newsThe portal itself — self-promo until real sponsors land
Subscribe, build a custom feed, or pitch a sponsorship at hello@acadenix.com
Latest intel// live feed
25 results//sorted by published//last sync 2026-07-13 11:30Z
Subscribe to news →
CVE-2024-1206 — Bootstrapped Wp_recipe_maker: The WP Recipe Maker plugin for WordPress is vulnerable to SQL Injection via the
The WP Recipe Maker plugin for WordPress is vulnerable to SQL Injection via the 'recipes' parameter in all versions up to, and including, 9.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the CVSSv3.1 8.8 (HIGH) · EPSS 71th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2024-0590 — Microsoft Clarity: The Microsoft Clarity plugin for WordPress is vulnerable to Cross-Site Request Forgery in all
The Microsoft Clarity plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9.3. This is due to missing nonce validation on the edit_clarity_project_id() function. This makes it possible for unauthenticated attackers to change the project id and add malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVSSv3.1 6.1 (MEDIUM) · EPSS 96th percentile
6.1
CVSS v3.1
88
Edit Score
CVE-2024-22983 — Projectworlds Visitor_management_system: SQL injection vulnerability in Projectworlds Visitor Management System in PHP v.1.0 allows a remote
SQL injection vulnerability in Projectworlds Visitor Management System in PHP v.1.0 allows a remote attacker to escalate privileges via the name parameter in the myform.php endpoint. CVSSv3.1 8.1 (HIGH) · EPSS 55th percentile
8.1
CVSS v3.1
91
Edit Score
CVE-2024-1514 — Wp-ecommerce Wp_ecommerce: The WP eCommerce plugin for WordPress is vulnerable to time-based blind SQL Injection via
The WP eCommerce plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'cart_contents' parameter in all versions up to, and including, 3.15.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVSSv3.1 9.8 (CRITICAL) · EPSS 72th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2024-0786 — Tatvic Conversios.io: The Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag
The Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the ee_syncProductCategory function using the parameters conditionData, valueData, productArray, exclude and include in all versions up to, and including, 7.0.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for au CVSSv3.1 8.8 (HIGH) · EPSS 61th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2024-1698 — Wpdeveloper Notificationx: The NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin
The NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor plugin for WordPress is vulnerable to SQL Injection via the 'type' parameter in all versions up to, and including, 2.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can b CVSSv3.1 9.8 (CRITICAL) · EPSS 100th percentile
9.8
CVSS v3.1
100
Edit Score
CVE-2024-23605 — Ggml Llama.cpp: A heap-based buffer overflow vulnerability exists in the GGUF library header.n_kv functionality of llama.cpp
A heap-based buffer overflow vulnerability exists in the GGUF library header.n_kv functionality of llama.cpp Commit 18c2e17. A specially crafted .gguf file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability. CVSSv3.1 8.8 (HIGH) · EPSS 35th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2024-23496 — Ggml Llama.cpp: A heap-based buffer overflow vulnerability exists in the GGUF library gguf_fread_str functionality of llama.cpp
A heap-based buffer overflow vulnerability exists in the GGUF library gguf_fread_str functionality of llama.cpp Commit 18c2e17. A specially crafted .gguf file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability. CVSSv3.1 8.8 (HIGH) · EPSS 35th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2024-22873 — Tencent Blueking_configuration_management_database: Blueking CMDB v3.2.x to v3.9.x was discovered to contain a Server-Side Request Forgery
Tencent Blueking CMDB v3.2.x to v3.9.x was discovered to contain a Server-Side Request Forgery (SSRF) via the event subscription function (/service/subscription.go). This vulnerability allows attackers to access internal requests via a crafted POST request. CVSSv3.1 8.1 (HIGH) · EPSS 47th percentile
8.1
CVSS v3.1
91
Edit Score
CVE-2024-21836 — Ggml Llama.cpp: A heap-based buffer overflow vulnerability exists in the GGUF library header.n_tensors functionality of llama.cpp
A heap-based buffer overflow vulnerability exists in the GGUF library header.n_tensors functionality of llama.cpp Commit 18c2e17. A specially crafted .gguf file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability. CVSSv3.1 8.8 (HIGH) · EPSS 35th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2024-21825 — Ggml Llama.cpp: A heap-based buffer overflow vulnerability exists in the GGUF library GGUF_TYPE_ARRAY/GGUF_TYPE_STRING parsing functionality of
A heap-based buffer overflow vulnerability exists in the GGUF library GGUF_TYPE_ARRAY/GGUF_TYPE_STRING parsing functionality of llama.cpp Commit 18c2e17. A specially crafted .gguf file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability. CVSSv3.1 8.8 (HIGH) · EPSS 41th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2024-21802 — Ggml Llama.cpp: A heap-based buffer overflow vulnerability exists in the GGUF library info->ne functionality of llama.cpp
