yahoo-inc/cve-impacts huggingface dataset:
CVE-2024-30499: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks CRM Perks Forms.This issue affects CRM Perks Forms: from n/a through 1.1.4.
Key phrases: sql command, sql injection
CVE-2024-30500: Unrestricted Upload of File with Dangerous Type vulnerability in CubeWP CubeWP  All-in-One Dynamic Content Framework.This issue affects CubeWP  All-in-One Dynamic Content Framework: from n/a through 1.1.12.
Key phrases: unrestricted upload of file with dangerous type
CVE-2024-30501: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.9.4.
Key phrases: sql command, sql injection
CVE-2024-30502: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel Engine.This issue affects WP Travel Engine: from n/a through 5.7.9.
Key phrases: sql command, sql injection
CVE-2024-30503: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EverPress Mailster allows Reflected XSS.This issue affects Mailster: from n/a through 4.0.6.
Key phrases: Reflected XSS.This issue affects Mailster: from n, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-30504: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel Engine.This issue affects WP Travel Engine: from n/a through 5.7.9.
Key phrases: sql command, sql injection
CVE-2024-30505: Missing Authorization vulnerability in Andy Moyle Church Admin.This issue affects Church Admin: from n/a through 4.1.18.
Key phrases: missing authorization
CVE-2024-30506: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vsourz Digital All In One Redirection allows Stored XSS.This issue affects All In One Redirection: from n/a through 2.2.0.
Key phrases: Stored XSS.This issue affects All In One Redirection, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-30507: Authorization Bypass Through User-Controlled Key vulnerability in Molongui.This issue affects Molongui: from n/a through 4.7.7.
Key phrases: Bypass Through User-Controlled, Authorization Bypass, authorization bypass through user-controlled key
CVE-2024-30508: Missing Authorization vulnerability in ThimPress WP Hotel Booking.This issue affects WP Hotel Booking: from n/a through 2.0.9.2.
Key phrases: missing authorization
CVE-2024-30510: Unrestricted Upload of File with Dangerous Type vulnerability in Salon Booking System Salon booking system.This issue affects Salon booking system: from n/a through 9.5.
Key phrases: dangerous type
CVE-2024-30511: Insertion of Sensitive Information into Log File vulnerability in Frdric GILLES FG PrestaShop to WooCommerce.This issue affects FG PrestaShop to WooCommerce: from n/a through 4.45.1.
Key phrases: insertion of sensitive information
CVE-2024-30513: Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.2.
Key phrases: Bypass Through User-Controlled, Authorization Bypass, authorization bypass through user-controlled key
CVE-2024-30514: Insertion of Sensitive Information into Log File vulnerability in Paid Memberships Pro Paid Memberships Pro  Payfast Gateway Add On.This issue affects Paid Memberships Pro  Payfast Gateway Add On: from n/a through 1.4.1.
Key phrases: insertion of sensitive information, log file
CVE-2024-30518: Cross-Site Request Forgery (CSRF) vulnerability in ThemeLocation Custom WooCommerce Checkout Fields Editor.This issue affects Custom WooCommerce Checkout Fields Editor: from n/a through 1.3.0.
Key phrases: cross-site request forgery (csrf)
CVE-2024-30519: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lordicon Lordicon Animated Icons allows Stored XSS.This issue affects Lordicon Animated Icons: from n/a through 2.0.1.
Key phrases: Stored XSS.This issue affects Lordicon Animated Icons:, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-30520: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Labib Ahmed Carousel Anything For WPBakery Page Builder allows Stored XSS.This issue affects Carousel Anything For WPBakery Page Builder: from n/a through 2.1.
Key phrases: Stored XSS.This issue affects Carousel Anything For WPBakery, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-30521: Cross-Site Request Forgery (CSRF) vulnerability in Landingi Landingi Landing Pages.This issue affects Landingi Landing Pages: from n/a through 3.1.1.
Key phrases: cross-site request forgery (csrf)
CVE-2024-30523: Insertion of Sensitive Information into Log File vulnerability in Paid Memberships Pro Paid Memberships Pro  Mailchimp Add On pmpro-mailchimp.This issue affects Paid Memberships Pro  Mailchimp Add On: from n/a through 2.3.4.
Key phrases: insertion of sensitive information, log file
CVE-2024-30524: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RedLettuce Plugins PDF Viewer for Elementor allows Stored XSS.This issue affects PDF Viewer for Elementor: from n/a through 2.9.3.
