CVE-2024-9291

kalvinGit kvf-admin XML File cross site scripting

A vulnerability classified as problematic has been found in kalvinGit kvf-admin up to f12a94dc1ebb7d1c51ee978a85e4c7ed75c620ff. Affected is an unknown function of the file /ueditor/upload?configPath=ueditor/config.json&action=uploadfile of the component XML File Handler. The manipulation of the argument upfile leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The GitHub repository of the project did not receive an update for more than two years.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Kvf-admin Project

Products

Kvf-admin

CVE-2024-6927

Viral Signup <= 2.1 - Admin+ Stored XSS

The Viral Signup WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wow-company

Products

Viral-signup Viral Signup

CVE-2024-7690

DN Popup <= 1.2.2 - Settings Update via CSRF

The DN Popup WordPress plugin through 1.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Digireturn

Products

Dn-popup Dn Popup

CVE-2024-8379

Cost Calculator Builder < 3.2.29 - Admin+ SQL Injection

The Cost Calculator Builder WordPress plugin before 3.2.29 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Stylemixthemes

Products

Cost Calculator Builder

CVE-2024-8283

Slider by 10Web < 1.2.59 - Admin+ Stored XSS

The Slider by 10Web WordPress plugin before 1.2.59 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

10web

Products

Slider

CVE-2024-8239

Starbox < 3.5.3 - Contributor+ Stored XSS

The Starbox WordPress plugin before 3.5.3 does not properly render social media profiles URLs in certain contexts, like the malicious user's profile or pages where the starbox shortcode is used, which may be abused by users with at least the contributor role to conduct Stored XSS attacks.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Squirrly Squirrlyuk

Products

Starbox Starbox

CVE-2024-7132

CoBlocks < 3.1.13 - Editor+ Stored XSS

The Page Builder Gutenberg Blocks WordPress plugin before 3.1.13 does not escape the content of post embed via one of its block, which could allow users with the capability to publish posts (editor and admin by default) to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Godaddy Gutentor

Products

Coblocks Gutenberg Blocks

CVE-2024-5417

Gutentor < 3.3.6 - Contributor+ Stored XSS

The Gutentor WordPress plugin before 3.3.6 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Gutentor

Products

Gutenberg Blocks Gutentor

CVE-2024-6020

Sign-up Sheets < 2.2.13 - Reflected XSS

The Sign-up Sheets WordPress plugin before 2.2.13 does not escape some generated URLs, as well as the $_SERVER['REQUEST_URI'] parameter before outputting them back in attributes, which could lead to Reflected Cross-Site Scripting.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Fetchdesigns

Products

Sign-up Sheets

CVE-2024-6722

Chatbot Support AI <= 1.0.2 - Admin+ Stored XSS

The Chatbot Support AI: Free ChatGPT Chatbot, Woocommerce Chatbot WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Mansurahamed

Products

Chatbot Support Ai

CVE-2024-6888

Secure Copy Content Protection and Content Locking < 4.1.7 - Admin+ Stored XSS

The Secure Copy Content Protection and Content Locking WordPress plugin before 4.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Ays-pro Copy Content Protection Team

Products

Secure Copy Content Protection And Content Locking Secure Copy Content Protection And Content Locking

CVE-2024-9293

skyselang yylAdmin Backend File.php list sql injection

A vulnerability classified as critical was found in skyselang yylAdmin up to 3.0. Affected by this vulnerability is the function list of the file /app/admin/controller/file/File.php of the component Backend. The manipulation of the argument is_disable leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Skyselang Yyladmin Project

Products

Yyladmin Yyladmin

CVE-2024-23586

An insufficient session timeout vulnerability affects HCL Nomad server on Domino

HCL Nomad is susceptible to an insufficient session expiration vulnerability.   Under certain circumstances, an unauthenticated attacker could obtain old session information.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Domino Hcl Nomad Nomad Server On Domino

CVE-2024-6889

Secure Copy Content Protection and Content Locking < 4.1.7 - Admin+ Stored XSS

The Secure Copy Content Protection and Content Locking WordPress plugin before 4.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Ays-pro Copy Content Protection Team

Products

Secure Copy Content Protection And Content Locking Secure Copy Content Protection And Content Locking

CVE-2024-6926

Viral Signup <= 2.1 - Unauthenticated SQLi

The Viral Signup WordPress plugin through 2.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection

CVSS 3.1 · 9.8 Critical EPSS 3.3% KEV · Not listed

Vendors

Wow-company

Products

Viral-signup Viral Signup

CVE-2024-39275

Advantech ADAM-5630 Use of Persistent Cookies Containing Sensitive Information

Cookies of authenticated Advantech ADAM-5630 users remain as active valid cookies when a session is closed. Forging requests with a legitimate cookie, even if the session was terminated, allows an unauthorized attacker to act with the same level of privileges of the legitimate user.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Advantech

Products

Adam-5630 Adam-5630 Firmware

CVE-2024-38308

Advantech ADAM-5550 Cross-site Scripting

Advantech ADAM 5550's web application includes a "logs" page where all the HTTP requests received are displayed to the user. The device doesn't correctly neutralize malicious code when parsing HTTP requests to generate page output.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Advantech

Products

Adam-5550 Adam 5550-firmware

CVE-2024-34542

Advantech ADAM-5630 Weak Encoding for Password

Advantech ADAM-5630 shares user credentials plain text between the device and the user source device during the login process.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Advantech

Products

Adam-5630 Adam-5630 Firmware

CVE-2024-37187

Advantech ADAM-5550 Weak Encoding for Password

Advantech ADAM-5550 share user credentials with a low level of encryption, consisting of base 64 encoding.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Advantech

Products

Adam-5550 Adam-5550 Firmware

CVE-2024-41849

Adobe Experience Manager | Improper Input Validation (CWE-20)

Adobe Experience Manager versions 6.5.20 and earlier are affected by an Improper Input Validation vulnerability that could lead to a security feature bypass. An low-privileged attacker could leverage this vulnerability to slightly affect the integrity of the page. Exploitation of this issue requires user interaction and scope is changed.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Experience Manager