[CVE_SUBSCRIPTIONS]

Receive alerts for specific vendors, products, or severities
📡 [FLUX RSS CVE]

Subscribe to the CVE feed

7 derniers jours

> FILTERS

> Last 7 Days

STATISTIQUES

Total CVE: 425032
> CVE-2024-5297 [HIGH 8.8]
[PUBLISHED: 2024-05-23] [EPSS 1.93%]
D-Link D-View executeWmicCmd Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of D-Link D-View. Although authentication is required to exploit this vulnerability, the existing authentication mechanis...
AFFECTED_PRODUCTS: Dlink D View 8
> CVE-2024-5296 [CRITICAL 9.8]
[PUBLISHED: 2024-05-23] [EPSS 1.12%]
D-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of D-Link D-View. Authentication is not required to exploit this vulnerability. The specific flaw exists within the To...
AFFECTED_PRODUCTS: Dlink D View 8
> CVE-2024-5295 [HIGH 8.8]
[PUBLISHED: 2024-05-23] [EPSS 1.97%]
D-Link G416 flupl self Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 wireless routers. Authentication is not required to exploit this vulnerability. The specific flaw exi...
AFFECTED_PRODUCTS: Dlink G416 Firmware
> CVE-2024-5294 [MEDIUM 6.5]
[PUBLISHED: 2024-05-23] [EPSS 0.46%]
D-Link DIR-3040 prog.cgi websSecurityHandler Memory Leak Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of D-Link DIR-3040 routers. Authentication is not required to exploit this vulnerability....
AFFECTED_PRODUCTS: Dlink Dir 3040 Firmware
> CVE-2024-5293 [HIGH 8.8]
[PUBLISHED: 2024-05-23] [EPSS 1.61%]
D-Link DIR-2640 HTTP Referer Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2640-US routers. Authentication is not required to exploit this vulnerability. The spe...
AFFECTED_PRODUCTS: Dlink Dir 2640 Firmware
> CVE-2024-5292 [HIGH 7.8]
[PUBLISHED: 2024-05-23] [EPSS 0.54%]
D-Link Network Assistant Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of D-Link Network Assistant. An attacker must first obtain the ability to execute low-privileged code on the...
AFFECTED_PRODUCTS: Dlink Network Assistant
> CVE-2024-5291 [HIGH 8.8]
[PUBLISHED: 2024-05-23] [EPSS 1.97%]
D-Link DIR-2150 GetDeviceSettings Target Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2150 routers. Authentication is not required to exploit this vulnerability. The spec...
AFFECTED_PRODUCTS: Dlink Dir 2150 Firmware
> CVE-2024-5247 [HIGH 8.8]
[PUBLISHED: 2024-05-23] [âš¡ EPSS 26.9%]
NETGEAR ProSAFE Network Management System UpLoadServlet Unrestricted File Upload Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Authentication is required to exploit thi...
AFFECTED_PRODUCTS: Netgear Prosafe Network Management System
> CVE-2024-5246 [HIGH 8.8]
[PUBLISHED: 2024-05-23] [âš¡ EPSS 31.3%]
NETGEAR ProSAFE Network Management System Tomcat Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Authentication is required to exploit this vulnerability. The specific f...
AFFECTED_PRODUCTS: Netgear Prosafe Network Management Software 300
> CVE-2024-5245 [HIGH 7.8]
[PUBLISHED: 2024-05-23] [EPSS 0.57%]
NETGEAR ProSAFE Network Management System Default Credentials Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NETGEAR ProSAFE Network Management System. An attacker must first obtain the ability to execute low-pr...
AFFECTED_PRODUCTS: Netgear Prosafe Network Management System
> CVE-2024-5244 [MEDIUM 4.2]
[PUBLISHED: 2024-05-23] [EPSS 0.38%]
TP-Link Omada ER605 Reliance on Security Through Obscurity Vulnerability. This vulnerability allows network-adjacent attackers to access or spoof DDNS messages on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit this vulnerability. However, devices are...
