Threat database

An attacker who successfully exploited these vulnerabilities could cause enable command execution. A vulnerability exists in the AC500 V3 version mentioned. After successfully exploiting CVE-2024-12429 (directory traversal), a successfully authenticated attacker can inject arbitrary commands into a specifically crafted file, which then will be executed by root user. All AC500 V3 products (PM5xxx) with firmware version earlier than 3.8.0 are affected by this vulnerability.

EPSS 0.3%VulnerabilityABB#cwe-280Germany+7

The Shine PDF Embeder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shinepdf' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Cross-Site Request Forgery (CSRF) vulnerability in GabbyKhrmon Wsify Widget wsify-widget allows Stored XSS.This issue affects Wsify Widget: from n/a through <= 1.0.

The cause of vulnerability is improper validation of form input field “Name” on Graph page in Items section.

EPSS 0.7%Vulnerability#cwe-20Germany+8

CVE-2022-23131 is a high-severity vulnerability in the Zabbix Frontend that allows authentication bypass due to unsafe client-side session storage when SAML is configured. This flaw can lead to unauthorized access or takeover of the Zabbix instance. Exploitation of this vulnerability has been observed in the wild.

CVE-2022-23134 is a high-severity vulnerability in the Zabbix Frontend that allows malicious actors to bypass step checks and potentially modify the frontend configuration. This improper access control issue has been exploited in the wild. No specific affected versions or patch information is provided.