1.0 via /music/ajax.php?action=delete_genre.
AFFECTED_PRODUCTS: Lopalopa Music Management System
> CVE-2024-42788 [MEDIUM 6.1]
[PUBLISHED: 2024-08-26] [EPSS 0.52%]
A Stored Cross Site Scripting (XSS) vulnerability was found in "/music/ajax.php?action=save_music" in Kashipara Music Management System v1.0. This vulnerability allows remote attackers to execute arbitrary code via "title" & "artist" parameter fields.
AFFECTED_PRODUCTS: Lopalopa Music Management System
> CVE-2024-41285 [CRITICAL 9.8]
[PUBLISHED: 2024-08-26] [EPSS 1.06%]
A stack overflow in FAST FW300R v1.3.13 Build 141023 Rel.61347n allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via a crafted file path.
AFFECTED_PRODUCTS: Fastcom Fw300r Firmware
> CVE-2024-34087 [CRITICAL 9.8]
[PUBLISHED: 2024-08-26] [EPSS 1.19%]
An SEH-based buffer overflow in the BPQ32 HTTP Server in BPQ32 6.0.24.1 allows remote attackers with access to the Web Terminal to achieve remote code execution via an HTTP POST /TermInput request.
> CVE-2024-8169 [HIGH 7.3]
[PUBLISHED: 2024-08-26] [EPSS 0.65%]
A vulnerability was found in code-projects Online Quiz Site 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file signupuser.php. The manipulation of the argument lid leads to sql injection. The attack may be launched remotely. The exploit has been disc...
AFFECTED_PRODUCTS: Fabianros Online Quiz Site
> CVE-2024-8168 [HIGH 7.3]
[PUBLISHED: 2024-08-26] [EPSS 0.65%]
A vulnerability was found in code-projects Online Bus Reservation Site 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file login.php. The manipulation of the argument Username leads to sql injection. The attack can be launched remotely. The e...
AFFECTED_PRODUCTS: Fabianros Online Bus Reservation Site
> CVE-2024-8167 [HIGH 7.3]
[PUBLISHED: 2024-08-26] [EPSS 0.65%]
A vulnerability was found in code-projects Job Portal 1.0. It has been classified as critical. Affected is an unknown function of the file /forget.php. The manipulation of the argument email/mobile leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed t...
AFFECTED_PRODUCTS: Fabianros Job Portal
> CVE-2024-8166 [MEDIUM 4.7]
[PUBLISHED: 2024-08-26] [EPSS 0.68%]
A vulnerability has been found in Ruijie EG2000K 11.1(6)B2 and classified as critical. This vulnerability affects unknown code of the file /tool/index.php?c=download&a=save. The manipulation of the argument content leads to unrestricted upload. The attack can be initiated remotely. The exploit has b...
AFFECTED_PRODUCTS: Ruijie Eg2000k Firmware
> CVE-2024-7988 [CRITICAL 9.8]
[PUBLISHED: 2024-08-26] [EPSS 4.78%]
A remote code execution vulnerability exists in the Rockwell Automation ThinManager® ThinServer™ that allows a threat actor to execute arbitrary code with System privileges. This vulnerability exists due to the lack of proper data input validation, which allows files to be overwritten.
> CVE-2024-7987
[PUBLISHED: 2024-08-26] [EPSS 0.32%]
A remote code execution vulnerability exists in the Rockwell Automation ThinManager® ThinServer™ that allows a threat actor to execute arbitrary code with System privileges. To exploit this vulnerability and a threat actor must abuse the ThinServer™ service by creating a junction and use it to uploa...
> CVE-2024-43966 [HIGH 7.6]
[PUBLISHED: 2024-08-26] [EPSS 0.44%]
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stark Digital WP Testimonial Widget.This issue affects WP Testimonial Widget: from n/a through 3.1.
AFFECTED_PRODUCTS: Starkdigital Wp Testimonial Widget
> CVE-2024-42789 [MEDIUM 6.3]
[PUBLISHED: 2024-08-26] [EPSS 0.64%]
A Reflected Cross Site Scripting (XSS) vulnerability was found in "/music/controller.php?page=test" in Kashipara Music Management System v1.0. This vulnerability allows remote attackers to execute arbitrary code via the "page" parameter.
AFFECTED_PRODUCTS: Lopalopa Music Management System
> CVE-2024-42787 [MEDIUM 6.1]
[PUBLISHED: 2024-08-26] [EPSS 0.52%]
A Stored Cross Site Scripting (XSS) vulnerability was found in "/music/ajax.php?action=save_playlist" in Kashipara Music Management System v1.0. This vulnerability allows remote attackers to execute arbitrary code via "title" & "description" parameter fields.
AFFECTED_PRODUCTS: Lopalopa Music Management System