AFFECTED_PRODUCTS: Tp-Link Omada Er605 Firmware
> CVE-2024-5243 [HIGH 7.5]
[PUBLISHED: 2024-05-23] [EPSS 0.83%]
TP-Link Omada ER605 Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit this vulnerability. However, devices are vulnera...
AFFECTED_PRODUCTS: Tp-Link Omada Er605 Firmware
> CVE-2024-5242 [HIGH 7.5]
[PUBLISHED: 2024-05-23] [EPSS 0.80%]
TP-Link Omada ER605 Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit this vulnerability. However, devices...
AFFECTED_PRODUCTS: Tp-Link Omada Er605 Firmware
> CVE-2024-5228 [HIGH 7.5]
[PUBLISHED: 2024-05-23] [EPSS 0.51%]
TP-Link Omada ER605 Comexe DDNS Response Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit this v...
AFFECTED_PRODUCTS: Tp-Link Omada Er605 Firmware
> CVE-2024-5227 [HIGH 7.5]
[PUBLISHED: 2024-05-23] [EPSS 0.71%]
TP-Link Omada ER605 PPTP VPN username Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit this vulnerability. However,...
AFFECTED_PRODUCTS: Tp-Link Omada Er605 Firmware
> CVE-2024-5202 [HIGH 7.7]
[PUBLISHED: 2024-05-23] [EPSS 0.36%]
Arbitrary File Read in OpenText Dimensions RM allows authenticated users to read files stored on the server via webservices
> CVE-2024-5201 [HIGH 8.8]
[PUBLISHED: 2024-05-23] [EPSS 0.37%]
Privilege Escalation in OpenText Dimensions RM allows an authenticated user to escalate there privilege to the privilege of another user via HTTP Request
> CVE-2024-35570 [CRITICAL 9.8]
[PUBLISHED: 2024-05-23] [EPSS 0.89%]
An arbitrary file upload vulnerability in the component \controller\ImageUploadController.class of inxedu v2.0.6 allows attackers to execute arbitrary code via uploading a crafted jsp file.
AFFECTED_PRODUCTS: Inxedu Inxedu
> CVE-2024-35375 [CRITICAL 9.8]
[PUBLISHED: 2024-05-23] [EPSS 0.47%]
There is an arbitrary file upload vulnerability on the media add .php page in the backend of the website in version 5.7.114 of DedeCMS
AFFECTED_PRODUCTS: Dedecms Dedecms
> CVE-2024-35080 [CRITICAL 9.8]
[PUBLISHED: 2024-05-23] [EPSS 0.58%]
An arbitrary file upload vulnerability in the gok4 method of inxedu v2024.4 allows attackers to execute arbitrary code via uploading a crafted .jsp file.
AFFECTED_PRODUCTS: Inxedu Inxedu
> CVE-2024-35079 [CRITICAL 9.8]
[PUBLISHED: 2024-05-23] [EPSS 0.58%]
An arbitrary file upload vulnerability in the uploadAudio method of inxedu v2024.4 allows attackers to execute arbitrary code via uploading a crafted .jsp file.
AFFECTED_PRODUCTS: Inxedu Inxedu
> CVE-2024-31843 [MEDIUM 4.1]
[PUBLISHED: 2024-05-23] [EPSS 0.54%]
An issue was discovered in Italtel Embrace 1.6.4. The Web application does not properly check the parameters sent as input before they are processed on the server side. This allows authenticated users to execute commands on the Operating System.
AFFECTED_PRODUCTS: Italtel Embrace
> CVE-2024-5143 [MEDIUM 6.8]
[PUBLISHED: 2024-05-23] [EPSS 0.40%]
A user with device administrative privileges can change existing SMTP server settings on the device, without having to re-enter SMTP server credentials. By redirecting send-to-email traffic to the new server, the original SMTP server credentials may potentially be exposed.
> CVE-2024-4365 [MEDIUM 6.4]
[PUBLISHED: 2024-05-23] [EPSS 0.34%]
The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘add_iframe_url_as_param_direct’ parameter in versions up to, and including, 2024.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contr...
