Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-24 03:33Z
2024-11-04
2024-11-04 12:16Z
CRIT

CVE-2024-10035 — Bg-tek Coslat: Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-10035

Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in a Command ('Command Injection'), Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in BG-TEK Informatics Security Technologies CoslatV3 allows Command Injection, Privilege Escalation. This issue affects CoslatV3: through 3.1069. NOTE: The vendor was contacted and it was learned that the product is not suppo CVSSv3.1 9.8 (CRITICAL) · EPSS 78th percentile

CWECWE 94CWECWE 77CWECWE 78VNDBg TekTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-11-04
2024-11-04 11:15Z
CRIT

CVE-2024-51661 — Davidlingren Media_library_assistant: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-51661

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Command Injection.This issue affects Media LIbrary Assistant: from n/a through <= 3.19. CVSSv3.1 9.1 (CRITICAL)

CWECWE 78VNDDavidlingrenTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2024-10-31
2024-10-31 19:15Z
CRIT

CVE-2024-51065 — Phpgurukul Beauty_parlour_management_system: Beauty Parlour Management System v1.1 is vulnerable to SQL Injection in admin/index.php via

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-51065

Phpgurukul Beauty Parlour Management System v1.1 is vulnerable to SQL Injection in admin/index.php via the the username parameter. CVSSv3.1 9.8 (CRITICAL) · EPSS 40th percentile

CWECWE 89VNDPhpgurukulTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-10-31
2024-10-31 19:15Z
CRIT

CVE-2024-51064 — Phpgurukul Teachers_record_management_system: Teachers Record Management System v2.1 is vulnerable to SQL Injection via the tid

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-51064

Phpgurukul Teachers Record Management System v2.1 is vulnerable to SQL Injection via the tid parameter to admin/queries.php. CVSSv3.1 9.8 (CRITICAL) · EPSS 43th percentile

CWECWE 89VNDPhpgurukulTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-10-31
2024-10-31 19:15Z
CRIT

CVE-2024-51063 — Phpgurukul Teachers_record_management_system: Teachers Record Management System v2.1 is vulnerable to SQL Injection in add-teacher.php via

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-51063

Phpgurukul Teachers Record Management System v2.1 is vulnerable to SQL Injection in add-teacher.php via the mobile number or email parameter. CVSSv3.1 9.1 (CRITICAL) · EPSS 39th percentile

CWECWE 89VNDPhpgurukulTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2024-10-31
2024-10-31 19:15Z
CRIT

CVE-2024-51060 — Projectworlds Online_admission_system: Online Admission System v1 is vulnerable to SQL Injection in index.php via the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-51060

Projectworlds Online Admission System v1 is vulnerable to SQL Injection in index.php via the 'a_id' parameter. CVSSv3.1 9.1 (CRITICAL) · EPSS 37th percentile

CWECWE 89VNDProjectworldsTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2024-10-31
2024-10-31 10:15Z
CRIT

CVE-2024-49674 — Site: Cross-Site Request Forgery (CSRF) vulnerability in lukashuser EKC Tournament Manager ekc-tournament-manager allows Upload a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-49674

Cross-Site Request Forgery (CSRF) vulnerability in lukashuser EKC Tournament Manager ekc-tournament-manager allows Upload a Web Shell to a Web Server.This issue affects EKC Tournament Manager: from n/a through <= 2.2.1. CVSSv3.1 9.6 (CRITICAL)

CWECWE 352TYPVulnerability
9.6
CVSS v3.1
98
Edit Score
728 × 90 / responsive · programmatic ad slot
2024-10-31
2024-10-31 05:15Z
HIGH

CVE-2024-21537 — Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-21537

Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eval in the dynamicImport function. An attacker can exploit this vulnerability by passing a malicious input through the defaultLoaders function. CVSSv3.1 8.8 (HIGH) · EPSS 61th percentile

CWECWE 94TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-10-30
2024-10-30 21:15Z
HIGH