Key phrases: Stored XSS.This issue affects PDF Viewer for Elementor, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-30526: Cross-Site Request Forgery (CSRF) vulnerability in Easy Social Feed.This issue affects Easy Social Feed: from n/a through 6.5.6.
Key phrases: cross-site request forgery (csrf)
CVE-2024-30530: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sonaar Music MP3 Audio Player for Music, Radio & Podcast by Sonaar allows Stored XSS.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through 5.1.
Key phrases: Stored XSS.This issue affects MP3 Audio Player for, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-30531: Server-Side Request Forgery (SSRF) vulnerability in Nelio Software Nelio Content.This issue affects Nelio Content: from n/a through 3.2.0.
Key phrases: server-side request forgery (ssrf)
CVE-2024-30532: Server-Side Request Forgery (SSRF) vulnerability in Builderall Team Builderall Builder for WordPress.This issue affects Builderall Builder for WordPress: from n/a through 2.0.1.
Key phrases: server-side request forgery (ssrf)
CVE-2024-30533: Unrestricted Upload of File with Dangerous Type vulnerability in Techeshta Layouts for Elementor.This issue affects Layouts for Elementor: from n/a before 1.8.
Key phrases: unrestricted upload of file with dangerous type
CVE-2024-30535: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WhiteStudio Easy Form Builder.This issue affects Easy Form Builder: from n/a through 3.7.4.
Key phrases: sql command, sql injection
CVE-2024-30536: Cross-Site Request Forgery (CSRF) vulnerability in WPFactory Slugs Manager.This issue affects Slugs Manager: from n/a through 2.6.7.
Key phrases: cross-site request forgery (csrf)
CVE-2024-30541: Cross-Site Request Forgery (CSRF) vulnerability in LWS LWS Optimize.This issue affects LWS Optimize: from n/a through 1.9.1.
Key phrases: cross-site request forgery (csrf)
CVE-2024-30543: Authorization Bypass Through User-Controlled Key vulnerability in UPQODE Whizz.This issue affects Whizzy: from n/a through 1.1.18.
Key phrases: Bypass Through User-Controlled, Authorization Bypass, authorization bypass through user-controlled key
CVE-2024-30548: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Kagan underConstruction allows Stored XSS.This issue affects underConstruction: from n/a through 1.21.
Key phrases: Stored XSS.This issue affects underConstruction: from n, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-30549: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cimatti Consulting Contact Forms by Cimatti allows Stored XSS.This issue affects Contact Forms by Cimatti: from n/a through 1.8.0.
Key phrases: Stored XSS.This issue affects Contact Forms by Cimatti, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-30550: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevart Responsive Image Gallery, Gallery Album allows Reflected XSS.This issue affects Responsive Image Gallery, Gallery Album: from n/a through 2.0.3.
Key phrases: Reflected XSS.This issue affects Responsive Image Gallery, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-30551: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Toast Plugins Sticky Anything.This issue affects Sticky Anything: from n/a through 2.1.5.
Key phrases: improper neutralization of input during web page generation, cross-site scripting
CVE-2024-30552: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wppdf.Org Responsive flipbook allows Stored XSS.This issue affects Responsive flipbook: from n/a through 1.0.0.
Key phrases: Stored XSS.This issue affects Responsive flipbook: from, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-30553: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joby Joseph WP Twitter Mega Fan Box Widget allows Stored XSS.This issue affects WP Twitter Mega Fan Box Widget : from n/a through 1.0.
Key phrases: Stored XSS.This issue affects WP Twitter Mega Fan, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-30554: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wouter Dijkstra DD Rating allows Stored XSS.This issue affects DD Rating: from n/a through 1.7.1.
Key phrases: Stored XSS.This issue affects DD Rating: from, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-30555: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sayan Datta Ultimate Social Comments  Email Notification & Lazy Load allows Stored XSS.This issue affects Ultimate Social Comments  Email Notification & Lazy Load: from n/a through 1.4.8.
Key phrases: Stored XSS.This issue affects Ultimate Social Comments  , improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-30556: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MightyThemes Mighty Classic Pros And Cons allows Stored XSS.This issue affects Mighty Classic Pros And Cons: from n/a through 2.0.9.
Key phrases: Stored XSS.This issue affects Mighty Classic Pros And, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-30557: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aesopinteractive Aesop Story Engine allows Stored XSS.This issue affects Aesop Story Engine: from n/a through 2.3.2.
