5.1
CVE-2024-7900 - xiaohe4966 TpMeCMS Basic Configuration config cross site scripting
A vulnerability, which was classified as problematic, was found in xiaohe4966 TpMeCMS 1.3.3.2. Affected is an unknown function of the file /h.php/general/config?ref=addtabs of the component Basic Configuration Handler. The manipulation of the argument Site Name/Beian/Contact address/copyright/technโฆ
5.1
CVE-2024-7899 - InnoCMS Backend edit code injection
A vulnerability, which was classified as critical, has been found in InnoCMS 0.3.1. This issue affects some unknown processing of the file /panel/pages/1/edit of the component Backend. The manipulation leads to code injection. The attack may be initiated remotely. The exploit has been disclosed to โฆ
6.9
CVE-2024-7898 - Tosei Online Store Management System ใใใๅบ่็ฎก็ใทในใใ Backend default credentials
A vulnerability classified as critical was found in Tosei Online Store Management System ใใใๅบ่็ฎก็ใทในใใ 4.02/4.03/4.04. This vulnerability affects unknown code of the component Backend. The manipulation leads to use of default credentials. The attack can be initiated remotely. The exploit has been disโฆ
5.3
CVE-2024-7897 - Tosei Online Store Management System ใใใๅบ่็ฎก็ใทในใใ tosei_kikai.php command injection
A vulnerability classified as critical has been found in Tosei Online Store Management System ใใใๅบ่็ฎก็ใทในใใ 4.02/4.03/4.04. This affects an unknown part of the file /cgi-bin/tosei_kikai.php. The manipulation of the argument kikaibangou leads to command injection. It is possible to initiate the attackโฆ
5.3
CVE-2024-7896 - Tosei Online Store Management System ใใใๅบ่็ฎก็ใทในใใ p1_ftpserver.php command injection
A vulnerability was found in Tosei Online Store Management System ใใใๅบ่็ฎก็ใทในใใ 4.02/4.03/4.04. It has been rated as critical. Affected by this issue is some unknown functionality of the file /cgi-bin/p1_ftpserver.php. The manipulation of the argument adr_txt leads to command injection. The attack maโฆ
6.4
CVE-2024-7703 - ARMember โ Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0โฆ
The ARMember โ Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.0.37 due to insufficient input sanitization and output escaping. This makesโฆ
7.2
CVE-2023-3416 - tagDiv Opt-In Builder <= 1.4.4 - Authenticated (Admin+) SQL Injection
The tagDiv Opt-In Builder plugin is vulnerable to Blind SQL Injection via the 'subscriptionCouponId' parameter via the 'create_stripe_subscription' REST API endpoint in versions up to, and including, 1.4.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparatioโฆ
8.1
CVE-2023-0714 - Metform Elementor Contact Form Builder <= 3.2.4 - Unauthenticated Double-Extension Arbitrary File Uโฆ
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in versions up to, and including, 3.2.4. This allows unauthenticated visitors to perform a "double extension" attack and upload files containing a malicious extenโฆ
7.2
CVE-2023-3419 - tagDiv Opt-In Builder <= 1.4.4 - Authenticated (Admin+) SQL Injection
The tagDiv Opt-In Builder plugin is vulnerable to Blind SQL Injection via the 'couponId' parameter of the 'recreate_stripe_subscription' REST API endpoint in versions up to, and including, 1.4.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the exโฆ
5.1
CVE-2024-7887 - LimeSurvey File Upload index.php denial of service
A vulnerability was found in LimeSurvey 6.3.0-231016 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php of the component File Upload. The manipulation of the argument size leads to denial of service. The attack may be launched remotely. The exโฆ