2208 matches found
CVE-2023-48319
CVE-2023-48319 affects the WordPress plugin Salon booking system (salon-booking-system) up to version 8.6. It is an Improper Privilege Management vulnerability that enables Privilege Escalation for users with Editor-level access, potentially granting Administrator privileges. The issue is fixed i...
CVE-2023-47682
CVE-2023-47682 affects the WordPress WP User Frontend plugin (versions ≤3.6.5). The issue is improper privilege management that allows authenticated users (author level and above) to escalate privileges, potentially enabling admin-level access via the registration_form function. The vulnerability...
CVE-2023-47178
CVE-2023-47178 describes an unauthenticated Local File Inclusion (path traversal) vulnerability in The Plus Addons for Elementor Pro. Affected versions are up to and including 5.2.8 (the patch to fix is 5.2.9). The issue arises from improper limitation of a pathname to a restricted directory, ena...
CVE-2023-46784
CVE-2023-46784 affects WordPress ICS Calendar plugin
CVE-2023-46205
CVE-2023-46205 : Local File Inclusion in the WordPress plugin Ultimate Addons for WPBakery Page Builder. Affected versions: up to 3.19.14. Root cause: improper limitation of a pathname to restricted directories (path traversal) leading to PHP Local File Inclusion. Impact (per CVE metrics): potent...
CVE-2023-46197
CVE-2023-46197: Path traversal vulnerability in Popup by Supsystic (WordPress plugin) allowing relative path traversal in versions up to 1.10.19. Exploitation path observed via getWpCsvList; unauthenticated access possible per Patchstack documenting arbitrary file download risk. Affected: Popup b...
CVE-2024-25595
CVE-2024-25595 describes an Authentication Bypass by Spoofing in the Defender Security plugin for WordPress by WPMU DEV. Affected versions are Defender Security up to 4.4.1, with the underlying issue allowing an unauthenticated bypass of IP-based or functional protections, effectively enabling a ...
CVE-2023-41956
The CVE-2023-41956 entry concerns WordPress Simple Membership (smp7) with an Improper Authentication flaw that allowed an authenticated user to takeover accounts via the password reset flow. Affected versions are Simple Membership up to 4.3.4; patched in 4.3.5. Reports from NVD/Red Hat/Wordfence ...
CVE-2023-41954
ProfilePress WordPress plugin
CVE-2023-41665
CVE-2023-41665 is a WordPress GiveWP plugin vulnerability: Privilege Escalation due to improper/insufficient privilege checks for updating default roles, enabling an authenticated Give Manager to elevate privileges up to administrator. Affected versions: GiveWP
CVE-2023-41243
CVE-2023-41243 affects the WordPress plugin WPvivid Backup and Migration (Migration, Backup, Staging) and is caused by improper privilege management enabling privilege escalation. Affected versions are
CVE-2023-38399
CVE-2023-38399 concerns a Local File Inclusion (path traversal) in WordPress plugin Phlox Portfolio by Averta. The vulnerability affects Phlox Portfolio versions up to 2.3.1 and is exploitable without authentication due to improper limitation of a pathname to a restricted directory. Patchstack an...
CVE-2023-25050
CVE-2023-25050 affects WordPress Shortcodes Ultimate (versions n/a through 5.12.6). The vulnerability is an Improper Limitation of a Pathname to a Restricted Directory (path traversal) that enables Absolute Path Traversal. Public sources (Patchstack; CVE records; Red Hat advisory) confirm the iss...
CVE-2022-45374
CVE-2022-45374 (YARPP for WordPress) : Local File Inclusion due to improper path handling in YARPP
CVE-2022-44581
CVE-2022-44581 affects the WordPress Defender Security plugin (WPMU DEV Defender Security) with versions up to 3.3.2. Multiple connected sources describe insecure storage of sensitive information and note that screen temporary files may expose sensitive data. Patchstack frames the issue as Broken...
CVE-2024-33861
Qt6-base is affected (CVE-2024-33861) due to an invalid pointer passed as a callback in QStringConverter, which could lead to stack modification and bypass of security restrictions. Multiple advisories (e.g., OSV/GLSA) reference fixes in qt6-base; remediation is to upgrade to the patched Qt6-base...
The vulnerability of the Linux operating system’s Intel Hardware Feedback Interface driver allows attackers to compromise the integrity and accessibility of protected information.
The vulnerability of the Intel Hardware Feedback Interface driver in the drivers/thermal/intel/intelhfi.c file of the Linux kernel is related to the improper use of a reserved buffer after resuming from sleep mode. Exploiting this vulnerability could allow an attacker to compromise the integrity...
The vulnerability of the btrfs_get_root_ref() function in the fs/btrfs/disk-io.c file of the Linux kernel’s file system allows a hacker to cause a service failure.
The vulnerability of the btrfsgetrootref function in the fs/btrfs/disk-io.c file of the Linux kernel’s file system is related to the repeated release of a reserved memory block. Exploiting this vulnerability could allow an attacker to cause a service failure...