Key phrases: Stored XSS.This issue affects Aesop Story Engine:, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-30558: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Simpson Add Shortcodes Actions And Filters allows Reflected XSS.This issue affects Add Shortcodes Actions And Filters: from n/a through 2.10.
Key phrases: Reflected XSS.This issue affects Add Shortcodes Actions And, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-30559: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maurice Spin 360 deg and 3D Model Viewer allows Stored XSS.This issue affects Spin 360 deg and 3D Model Viewer: from n/a through 1.2.7.
Key phrases: Stored XSS.This issue affects Spin 360 deg and, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-30561: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scientech It Solution Appointment Calendar allows Reflected XSS.This issue affects Appointment Calendar: from n/a through 2.9.6.
Key phrases: Reflected XSS.This issue affects Appointment Calendar: from, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-30568: Netgear R6850 1.1.0.88 was discovered to contain a command injection vulnerability via the c4-IPAddr parameter.
Key phrases: command injection
CVE-2024-30569: An information leak in currentsetting.htm of Netgear R6850 v1.1.0.88 allows attackers to obtain sensitive information without any authentication required.
Key phrases: obtain sensitive information, obtain sensitive information without any authentication required, information leak
CVE-2024-30570: An information leak in debuginfo.htm of Netgear R6850 v1.1.0.88 allows attackers to obtain sensitive information without any authentication required.
Key phrases: obtain sensitive information, obtain sensitive information without any authentication required, information leak
CVE-2024-30571: An information leak in the BRS_top.html component of Netgear R6850 v1.1.0.88 allows attackers to obtain sensitive information without any authentication required.
Key phrases: obtain sensitive information, obtain sensitive information without any authentication required, information leak
CVE-2024-30572: Netgear R6850 1.1.0.88 was discovered to contain a command injection vulnerability via the ntp_server parameter.
Key phrases: command injection
CVE-2024-30583: Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the mitInterface parameter of the fromAddressNat function.
Key phrases: stack overflow
CVE-2024-30584: Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the security parameter of the formWifiBasicSet function.
Key phrases: stack overflow
CVE-2024-30585: Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the deviceId parameter of the saveParentControlInfo function.
Key phrases: stack overflow
CVE-2024-30586: Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the security_5g parameter of the formWifiBasicSet function.
Key phrases: stack overflow
CVE-2024-30587: Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the urls parameter of the saveParentControlInfo function.
Key phrases: stack overflow
CVE-2024-30588: Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the schedStartTime parameter of the setSchedWifi function.
Key phrases: stack overflow
CVE-2024-30589: Tenda FH1202 v1.2.0.14(408) firmware has a stack overflow vulnerability in the entrys parameter of the fromAddressNat function.
Key phrases: stack overflow
CVE-2024-30590: Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the schedEndTime parameter of the setSchedWifi function.
Key phrases: stack overflow
CVE-2024-30591: Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the time parameter of the saveParentControlInfo function.
Key phrases: stack overflow
CVE-2024-30592: Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the page parameter of the fromAddressNat function.
Key phrases: stack overflow
CVE-2024-30593: Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability located in the deviceName parameter of the formSetDeviceName function.
Key phrases: stack overflow
CVE-2024-30594: Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the deviceMac parameter of the addWifiMacFilter function.
Key phrases: stack overflow
CVE-2024-30595: Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the deviceId parameter of the addWifiMacFilter function.
Key phrases: stack overflow
CVE-2024-30596: Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the deviceId parameter of the formSetDeviceName function.
Key phrases: stack overflow
CVE-2024-30597: Tenda FH1203 v2.0.1.6 firmware has a stack overflow vulnerability in the security parameter of the formWifiBasicSet function.
Key phrases: stack overflow
CVE-2024-30598: Tenda FH1203 v2.0.1.6 firmware has a stack overflow vulnerability in the security_5g parameter of the formWifiBasicSet function.
Key phrases: stack overflow
CVE-2024-30599: Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the deviceMac parameter of the addWifiMacFilter function.
Key phrases: stack overflow
CVE-2024-30600: Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the schedEndTime parameter of the setSchedWifi function.
Key phrases: stack overflow
CVE-2024-30601: Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the time parameter of the saveParentControlInfo function.
Key phrases: stack overflow
CVE-2024-30602: Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the schedStartTime parameter of the setSchedWifi function.
Key phrases: stack overflow
CVE-2024-30603: Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the urls parameter of the saveParentControlInfo function.
Key phrases: stack overflow
CVE-2024-30604: Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the list1 parameter of the fromDhcpListClient function.