CVE-2024-48734 — Unrestricted file upload in /SASStudio/SASStudio/sasexec/{sessionID}/{InternalPath} in SAS Studio 9.4 allows remote attacker to upload

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-48734

Unrestricted file upload in /SASStudio/SASStudio/sasexec/{sessionID}/{InternalPath} in SAS Studio 9.4 allows remote attacker to upload malicious files. NOTE: this is disputed by the vendor because file upload is allowed for authorized users. CVSSv3.1 8.8 (HIGH) · EPSS 45th percentile

CWECWE 434TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-10-30
2024-10-30 21:15Z
HIGH

CVE-2024-48733 — SQL: injection vulnerability in /SASStudio/sasexec/sessions/{sessionID}/sql in SAS Studio 9.4 allows remote attacker to execute

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-48733

SQL injection vulnerability in /SASStudio/sasexec/sessions/{sessionID}/sql in SAS Studio 9.4 allows remote attacker to execute arbitrary SQL commands via the POST body request. NOTE: this is disputed by the vendor because SQL statement execution is allowed for authorized users. CVSSv3.1 8.8 (HIGH) · EPSS 49th percentile

CWECWE 89TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-10-30
2024-10-30 08:15Z
CRIT

CVE-2024-50511 — Upload: Unrestricted Upload of File with Dangerous Type vulnerability in donimedia WP donimedia carousel wp-donimedia-carousel

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-50511

Unrestricted Upload of File with Dangerous Type vulnerability in donimedia WP donimedia carousel wp-donimedia-carousel allows Upload a Web Shell to a Web Server.This issue affects WP donimedia carousel: from n/a through <= 1.0.1. CVSSv3.1 9.9 (CRITICAL)

CWECWE 434TYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2024-10-30
2024-10-30 08:15Z
CRIT

CVE-2024-50510 — Upload: Unrestricted Upload of File with Dangerous Type vulnerability in webandprint AR For Woocommerce ar-for-woocommerce

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-50510

Unrestricted Upload of File with Dangerous Type vulnerability in webandprint AR For Woocommerce ar-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects AR For Woocommerce: from n/a through <= 6.3. CVSSv3.1 10.0 (CRITICAL)

CWECWE 434TYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2024-10-30
2024-10-30 08:15Z
HIGH

CVE-2024-50509 — Limitation: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Chetan

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-50509

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Chetan Khandla Woocommerce Product Design woo-product-design allows Path Traversal.This issue affects Woocommerce Product Design: from n/a through <= 1.0.0. CVSSv3.1 8.6 (HIGH)

CWECWE 22TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2024-10-30
2024-10-30 08:15Z
CRIT

CVE-2024-50507 — Deserialization: of Untrusted Data vulnerability in Daschmi DS.DownloadList dsdownloadlist allows Object Injection.This issue affects

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-50507

Deserialization of Untrusted Data vulnerability in Daschmi DS.DownloadList dsdownloadlist allows Object Injection.This issue affects DS.DownloadList: from n/a through <= 1.3. CVSSv3.1 9.8 (CRITICAL)

CWECWE 502TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-10-30
2024-10-30 08:15Z
HIGH

CVE-2024-50506 — Incorrect: Privilege Assignment vulnerability in azexo Marketing Automation by AZEXO marketing-automation-by-azexo allows Privilege Escalation.This

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-50506

Incorrect Privilege Assignment vulnerability in azexo Marketing Automation by AZEXO marketing-automation-by-azexo allows Privilege Escalation.This issue affects Marketing Automation by AZEXO: from n/a through <= 1.27.80. CVSSv3.1 8.8 (HIGH)

CWECWE 266TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-10-30
2024-10-30 08:15Z
HIGH

CVE-2024-50504 — Incorrect: Privilege Assignment vulnerability in webxmedia Bulk Change Role bulk-role-change allows Privilege Escalation.This issue

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-50504

Incorrect Privilege Assignment vulnerability in webxmedia Bulk Change Role bulk-role-change allows Privilege Escalation.This issue affects Bulk Change Role: from n/a through <= 1.1. CVSSv3.1 8.8 (HIGH)

