WordPress Pretty Grid – Social Feed Gallery Plugin plugin < 1.0.8 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Pretty Grid – Social Feed Gallery Plugin plugin versions 1.0.8. Solution Update the WordPress Pretty Grid – Social Feed Gallery Plugin plugin to the latest available version at least 1.0.8...

WordPress Easy Tiktok Feed plugin <= 1.1.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Easy Tiktok Feed plugin versions = 1.1.0. Solution Update the WordPress Easy Tiktok Feed plugin to the latest available version at least 1.1.1...

WordPress Drip Feed Content Extended for Learndash plugin <= 1.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Drip Feed Content Extended for Learndash plugin versions = 1.1. Solution No patched version available...

WordPress Easy Social Feed plugin <= 6.3.3 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Easy Social Feed plugin versions = 6.3.3. Solution Update the WordPress Easy Social Feed plugin to the latest available version at least 6.3.4...

WordPress Embed Tik Tok Video Feed (Tiktok feed) for WordPress plugin <= 1.0.3 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Embed Tik Tok Video Feed Tiktok feed for WordPress plugin versions = 1.0.3. Solution No patched version available...

ruby: HTTP response splitting in WEBrick

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients...

A flaw was found in Python specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1 3.9.5 3.8.11 3.7.11 and 3.6.14.

...

CVE-2022-0609

creationtimestamp| type| source ---|---|--- 2022-02-15 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=740 2022-02-15 09:13:49+00:00| exploited| https://t.me/truesecator/2628 2022-02-15 09:14:28+00:00| exploited| https://t.me/NeKaspersky/1810 2022-02-15 19:47:37+00:00|...

CVE-2022-24682

creationtimestamp| type| source ---|---|--- 2022-02-09 07:12:32+00:00| exploited| https://t.me/cibsecurity/37046 2023-06-14 21:10:04+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2024-12-24 20:26:45+00:00| seen| https://feedsin.space/feed/CISAKevBot/items/2971267 2025-01-30 01:12:15+00:0...

CVE-2022-20699

creationtimestamp| type| source ---|---|--- 2022-02-04 11:26:32+00:00| published-proof-of-concept| https://t.me/truesecator/2591 2022-02-05 15:10:07+00:00| published-proof-of-concept| https://t.me/NeKaspersky/1769 2022-02-10 20:17:11+00:00| seen| https://t.me/cibsecurity/37236 2022-02-11...

CVE-2022-20701

creationtimestamp| type| source ---|---|--- 2022-02-04 11:26:32+00:00| published-proof-of-concept| https://t.me/truesecator/2591 2022-02-05 15:10:07+00:00| published-proof-of-concept| https://t.me/NeKaspersky/1769 2022-02-10 20:16:59+00:00| seen| https://t.me/cibsecurity/37229 2023-06-14...

CVE-2022-20708

creationtimestamp| type| source ---|---|--- 2022-02-04 11:26:32+00:00| published-proof-of-concept| https://t.me/truesecator/2591 2022-02-05 15:10:07+00:00| published-proof-of-concept| https://t.me/NeKaspersky/1769 2022-02-10 20:17:10+00:00| seen| https://t.me/cibsecurity/37235 2022-04-05...

Product Feed PRO for WooCommerce < 11.2.3 - Reflected Cross-Site Scripting

The plugin does not escape the rowCount parameter before outputting it back in an attribute via the wooseacategoriesdropdown AJAX action available to any authenticated user, leading to a Reflected Cross-Site Scripting PoC...

Product Feed PRO for WooCommerce < 11.2.3 - Reflected Cross-Site Scripting

The plugin does not escape the rowCount parameter before outputting it back in an attribute via the wooseacategoriesdropdown AJAX action available to any authenticated user, leading to a Reflected Cross-Site Scripting...

WordPress Product Feed PRO for WooCommerce plugin <= 11.2.1 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered in WordPress Product Feed PRO for WooCommerce plugin versions = 11.2.1. Solution Update the WordPress Product Feed PRO for WooCommerce plugin to the latest available version at least 11.2.2...

Oracle prices could be not fresh

Handle 0x1f8b Vulnerability details Impact Unsafe oracle call. Proof of Concept The contract Cvx3CrvOracle doesn't check that the data is fress, it call the method latestRoundData, this method allow you to run some extra validations, but these validations were not made. According to the chain.lin...

CVE-2021-22600

creationtimestamp| type| source ---|---|--- 2022-01-26 16:19:36+00:00| seen| https://t.me/cibsecurity/36304 2022-05-05 21:09:50+00:00| exploited| https://t.me/cKure/9471 2022-05-06 11:37:55+00:00| exploited| https://t.me/truesecator/2920 2022-05-06 13:39:38+00:00| exploited|...

WordPress Product Feed PRO for WooCommerce plugin cross-site request forgery vulnerability

WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The platform supports setting up personal blogging sites on servers with PHP and MySQL. cross-site request forgery vulnerability exists in versions prior to 11.0.7 of the Product Feed PRO for...

CVE-2021-24974

The Product Feed PRO for WooCommerce WordPress plugin before 11.0.7 does not have authorisation and CSRF check in some of its AJAX actions, allowing any authenticated users to call then, which could lead to Stored Cross-Site Scripting issue which will be triggered in the admin dashboard due to th...

CVE-2021-24974

The Product Feed PRO for WooCommerce WordPress plugin before 11.0.7 does not have authorisation and CSRF check in some of its AJAX actions, allowing any authenticated users to call then, which could lead to Stored Cross-Site Scripting issue which will be triggered in the admin dashboard due to th...