Key phrases: stack overflow
CVE-2024-30606: Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the page parameter of the fromDhcpListClient function.
Key phrases: stack overflow
CVE-2024-30607: Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the deviceId parameter of the saveParentControlInfo function.
Key phrases: stack overflow
CVE-2024-3061: The HUSKY  Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.5.2 via the 'type' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other safe file types can be uploaded and included.
Key phrases: execute arbitrary files, bypass access controls, obtain sensitive data, local file inclusion, code execution
CVE-2024-30612: Tenda AC10U v15.03.06.48 has a stack overflow vulnerability in the deviceId, limitSpeed, limitSpeedUp parameter from formSetClientState function.
Key phrases: stack overflow
CVE-2024-30613: Tenda AC15 v15.03.05.18 has a stack overflow vulnerability in the time parameter from the setSmartPowerManagement function.
Key phrases: stack overflow
CVE-2024-30620: Tenda AX1803 v1.0.0.1 contains a stack overflow via the serviceName parameter in the function fromAdvSetMacMtuWan.
Key phrases: stack overflow
CVE-2024-30621: Tenda AX1803 v1.0.0.1 contains a stack overflow via the serverName parameter in the function fromAdvSetMacMtuWan.
Key phrases: stack overflow
CVE-2024-30622: Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the mitInterface parameter from fromAddressNat function.
Key phrases: stack overflow
CVE-2024-30623: Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the page parameter from fromDhcpListClient function.
Key phrases: stack overflow
CVE-2024-30624: Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the urls parameter from saveParentControlInfo function.
Key phrases: stack overflow
CVE-2024-30625: Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the entrys parameter from fromAddressNat function.
Key phrases: stack overflow
CVE-2024-30626: Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the schedEndTime parameter from setSchedWifi function.
Key phrases: stack overflow
CVE-2024-30627: Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the deviceId parameter from saveParentControlInfo function.
Key phrases: stack overflow
CVE-2024-30628: Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the page parameter from fromAddressNat function.
Key phrases: stack overflow
CVE-2024-30629: Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the list1 parameter from fromDhcpListClient function.
Key phrases: stack overflow
CVE-2024-30630: Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the time parameter from saveParentControlInfo function.
Key phrases: stack overflow
CVE-2024-30631: Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the schedStartTime parameter from setSchedWifi function.
Key phrases: stack overflow
CVE-2024-30632: Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the security_5g parameter from formWifiBasicSet function.
Key phrases: stack overflow
CVE-2024-30633: Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the security parameter from the formWifiBasicSet function.
Key phrases: stack overflow
CVE-2024-30634: Tenda F1202 v1.2.0.20(408) has a stack overflow vulnerability via the mitInterface parameter in the fromAddressNat function.
Key phrases: stack overflow
CVE-2024-30635: Tenda F1202 v1.2.0.20(408) has a stack overflow vulnerability located in the funcpara1 parameter in the formSetCfm function.
Key phrases: stack overflow
CVE-2024-30636: Tenda F1202 v1.2.0.20(408) has a stack overflow vulnerability via the PPPOEPassword parameter in the formQuickIndex function.
Key phrases: stack overflow
CVE-2024-30637: Tenda F1202 v1.2.0.20(408) has a command injection vulnerablility in the formWriteFacMac function in the mac parameter.
Key phrases: command injection
CVE-2024-30638: Tenda F1202 v1.2.0.20(408) has a stack overflow vulnerability via the entrys parameter in the fromAddressNat function.
Key phrases: stack overflow
CVE-2024-30639: Tenda F1202 v1.2.0.20(408) has a stack overflow vulnerability in the page parameter of fromAddressNat function.
Key phrases: stack overflow
CVE-2024-30645: Tenda AC15V1.0 V15.03.20_multi has a command injection vulnerability via the deviceName parameter.
Key phrases: command injection
CVE-2024-3077: An malicious BLE device can crash BLE victim device by sending malformed gatt packet
Key phrases: crash, malformed gatt packet
CVE-2024-3078: A vulnerability was found in Qdrant up to 1.6.1/1.7.4/1.8.2 and classified as critical. This issue affects some unknown processing of the file lib/collection/src/collection/snapshots.rs of the component Full Snapshot REST API. The manipulation leads to path traversal. Upgrading to version 1.8.3 is able to address this issue. The patch is named 3ab5172e9c8f14fa1f7b24e7147eac74e2412b62. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-258611.