> CVE-2024-35091 [CRITICAL 9.8]
[PUBLISHED: 2024-05-23] [EPSS 0.42%]
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysTenantMapper.xml.
AFFECTED_PRODUCTS: J2Eefast J2eefast
> CVE-2024-35090 [HIGH 8.2]
[PUBLISHED: 2024-05-23] [EPSS 0.32%]
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysUreportFileMapper.xml.
AFFECTED_PRODUCTS: J2Eefast J2eefast
> CVE-2024-35086 [CRITICAL 9.8]
[PUBLISHED: 2024-05-23] [EPSS 0.53%]
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in BpmTaskFromMapper.xml .
AFFECTED_PRODUCTS: J2Eefast J2eefast
> CVE-2024-35085 [MEDIUM 5.4]
[PUBLISHED: 2024-05-23] [EPSS 0.25%]
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in ProcessDefinitionMapper.xml.
AFFECTED_PRODUCTS: J2Eefast J2eefast
> CVE-2024-35084 [CRITICAL 9.8]
[PUBLISHED: 2024-05-23] [EPSS 0.42%]
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysMsgPushMapper.xml.
AFFECTED_PRODUCTS: J2Eefast J2eefast
> CVE-2024-35083 [HIGH 8.8]
[PUBLISHED: 2024-05-23] [EPSS 0.40%]
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysLoginInfoMapper.xml.
AFFECTED_PRODUCTS: J2Eefast J2eefast
> CVE-2024-35082 [MEDIUM 6.3]
[PUBLISHED: 2024-05-23] [EPSS 0.25%]
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysOperLogMapper.xml.
AFFECTED_PRODUCTS: J2Eefast J2eefast
> CVE-2024-35081 [HIGH 7.5]
[PUBLISHED: 2024-05-23] [EPSS 0.46%]
LuckyFrameWeb v3.5.2 was discovered to contain an arbitrary file deletion vulnerability via the fileName parameter in the fileDownload method.
AFFECTED_PRODUCTS: Luckyframe Luckyframeweb
> CVE-2024-34936 [HIGH 8.6]
[PUBLISHED: 2024-05-23] [EPSS 0.38%]
A SQL injection vulnerability in /view/event1.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the month parameter.
AFFECTED_PRODUCTS: Campcodes Complete Web Based School Management System
> CVE-2024-34935 [CRITICAL 9.8]
[PUBLISHED: 2024-05-23] [EPSS 0.51%]
A SQL injection vulnerability in /view/conversation_history_admin.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the conversation_id parameter.
AFFECTED_PRODUCTS: Campcodes Complete Web Based School Management System
> CVE-2024-34934 [CRITICAL 9.8]
[PUBLISHED: 2024-05-23] [EPSS 0.51%]
A SQL injection vulnerability in /view/emarks_range_grade_update_form.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the conversation_id parameter.
AFFECTED_PRODUCTS: Campcodes Complete Web Based School Management System
> CVE-2024-34933 [MEDIUM 6.3]
[PUBLISHED: 2024-05-23] [EPSS 0.30%]
A SQL injection vulnerability in /model/update_grade.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the admission_fee parameter.
AFFECTED_PRODUCTS: Campcodes Complete Web Based School Management System
> CVE-2024-34932 [CRITICAL 9.8]
[PUBLISHED: 2024-05-23] [EPSS 0.51%]
A SQL injection vulnerability in /model/update_exam.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the name parameter.
AFFECTED_PRODUCTS: Campcodes Complete Web Based School Management System
> CVE-2024-34931 [CRITICAL 9.8]
[PUBLISHED: 2024-05-23] [EPSS 0.51%]
A SQL injection vulnerability in /model/update_subject.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the name parameter.
AFFECTED_PRODUCTS: Campcodes Complete Web Based School Management System
> CVE-2024-34930 [MEDIUM 5.3]
[PUBLISHED: 2024-05-23] [EPSS 0.22%]
A SQL injection vulnerability in /model/all_events1.php in Campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the month parameter.
