CVE-2024-22636: Undefined Security Weakness

PluXml Blog v5.8.9 was discovered to contain a remote code execution RCE vulnerability in the Static Pages feature. This vulnerability is exploited via injecting a crafted payload into the Content field...

PT-2024-19512 · Unknown · Pluxml Blog

Name of the Vulnerable Software and Affected Versions: PluXml Blog version 5.8.9 Description: The issue is related to a remote code execution RCE vulnerability in the Static Pages feature of PluXml Blog. This vulnerability can be exploited by injecting a crafted payload into the Content field...

CVE-2024-22636

PluXml Blog v5.8.9 was discovered to contain a remote code execution RCE vulnerability in the Static Pages feature. This vulnerability is exploited via injecting a crafted payload into the Content field...

CVE-2024-22636

Removed by vendor...

CVE-2024-22636

PluXml Blog v5.8.9 was discovered to contain a remote code execution RCE vulnerability in the Static Pages feature. This vulnerability is exploited via injecting a crafted payload into the Content field...

PluXml Security Vulnerability

PluXml is a free and open source content management system that does not require a database to work. A security vulnerability exists in PluXml Blog version v5.8.9, which stems from a remote code execution vulnerability contained in a static page that can be used to execute remote code by injectin...

Path Traversal

@hono/node-server is vulnerable to Path Traversal. The vulnerability is due to improper url string validation in src/request.ts, allowing an attacker to use .. in the request URL to access arbitrary files on the static server...

Content-Security-Policy protection for user content disabled by redhat-dependency-analytics

Jenkins sets the Content-Security-Policy header to static files served by Jenkins specifically DirectoryBrowserSupport, such as workspaces, /userContent, or archived artifacts, unless a Resource Root URL is specified. redhat-dependency-analytics 0.7.1 and earlier globally disables the...

CVE-2023-49256

It is possible to download the configuration backup without authorization and decrypt included passwords using hardcoded static key...

Authorization

It is possible to download the configuration backup without authorization and decrypt included passwords using hardcoded static key...

CVE-2023-49256 Predictable encryption passphrase used in publicly accessible configuration file

It is possible to download the configuration backup without authorization and decrypt included passwords using hardcoded static key...

CVE-2023-49256

CVE-2023-49256 allows unauthenticated retrieval of a device’s configuration backup and decryption of passwords, using a hardcoded static key. Red Hat’s linked entries reiterate the issue and describe the root cause as hardcoded credentials embedded in the device, enabling confidentiality impact (...

CVE-2023-49256 Predictable encryption passphrase used in publicly accessible configuration file

It is possible to download the configuration backup without authorization and decrypt included passwords using hardcoded static key...

CVE-2023-51984

D-Link DIR-822+ V1.0.2 was found to contain a command injection in SetStaticRouteSettings function. allows remote attackers to execute arbitrary commands via shell...

CVE-2023-6369

The Export WP Page to Static HTML/CSS plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on multiple AJAX actions in all versions up to, and including, 2.1.9. This makes it possible for authenticated attackers, with...

WordPress Plugin Export WP Page to Static HTML/CSS Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

CVE-2023-6369: Missing Authorization

The Export WP Page to Static HTML/CSS plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on multiple AJAX actions in all versions up to, and including, 2.1.9. This makes it possible for authenticated attackers, with...

CVE-2023-6750

The Clone WordPress plugin before 2.4.3 uses buffer files to store in-progress backup informations, which is stored at a publicly accessible, statically defined file path...

Path Traversal

iodine is vulnerable to Path Traversal . The vulnerability is due to improper validation or URL's allowrf to manipulate the static file server. This issue can be exploited by an attacker to read files outside the public folder via a malicious URL...

PluXml Blog 5.8.9 Remote Code Execution Vulnerability

Exploit Title: PluXml Blog Version : 5.8.9 - Remote Code Execution Authenticated Exploit Author: tmrswrr Category: Webapps Vendor Homepage: https://pluxml.org/ Version : 5.8.9 Tested on: https://www.softaculous.com/apps/cms/PluXml 1 After login Click Static pages Edit Write in content your payloa...