Key phrases: path traversal
CVE-2024-30806: An issue was discovered in Bento4 v1.6.0-641-2-g1529b83. There is a heap overflow in AP4_Dec3Atom::AP4_Dec3Atom at Ap4Dec3Atom.cpp, leading to a Denial of Service (DoS), as demonstrated by mp42aac.
Key phrases: Denial of Service (DoS), heap overflow, denial of service (dos)
CVE-2024-30807: An issue was discovered in Bento4 v1.6.0-641-2-g1529b83. There is a heap-use-after-free in AP4_UnknownAtom::~AP4_UnknownAtom at Ap4Atom.cpp, leading to a Denial of Service (DoS), as demonstrated by mp42ts.
Key phrases: Denial of Service (DoS), heap-use-after-free, denial of service (dos), use after free
CVE-2024-30808: An issue was discovered in Bento4 v1.6.0-641-2-g1529b83. There is a heap-use-after-free in AP4_SubStream::~AP4_SubStream at Ap4ByteStream.cpp, leading to a Denial of Service (DoS), as demonstrated by mp42ts.
Key phrases: Denial of Service (DoS), heap-use-after-free, denial of service (dos), use after free
CVE-2024-30809: An issue was discovered in Bento4 v1.6.0-641-2-g1529b83. There is a heap-use-after-free in Ap4Sample.h in AP4_Sample::GetOffset() const, leading to a Denial of Service (DoS), as demonstrated by mp42ts.
Key phrases: Denial of Service (DoS), heap-use-after-free, denial of service (dos), use after free
CVE-2024-3081: A vulnerability was found in EasyCorp EasyAdmin up to 4.8.9. It has been declared as problematic. Affected by this vulnerability is the function Autocomplete of the file assets/js/autocomplete.js of the component Autocomplete. The manipulation of the argument item leads to cross site scripting. The attack can be launched remotely. Upgrading to version 4.8.10 is able to address this issue. The identifier of the patch is 127436e4c3f56276d548070f99e61b7234200a11. It is recommended to upgrade the affected component. The identifier VDB-258613 was assigned to this vulnerability.
Key phrases: cross site scripting
CVE-2024-3084: A vulnerability was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. It has been rated as problematic. This issue affects some unknown processing of the component Hire an Ambulance Page. The manipulation of the argument Patient Name/Relative Name/Relative Phone Number/City/State/Message leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258677 was assigned to this vulnerability.
Key phrases: cross site scripting
CVE-2024-3085: A vulnerability classified as critical has been found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. Affected is an unknown function of the file /admin/login.php of the component Admin Login Page. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-258678 is the identifier assigned to this vulnerability.
Key phrases: sql injection
CVE-2024-30858: netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/edit_fire_wall.php.
Key phrases: sql injection
CVE-2024-30859: netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/config_ISCGroupSSLCert.php.
Key phrases: sql injection
CVE-2024-3086: A vulnerability classified as problematic was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. Affected by this vulnerability is an unknown functionality of the file ambulance-tracking.php of the component Ambulance Tracking Page. The manipulation of the argument searchdata leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258679.
Key phrases: cross site scripting
CVE-2024-30860: netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/export_excel_user.php.
Key phrases: sql injection
CVE-2024-30861: netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/configguide/ipsec_guide_1.php.
Key phrases: sql injection
CVE-2024-30862: netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /3g/index.php.
Key phrases: sql injection
CVE-2024-30863: netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /WebPages/history.php.
Key phrases: sql injection
CVE-2024-30864: netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/config_ISCGroupTimePolicy.php.
Key phrases: sql injection
CVE-2024-30865: netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/edit_user_login.php.
Key phrases: sql injection
CVE-2024-30866: netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /3g/menu.php.
Key phrases: sql injection
CVE-2024-30867: netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/edit_virtual_site_info.php.
Key phrases: sql injection
CVE-2024-30868: netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/add_getlogin.php.
Key phrases: sql injection
CVE-2024-3087: A vulnerability, which was classified as critical, has been found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. Affected by this issue is some unknown functionality of the file ambulance-tracking.php of the component Ambulance Tracking Page. The manipulation of the argument searchdata leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258680.
Key phrases: sql injection
CVE-2024-30870: netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/address_interpret.php.
Key phrases: sql injection
CVE-2024-30871: netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /WebPages/applyhardware.php.
Key phrases: sql injection
CVE-2024-30872: netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /include/authrp.php.
Key phrases: sql injection
CVE-2024-3088: A vulnerability, which was classified as critical, was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. This affects an unknown part of the file /admin/forgot-password.php of the component Forgot Password Page. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258681 was assigned to this vulnerability.