AFFECTED_PRODUCTS: Campcodes Complete Web Based School Management System
> CVE-2024-34929 [CRITICAL 9.8]
[PUBLISHED: 2024-05-23] [EPSS 0.51%]
A SQL injection vulnerability in /view/find_friends.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the my_index parameter.
AFFECTED_PRODUCTS: Campcodes Complete Web Based School Management System
> CVE-2024-34928 [HIGH 7.3]
[PUBLISHED: 2024-05-23] [EPSS 0.32%]
A SQL injection vulnerability in /model/update_subject_routing.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the grade parameter.
AFFECTED_PRODUCTS: Campcodes Complete Web Based School Management System
> CVE-2024-34927 [CRITICAL 9.8]
[PUBLISHED: 2024-05-23] [EPSS 0.51%]
A SQL injection vulnerability in /model/update_classroom.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the name parameter.
AFFECTED_PRODUCTS: Campcodes Complete Web Based School Management System
> CVE-2024-2301 [HIGH 7.6]
[PUBLISHED: 2024-05-23] [EPSS 0.30%]
Certain HP LaserJet Pro devices are potentially vulnerable to a Cross-Site Scripting (XSS) attack via the web management interface of the device.
> CVE-2023-4859
[PUBLISHED: 2024-05-23]
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-27957. Reason: This candidate is a duplicate of CVE-2024-27957. Notes: All CVE users should reference CVE-2024-27957 instead of this candidate. All references and descriptions in this candidate have been removed to...
> CVE-2024-5085 [HIGH 8.1]
[PUBLISHED: 2024-05-23] [EPSS 0.78%]
The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.0 via deserialization of untrusted input in the 'process_entry' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No know...
AFFECTED_PRODUCTS: Hashthemes Hash Form
> CVE-2024-5084 [CRITICAL 9.8]
[PUBLISHED: 2024-05-23] [⚡ EPSS 50.7%] [🎯 NUCLEI]
The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'file_upload_action' function in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to upload arbitrary files o...
AFFECTED_PRODUCTS: Hashthemes Hash Form
> CVE-2024-35222 [MEDIUM 5.9]
[PUBLISHED: 2024-05-23] [EPSS 0.35%]
Tauri is a framework for building binaries for all major desktop platforms. Remote origin iFrames in Tauri applications can access the Tauri IPC endpoints without being explicitly allowed in the `dangerousRemoteDomainIpcAccess` in v1 and in the `capabilities` in v2. Valid commands with potentially u...
> CVE-2024-5168 [CRITICAL 9.8]
[PUBLISHED: 2024-05-23] [EPSS 0.53%]
Improper access control vulnerability in Prodys' Quantum Audio codec affecting versions 2.3.4t and below. This vulnerability could allow an unauthenticated user to bypass authentication entirely and execute arbitrary API requests against the web application.
> CVE-2024-4471 [HIGH 8.0]
[PUBLISHED: 2024-05-23] [EPSS 0.60%]
The 140+ Widgets | Best Addons For Elementor – FREE for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.4.3.1 via deserialization of untrusted input in the 'export_content' function. This allows authenticated attackers, with contributor-level permissions and above...
> CVE-2024-35224 [HIGH 7.6]
[PUBLISHED: 2024-05-23] [EPSS 0.33%]
OpenProject is the leading open source project management software. OpenProject utilizes `tablesorter` inside of the Cost Report feature. This dependency, when misconfigured, can lead to Stored XSS via `{icon}` substitution in table header values. This attack requires the permissions "Edit work pack...