CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37268 – WordPress Striking theme <= 2.3.4 - Local File Inclusion vulnerability
https://notcve.org/view.php?id=CVE-2024-37268
This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. • https://patchstack.com/database/vulnerability/striking-r/wordpress-striking-theme-2-3-4-local-file-inclusion-vulnerability?_s_id=cve • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2024-29176
https://notcve.org/view.php?id=CVE-2024-29176
A remote low privileged attacker could potentially exploit this vulnerability, leading to an application crash or execution of arbitrary code on the vulnerable application's underlying operating system with privileges of the vulnerable application. • https://www.dell.com/support/kbdoc/en-us/000226148/dsa-2024-219-dell-technologies-powerprotect-dd-security-update-for-multiple-security-vulnerabilities • CWE-788: Access of Memory Location After End of Buffer •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-6054 – Auto Featured Image <= 1.2 - Authenticated (Contributor+) Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2024-6054
This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible. • https://plugins.trac.wordpress.org/browser/auto-featured-image/tags/1.2/auto-featured-image.php#L167 https://www.wordfence.com/threat-intel/vulnerabilities/id/4d1512c2-75c1-405b-8bb4-f42ec69159a7?source=cve • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-5762 – Zen Cart findPluginAdminPage Local File Inclusion Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-5762
Zen Cart findPluginAdminPage Local File Inclusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Zen Cart. ... An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the service account. ... This vulnerability allows remote attackers to execute arbitrary code on affected installations of Zen Cart. ... An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the service account. • https://docs.zen-cart.com/release/whatsnew_2.0.0 https://www.zerodayinitiative.com/advisories/ZDI-24-883 • CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') •
CVSS: 6.3EPSS: 0%CPEs: -EXPL: 0CVE-2023-26877
https://notcve.org/view.php?id=CVE-2023-26877
File upload vulnerability found in Softexpert Excellence Suite v.2.1 allows attackers to execute arbitrary code via a .php file upload to the form/efms_exec_html/file_upload_parser.php endpoint. • https://gist.github.com/rodnt/90ac26fdf891e602f6f090d6aebce32d • CWE-94: Improper Control of Generation of Code ('Code Injection') •