Key phrases: sql injection
CVE-2024-3089: A vulnerability has been found in PHPGurukul Emergency Ambulance Hiring Portal 1.0 and classified as problematic. This vulnerability affects unknown code of the file /admin/manage-ambulance.php of the component Manage Ambulance Page. The manipulation of the argument del leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-258682 is the identifier assigned to this vulnerability.
Key phrases: cross-site request forgery, cross site request forgery
CVE-2024-3090: A vulnerability was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0 and classified as problematic. This issue affects some unknown processing of the file /admin/add-ambulance.php of the component Add Ambulance Page. The manipulation of the argument Ambulance Reg No/Driver Name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258683.
Key phrases: cross site scripting
CVE-2024-3091: A vulnerability was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. It has been classified as problematic. Affected is an unknown function of the file /admin/search.php of the component Search Request Page. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258684.
Key phrases: cross site scripting, cross-site scripting
CVE-2024-3094: Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.
Key phrases: data interaction
CVE-2024-30946: DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/co_do.php.
Key phrases: cross-site request forgery (csrf)
CVE-2024-30965: DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/member_scores.php.
Key phrases: cross-site request forgery (csrf)
CVE-2024-30998: SQL Injection vulnerability in PHPGurukul Men Salon Management System v.2.0, allows remote attackers to execute arbitrary code and obtain sensitive information via the email parameter in the index.php component.
Key phrases: execute arbitrary code, obtain sensitive information, execute arbitrary code and obtain sensitive information via, sql injection
CVE-2024-31002: Buffer Overflow vulnerability in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the AP4 BitReader::ReadCache() at Ap4Utils.cpp component.
Key phrases: execute arbitrary code, execute arbitrary code via the AP4 BitReader::ReadCache(, buffer overflow
CVE-2024-31003: Buffer Overflow vulnerability in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the AP4_MemoryByteStream::WritePartial at Ap4ByteStream.cpp.
Key phrases: execute arbitrary code, execute arbitrary code via the AP4_MemoryByteStream::WritePartial at Ap4ByteStream.cpp, buffer overflow
CVE-2024-31004: An issue in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the Ap4StsdAtom.cpp,AP4_StsdAtom::AP4_StsdAtom,mp4fragment.
Key phrases: execute arbitrary code, execute arbitrary code via the Ap4StsdAtom.cpp
CVE-2024-31005: An issue in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the Ap4MdhdAtom.cpp,AP4_MdhdAtom::AP4_MdhdAtom,mp4fragment
Key phrases: execute arbitrary code, execute arbitrary code via the Ap4MdhdAtom.cpp
CVE-2024-31008: An issue was discovered in WUZHICMS version 4.1.0, allows an attacker to execute arbitrary code and obtain sensitive information via the index.php file.
Key phrases: execute arbitrary code, obtain sensitive information, execute arbitrary code and obtain sensitive information via
CVE-2024-31009: SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via lgid parameter in Banner.php.
Key phrases: obtain sensitive information, obtain sensitive information via lgid parameter in Banner.php, sql injection
CVE-2024-31010: SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via the ID parameter in Banner.php.
Key phrases: obtain sensitive information, obtain sensitive information via the ID parameter in, sql injection
CVE-2024-31011: Arbitrary file write vulnerability in beescms v.4.0, allows a remote attacker to execute arbitrary code via a file path that was not isolated and the suffix was not verified in admin_template.php.
Key phrases: execute arbitrary code, execute arbitrary code via a file path that, arbitrary file write
CVE-2024-31012: An issue was discovered in SEMCMS v.4.8, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via the upload.php file.
Key phrases: execute arbitrary code, obtain sensitive information, escalate privileges
CVE-2024-31013: Cross Site Scripting (XSS) vulnerability in emlog version Pro 2.3, allow remote attackers to execute arbitrary code via a crafted payload to the bottom of the homepage in footer_info parameter.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted payload to, cross site scripting (xss)
CVE-2024-31025: SQL Injection vulnerability in ECshop 4.x allows an attacker to obtain sensitive information via the file/article.php component.
Key phrases: obtain sensitive information, obtain sensitive information via the file/article.php, sql injection
CVE-2024-31032: An issue in Huashi Private Cloud CDN Live Streaming Acceleration Server hgateway-sixport v.1.1.2 allows a remote attacker to execute arbitrary code via the manager/ipping.php component.
