CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-54373 – WordPress EduAdmin Booking plugin <= 5.2.0 - Local File Inclusion vulnerability
https://notcve.org/view.php?id=CVE-2024-54373
11 Dec 2024 — This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. • https://patchstack.com/database/wordpress/plugin/eduadmin-booking/vulnerability/wordpress-eduadmin-booking-plugin-5-2-0-local-file-inclusion-vulnerability?_s_id=cve • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-54375 – WordPress Woolook plugin <= 1.7.0 - Local File Inclusion vulnerability
https://notcve.org/view.php?id=CVE-2024-54375
11 Dec 2024 — This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. • https://patchstack.com/database/wordpress/plugin/woolook/vulnerability/wordpress-woolook-plugin-1-7-0-local-file-inclusion-vulnerability?_s_id=cve • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-54376 – WordPress EazyDocs plugin <= 2.5.5 - Local File Inclusion vulnerability
https://notcve.org/view.php?id=CVE-2024-54376
11 Dec 2024 — Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Spider-themes EazyDocs.This issue affects EazyDocs: from n/a through 2.5.5. ... This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve ... • https://patchstack.com/database/wordpress/plugin/eazydocs/vulnerability/wordpress-eazydocs-plugin-2-5-4-local-file-inclusion-vulnerability?_s_id=cve • CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-54380 – WordPress WP Cookies Enabler plugin <= 1.0.1 - Local File Inclusion vulnerability
https://notcve.org/view.php?id=CVE-2024-54380
11 Dec 2024 — This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. • https://patchstack.com/database/wordpress/plugin/wp-cookies-enabler/vulnerability/wordpress-wp-cookies-enabler-plugin-1-0-1-local-file-inclusion-vulnerability?_s_id=cve • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-54270 – WordPress Axeptio plugin <= 2.5.3 - Local File Inclusion vulnerability
https://notcve.org/view.php?id=CVE-2024-54270
11 Dec 2024 — Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axeptio Axeptio allows PHP Local File Inclusion.This issue affects Axeptio: from n/a through 2.5.3. ... This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code executi... • https://patchstack.com/database/wordpress/plugin/axeptio-sdk-integration/vulnerability/wordpress-axeptio-plugin-2-5-1-local-file-inclusion-vulnerability?_s_id=cve • CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-11947 – GFI Archiver Core Service Deserialization of Untrusted Data Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-11947
11 Dec 2024 — GFI Archiver Core Service Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. ... An attacker can leverage this vulnerability to execute code in the context of SYSTEM. An attacke... • https://www.zerodayinitiative.com/advisories/ZDI-24-1670 • CWE-502: Deserialization of Untrusted Data •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-11948 – GFI Archiver Telerik Web UI Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-11948
11 Dec 2024 — GFI Archiver Telerik Web UI Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. ... An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE. An attacker can leverage this vul... • https://www.zerodayinitiative.com/advisories/ZDI-24-1671 • CWE-1395: Dependency on Vulnerable Third-Party Component •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-11949 – GFI Archiver Store Service Deserialization of Untrusted Data Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-11949
11 Dec 2024 — GFI Archiver Store Service Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. ... An attacker can leverage this vulnerability to execute code in the context of SYSTEM. An attack... • https://www.zerodayinitiative.com/advisories/ZDI-24-1672 • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.8EPSS: 0%CPEs: -EXPL: 0CVE-2024-12547 – Tungsten Automation Power PDF JPF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-12547
11 Dec 2024 — This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tungsten Automation Power PDF. ... An attacker can leverage this vulnerability to execute code in the context of the current process. •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 3CVE-2024-10124 – Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce <= 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation
https://notcve.org/view.php?id=CVE-2024-10124
11 Dec 2024 — This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated. • https://packetstorm.news/files/id/183151 • CWE-284: Improper Access Control •