A heap-based buffer overflow vulnerability exists in the GGUF library info->ne functionality of llama.cpp Commit 18c2e17. A specially crafted .gguf file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability. CVSSv3.1 8.8 (HIGH) · EPSS 65th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2024-1710 — Unlimited-elements Addon_library: The Addon Library plugin for WordPress is vulnerable to unauthorized access of data due
The Addon Library plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the onAjaxAction function action in all versions up to, and including, 1.3.76. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform several unauthorized actions including uploading arbitrary files. CVSSv3.1 8.8 (HIGH) · EPSS 55th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2024-1708 — Connectwise Screenconnect: 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an
ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker the ability to execute remote code or directly impact confidential data or critical systems. CVSSv3.1 8.4 (HIGH) · EPSS 98th percentile
8.4
CVSS v3.1
100
Edit Score
CVE-2024-1512 — Stylemixthemes Masterstudy_lms: The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to union based SQL Injection via the 'user' parameter of the /lms/stm-lms/order/items REST route in all versions up to, and including, 3.2.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing q CVSSv3.1 9.8 (CRITICAL) · EPSS 100th percentile
9.8
CVSS v3.1
100
Edit Score
CVE-2024-0610 — Papaki Piraeus_bank_woocommerce_payment_gateway: The Piraeus Bank WooCommerce Payment Gateway plugin for WordPress is vulnerable to time-based blind
The Piraeus Bank WooCommerce Payment Gateway plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'MerchantReference' parameter in all versions up to, and including, 1.6.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive infor CVSSv3.1 9.8 (CRITICAL) · EPSS 70th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2023-7081 — Postahsil Online_payment_system: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in POSTAHSİL Online Payment System allows SQL Injection. This issue affects Online Payment System: before 14.02.2024. CVSSv3.1 9.8 (CRITICAL) · EPSS 22th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2023-5155 — Utarit Solipay_mobile: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Utarit Information Technologies SoliPay Mobile App allows SQL Injection. This issue affects SoliPay Mobile App: before 5.0.8. CVSSv3.1 9.8 (CRITICAL) · EPSS 20th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2023-6441 — Unipa University_information_system: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in UNI-PA University Marketing & Computer Internet Trade Inc. University Information System allows SQL Injection. This issue affects University Information System: before 12.12.2023. CVSSv3.1 9.8 (CRITICAL) · EPSS 37th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2024-25100 — Wpswings Coupon_referral_program: Deserialization of Untrusted Data vulnerability in WP Swings Coupon Referral Program coupon-referral-program allows Object
Deserialization of Untrusted Data vulnerability in WP Swings Coupon Referral Program coupon-referral-program allows Object Injection.This issue affects Coupon Referral Program: from n/a through < 1.8.4. CVSSv3.1 10.0 (CRITICAL)
10.0
CVSS v3.1
100
Edit Score
CVE-2024-0594 — Getawesomesupport Awesome_support: The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable
The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to union-based SQL Injection via the 'q' parameter of the wpas_get_users action in all versions up to, and including, 6.1.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already ex CVSSv3.1 8.8 (HIGH) · EPSS 48th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2023-6677 — Oduyo Online_collection: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Oduyo Financial Technology Online Collection allows SQL Injection. This issue affects Online Collection: before v.1.0.2. CVSSv3.1 9.8 (CRITICAL) · EPSS 20th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2023-6724 — Simgesel Hearing_tracking_system: Authorization Bypass Through User-Controlled Key vulnerability in Software Engineering Consultancy Machine Equipment Limited Company
Authorization Bypass Through User-Controlled Key vulnerability in Software Engineering Consultancy Machine Equipment Limited Company Hearing Tracking System allows Authentication Abuse. This issue affects Hearing Tracking System: before for IOS 7.0, for Android Latest release 1.0. CVSSv3.1 8.8 (HIGH) · EPSS 13th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2024-25675 — Misp-project Misp: An issue was discovered in MISP before 2.4.184.
An issue was discovered in MISP before 2.4.184. A client does not need to use POST to start an export generation process. This is related to app/Controller/JobsController.php and app/View/Events/export.ctp. CVSSv3.1 9.8 (CRITICAL) · EPSS 52th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2024-25674 — Misp-project Misp: An issue was discovered in MISP before 2.4.184.
An issue was discovered in MISP before 2.4.184. Organisation logo upload is insecure because of a lack of checks for the file extension and MIME type. CVSSv3.1 9.8 (CRITICAL) · EPSS 51th percentile
9.8
CVSS v3.1
99
Edit Score