Key phrases: execute arbitrary code, execute arbitrary code via the manager/ipping.php
CVE-2024-31033: JJWT (aka Java JWT) through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. The impacted code is the setSigningKey() method within the DefaultJwtParser class and the signWith() method within the DefaultJwtBuilder class. NOTE: the vendor disputes this because the "ignores" behavior cannot occur (in any version) unless there is a user error in how JJWT is used, and because the version that was actually tested must have been more than six years out of date.
Key phrases: impacted code
CVE-2024-31061: Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the Last Name input field.
Key phrases: execute arbitrary code, execute arbitrary code via the Last Name input, cross site scripting
CVE-2024-31062: Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the Street input field.
Key phrases: execute arbitrary code, execute arbitrary code via the Street input field, cross site scripting
CVE-2024-31063: Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the Email input field.
Key phrases: execute arbitrary code, execute arbitrary code via the Email input field, cross site scripting
CVE-2024-31064: Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the First Name input field.
Key phrases: execute arbitrary code, execute arbitrary code via the First Name input, cross site scripting
CVE-2024-31065: Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the City input field.
Key phrases: execute arbitrary code, execute arbitrary code via the City input field, cross site scripting
CVE-2024-31084: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pulsar Web Design Weekly Class Schedule allows Reflected XSS.This issue affects Weekly Class Schedule: from n/a through 3.19.
Key phrases: Reflected XSS.This issue affects Weekly Class Schedule:, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-31085: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rob Marsh, SJ Post-Plugin Library allows Reflected XSS.This issue affects Post-Plugin Library: from n/a through 2.6.2.1.
Key phrases: Reflected XSS.This issue affects Post-Plugin Library, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-31087: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joel Starnes pageMash > Page Management allows Reflected XSS.This issue affects pageMash > Page Management: from n/a through 1.3.0.
Key phrases: Reflected XSS.This issue affects pageMash > Page Management, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-31089: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Techblissonline.Com (Rajesh) Platinum SEO allows Stored XSS.This issue affects Platinum SEO: from n/a through 2.4.0.
Key phrases: Stored XSS.This issue affects Platinum SEO: from, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-31090: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ???? Hacklog Down As PDF allows Reflected XSS.This issue affects Hacklog Down As PDF: from n/a through 2.3.6.
Key phrases: Reflected XSS.This issue affects Hacklog Down As PDF, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-31091: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SparkWeb Interactive, Inc. Custom Field Bulk Editor allows Reflected XSS.This issue affects Custom Field Bulk Editor: from n/a through 1.9.1.
Key phrases: Reflected XSS.This issue affects Custom Field Bulk Editor, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-31092: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Philip M. Hofer (Frumph) Comic Easel allows Reflected XSS.This issue affects Comic Easel: from n/a through 1.15.
Key phrases: Reflected XSS.This issue affects Comic Easel: from, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-31094: Deserialization of Untrusted Data vulnerability in Filter Custom Fields & Taxonomies Light.This issue affects Filter Custom Fields & Taxonomies Light: from n/a through 1.05.
Key phrases: deserialization of untrusted data
CVE-2024-31095: Authorization Bypass Through User-Controlled Key vulnerability in Ricard Torres Thumbs Rating.This issue affects Thumbs Rating: from n/a through 5.1.0.
Key phrases: Bypass Through User-Controlled, Authorization Bypass, authorization bypass through user-controlled key
CVE-2024-31096: Cross-Site Request Forgery (CSRF) vulnerability in kopatheme Nictitate.This issue affects Nictitate: from n/a through 1.1.4.
Key phrases: cross-site request forgery (csrf)
CVE-2024-31097: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stephan Spencer SEO Title Tag allows Reflected XSS.This issue affects SEO Title Tag: from n/a through 3.5.9.
Key phrases: Reflected XSS.This issue affects SEO Title Tag:, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-31099: Missing Authorization vulnerability in Averta Shortcodes and extra features for Phlox theme.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.15.5.
Key phrases: missing authorization
CVE-2024-31100: Cross-Site Request Forgery (CSRF) vulnerability in Festi-Team Popup Cart Lite for WooCommerce.This issue affects Popup Cart Lite for WooCommerce: from n/a through 1.1.
Key phrases: cross-site request forgery (csrf)
CVE-2024-31101: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in August Infotech AI Twitter Feeds (Twitter widget & shortcode) allows Stored XSS.This issue affects AI Twitter Feeds (Twitter widget & shortcode): from n/a through 2.4.