CWECWE 266TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-10-30
2024-10-30 08:15Z
CRIT

CVE-2024-50503 — Authentication: Bypass Using an Alternate Path or Channel vulnerability in Deryck User Toolkit user-toolkit

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-50503

Authentication Bypass Using an Alternate Path or Channel vulnerability in Deryck User Toolkit user-toolkit allows Authentication Bypass.This issue affects User Toolkit: from n/a through <= 1.2.3. CVSSv3.1 9.8 (CRITICAL)

CWECWE 288TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-10-29
2024-10-29 23:15Z
CRIT

CVE-2024-51567 — Cyberpanel Cyberpanel: upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-51567in the wild

upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected. CVSSv3.1 10.0 (CRITICAL) · EPSS 100th percentile

CWECWE 306VNDCyberpanelTYPVulnerabilitySTAitw exploited
10.0
CVSS v3.1
100
Edit Score
2024-10-29
2024-10-29 23:15Z
CRIT

CVE-2024-51378 — Cyberpanel Cyberpanel: getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-51378

getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected. CVSSv3.1 10.0 (CRITICAL)

CWECWE 78VNDCyberpanelTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2024-10-29
2024-10-29 17:15Z
HIGH

CVE-2024-9990 — Odude Crypto_tool: The Crypto plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-9990

The Crypto plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.15. This is due to missing nonce validation in the 'crypto_connect_ajax_process::check' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVSSv3.1 8.8 (HIGH)

CWECWE 352VNDOdudeVNDCryptoTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-10-29
2024-10-29 17:15Z
CRIT

CVE-2024-9989 — Odude Crypto_tool: The Crypto plugin for WordPress is vulnerable to authentication bypass in versions up to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-9989

The Crypto plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.18. This is due to a limited arbitrary method call to 'crypto_connect_ajax_process::log_in' function in the 'crypto_connect_ajax_process' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username. CVSSv3.1 9.8 (CRITICAL)

CWECWE 288VNDOdudeVNDCryptoTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-10-29
2024-10-29 17:15Z
CRIT

CVE-2024-9988 — Odude Crypto_tool: The Crypto plugin for WordPress is vulnerable to authentication bypass in versions up to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-9988

The Crypto plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.19. This is due to missing validation on the user being supplied in the 'crypto_connect_ajax_process::register' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username. CVSSv3.1 9.8 (CRITICAL)

CWECWE 288VNDOdudeVNDCryptoTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-10-29
2024-10-29 10:15Z
HIGH

CVE-2024-50550 — Litespeedtech Litespeed_cache: Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Privilege Escalation.This issue

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-50550

Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Privilege Escalation.This issue affects LiteSpeed Cache: from n/a through <= 6.5.1. CVSSv3.1 8.1 (HIGH)

CWECWE 266CWECWE 326VNDLitespeedtechTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2024-10-29
2024-10-29 09:15Z
CRIT

CVE-2024-50490 — Authorization: Missing Authorization vulnerability in lowcage PegaPoll pegapoll allows Accessing Functionality Not Properly Constrained by

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-50490

Missing Authorization vulnerability in lowcage PegaPoll pegapoll allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects PegaPoll: from n/a through <= 1.0.2. CVSSv3.1 9.8 (CRITICAL)

CWECWE 862TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-10-29
2024-10-29 09:15Z
CRIT

CVE-2024-50485 — Incorrect: Privilege Assignment vulnerability in Udit Rawat Exam Matrix exam-matrix allows Privilege Escalation.This issue

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-50485

Incorrect Privilege Assignment vulnerability in Udit Rawat Exam Matrix exam-matrix allows Privilege Escalation.This issue affects Exam Matrix: from n/a through <= 1.5. CVSSv3.1 9.8 (CRITICAL)

CWECWE 266TYPVulnerability
9.8
CVSS v3.1
99
Edit Score