CVE Radar.

You can follow the current trends of security vulnerabilities.

CVE Radar (266)

Detected during the last 30 days

CVE-2024-10470

The WPLMS Learning Management System for WordPress, WordPress LMS theme for WordPress is vulnerable to arbitrary file read and deletion due to insufficient file path validation and permissions checks in the readfile and unlink functions in all versions up to, and including, 4.962. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The theme is vulnerable even when it is not activated. Continue Reading

CRITICAL

CVE-2024-10508

CVSS: 9.8

The RegistrationMagic – User Registration Plugin with Custom Registration Forms plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0.2.6. This is due to the plugin not properly validating the password reset token prior to updating a user's password. This makes it possible for unauthenticated attackers to reset the password of arbitrary users, including administrators, and gain access to these accounts. Continue Reading

CRITICAL

CVE-2024-10547

CVSS: 9.8

The WP Membership plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the user_profile_image_upload() function in all versions up to, and including, 1.6.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Continue Reading

CRITICAL

CVE-2024-10589

CVSS: 9.8

The Leopard - WordPress Offload Media plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the import_settings() function in all versions up to, and including, 3.1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. Continue Reading

CRITICAL

CVE-2024-10871

CVSS: 9.8

The Category Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.2 via the 'params[caf-post-layout]' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where files with a .php extension can be uploaded and included. Continue Reading

CRITICAL

CVE-2024-11046

CVSS: 9.8

A vulnerability was found in D-Link DI-8003 16.07.16A1. It has been classified as critical. Affected is the function upgrade_filter_asp of the file /upgrade_filter.asp. The manipulation of the argument path leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continue Reading

CRITICAL

CVE-2024-11047

CVSS: 9.8

A vulnerability was found in D-Link DI-8003 16.07.16A1. It has been declared as critical. Affected by this vulnerability is the function upgrade_filter_asp of the file /upgrade_filter.asp. The manipulation of the argument path leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Continue Reading

CRITICAL

CVE-2024-11048

CVSS: 9.8

A vulnerability was found in D-Link DI-8003 16.07.16A1. It has been rated as critical. Affected by this issue is the function dbsrv_asp of the file /dbsrv.asp. The manipulation of the argument str leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Continue Reading

CRITICAL

CVE-2024-11054

CVSS: 9.8

A vulnerability classified as critical was found in SourceCodester Simple Music Cloud Community System 1.0. This vulnerability affects unknown code of the file /music/ajax.php?action=signup. The manipulation of the argument pp leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continue Reading

CRITICAL

CVE-2024-11055

CVSS: 9.8

A vulnerability, which was classified as critical, has been found in 1000 Projects Beauty Parlour Management System 1.0. This issue affects some unknown processing of the file /admin/admin-profile.php. The manipulation of the argument adminname leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Continue Reading

CRITICAL

Description

News

Affected

References

Attack Vector:

Attack Complexity (AC):

Privileges Required (PR):

User Interaction (UI):

Scope (S):

Availability Impact (A):

Confidentiality Impact (C):

Integrity Impact (I):

Exploitability:

Impact:

Vector String:

Get Free 100 Credits Monthly

Try first, decide later! Get started with a free plan. You can cancel at any time.

Start Free Trial

Ponarize offers an online tool that allows you to check whether a URL & IP address categorization and reputation scoring solution is classified in our Databases. Our goal is to offer you this service at the most affordable prices. We are happy to help you and enjoy working tog.

Spam Check IP Lookup Domain Lookup About Pricing Blog

Contact FAQ GDPR Privacy Policy Terms & Conditions

[email protected]