Key phrases: Stored XSS.This issue affects AI Twitter Feeds (, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-31102: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scimone Ignazio Prenotazioni allows Stored XSS.This issue affects Prenotazioni: from n/a through 1.7.4.
Key phrases: Stored XSS.This issue affects Prenotazioni: from n, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-31103: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kanban for WordPress Kanban Boards for WordPress allows Reflected XSS.This issue affects Kanban Boards for WordPress: from n/a through 2.5.21.
Key phrases: Reflected XSS.This issue affects Kanban Boards for WordPress, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-31104: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GetResponse GetResponse for WordPress allows Stored XSS.This issue affects GetResponse for WordPress: from n/a through 5.5.33.
Key phrases: Stored XSS.This issue affects GetResponse for WordPress:, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-31105: Cross-Site Request Forgery (CSRF) vulnerability in Adam Bowen Tax Rate Upload allows Reflected XSS.This issue affects Tax Rate Upload: from n/a through 2.4.5.
Key phrases: Reflected XSS.This issue affects Tax Rate Upload:, cross-site request forgery (csrf), reflected xss
CVE-2024-31106: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yooslider Yoo Slider allows Reflected XSS.This issue affects Yoo Slider: from n/a through 2.1.1.
Key phrases: Reflected XSS.This issue affects Yoo Slider: from, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-31107: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DiSo Development Team OpenID allows Reflected XSS.This issue affects OpenID: from n/a through 3.6.1.
Key phrases: Reflected XSS.This issue affects OpenID: from n, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-31108: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iFlyChat Team iFlyChat  WordPress Chat iflychat allows Stored XSS.This issue affects iFlyChat  WordPress Chat: from n/a through 4.7.2.
Key phrases: Stored XSS.This issue affects iFlyChat  WordPress Chat, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-31109: Cross-Site Request Forgery (CSRF) vulnerability in Toastie Studio Woocommerce Social Media Share Buttons allows Stored XSS.This issue affects Woocommerce Social Media Share Buttons: from n/a through 1.3.0.
Key phrases: Stored XSS.This issue affects Woocommerce Social Media Share, cross-site request forgery (csrf), stored xss
CVE-2024-31110: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Katz Web Services, Inc. Contact Form 7 Newsletter allows Reflected XSS.This issue affects Contact Form 7 Newsletter: from n/a through 2.2.
Key phrases: Reflected XSS.This issue affects Contact Form 7 Newsletter, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-31112: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stephanie Leary Convert Post Types allows Reflected XSS.This issue affects Convert Post Types: from n/a through 1.4.
Key phrases: Reflected XSS.This issue affects Convert Post Types:, improper neutralization of input during web page generation, cross-site scripting, reflected xss
CVE-2024-31114: Unrestricted Upload of File with Dangerous Type vulnerability in biplob018 Shortcode Addons.This issue affects Shortcode Addons: from n/a through 3.2.5.
Key phrases: unrestricted upload of file with dangerous type
CVE-2024-31115: Unrestricted Upload of File with Dangerous Type vulnerability in QuanticaLabs Chauffeur Taxi Booking System for WordPress.This issue affects Chauffeur Taxi Booking System for WordPress: from n/a through 6.9.
Key phrases: unrestricted upload of file with dangerous type
CVE-2024-31116: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web 10Web Map Builder for Google Maps.This issue affects 10Web Map Builder for Google Maps: from n/a through 1.0.74.
Key phrases: sql command, sql injection
CVE-2024-31117: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Moises Heberle WooCommerce Bookings Calendar.This issue affects WooCommerce Bookings Calendar: from n/a through 1.0.36.
Key phrases: improper neutralization of input during web page generation, cross-site scripting
CVE-2024-31120: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevart Responsive Image Gallery, Gallery Album allows Stored XSS.This issue affects Responsive Image Gallery, Gallery Album: from n/a through 2.0.3.
Key phrases: Stored XSS.This issue affects Responsive Image Gallery, improper neutralization of input during web page generation, cross-site scripting, stored xss
CVE-2024-31121: Contributor Cross Site Scripting (XSS) in HeartThis <= 0.1.0 versions.
Key phrases: contributor cross site scripting (xss)
CVE-2024-31122: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Prism IT Systems User Rights Access Manager allows Reflected XSS.This issue affects User Rights Access Manager: from n/a through 1.1.2.
Key phrases: Reflected XSS.This issue affects User Rights Access Manager, improper neutralization of input during web page generation, cross-site scripting, reflected xss