CVE-2024-5204

The Swiss Toolkit For WP plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.0.7. This is due to the plugin storing custom data in post metadata without an underscore prefix. This makes it possible for authenticated attackers with contributor-level and...

PT-2024-35100 · WordPress · Swiss Toolkit For Wp

Name of the Vulnerable Software and Affected Versions: Swiss Toolkit For WP plugin for WordPress versions up to, and including, 1.0.7 Description: The issue allows authenticated attackers with contributor-level and above permissions to bypass authentication and log in as any existing user on the...

WordPress Swiss Toolkit For WP Plugin <= 1.0.7 is vulnerable to Broken Authentication

Software Swiss Toolkit For WP Type Plugin Vulnerable versions = 1.0.7 Fixed in 1.0.8 OWASP Top 10 A2: Broken Authentication Classification Broken Authentication CVE CVE-2024-5204 Patch priority Medium CVSS severity Medium 8.8 Developer Claim ownership PSID 07e08699642a Credits István Márton...

PT-2024-25441 · Extend Themes · Extend Themes Colibri Wp +6

Name of the Vulnerable Software and Affected Versions: Extend Themes Pathway versions 1.0.15 and earlier Extend Themes Hugo WP versions 1.0.8 and earlier Extend Themes Althea WP versions 1.0.13 and earlier Extend Themes Elevate WP versions 1.0.15 and earlier Extend Themes Brite versions 1.0.11 an...

WordPress Vertice theme <= 1.0.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Theme Vertice versions = 1.0.7...

CVE-2024-32597

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Xylus Themes WordPress Importer allows Stored XSS.This issue affects WordPress Importer: from n/a through 1.0.7...

WordPress Plugin Fixed HTML Toolbar 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2024-24660 · Web357 · Web357 Fixed Html Toolbar

Name of the Vulnerable Software and Affected Versions: Web357 Fixed HTML Toolbar versions 1.0.7 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can inject...

WordPress Fixed HTML Toolbar plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Savphill Patchstack Alliance in WordPress Plugin Fixed HTML Toolbar versions = 1.0.7...

CVE-2024-31938

CVE-2024-31938 is a CSRF issue affecting Themeinwp NewsXpress (NewsXpress) up to version 1.0.7. The connected Red Hat entry reiterates the CSRF description without enabling concrete exploit or remediation details in the provided documents. No public patch/version fix is listed here; monitor for o...

WordPress Dashboard Welcome for Elementor plugin <= 1.0.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin Dashboard Welcome for Elementor versions = 1.0.7...

WordPress NewsXpress theme <= 1.0.7 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Theme NewsXpress versions = 1.0.7...

WordPress NewsXpress Theme <= 1.0.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software NewsXpress Type Theme Vulnerable versions = 1.0.7 Fixed in 1.0.8 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31938 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID fbdf2aa209f9 Credits Dhabaleshwar Das Required...

WordPress GamiPress – Button Plugin <= 1.0.7 is vulnerable to Cross Site Scripting (XSS)

Software GamiPress – Button Type Plugin Vulnerable versions = 1.0.7 Fixed in 1.0.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2460 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 46fbe1f93240 Credits Francesco Carlucci...

PT-2024-20478 · WordPress · Gamipress

Name of the Vulnerable Software and Affected Versions: GamiPress – Button plugin for WordPress versions up to, and including, 1.0.7 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplied attributes in the plugin...

AiLux imx6 Security Vulnerability

AiLux imx6 is a computing module from AiLux. A security vulnerability exists in versions prior to AiLux imx6 bundle imx61.0.7-2, which originates from a hole that allows a physical attacker to arbitrarily download/upload files from/to the file system, with unspecified impact on the confidentialit...

PT-2024-13258 · Google · Chromium

Name of the Vulnerable Software and Affected Versions: AiLux imx6 bundle versions prior to imx6 1.0.7-2 Description: A CWE-552 vulnerability in the embedded Chromium browser allows a physical attacker to arbitrarily download or upload files to or from the file system. This issue has unspecified...

PT-2024-13264 · Unknown · Ailux Imx6 Bundle

Name of the Vulnerable Software and Affected Versions: AiLux imx6 bundle versions prior to imx6 1.0.7-2 Description: A CWE-613 “Insufficient Session Expiration” issue in the web application exists due to the session cookie sessionid lasting two weeks, which facilitates session hijacking attacks...

AiLux imx6 Security Vulnerability

AiLux imx6 is a computing module from AiLux. A security vulnerability exists in versions prior to AiLux imx6 bundle imx61.0.7-2, which stems from insufficient session expiration and allows an attacker to conduct a session hijacking attack...

PT-2024-13263 · Ailux · Ailux Imx6 Bundle

Name of the Vulnerable Software and Affected Versions: AiLux imx6 bundle versions prior to imx6 1.0.7-2 Description: A CWE-646 issue in the "iec61850" functionality of the web application allows a remote authenticated attacker to upload any arbitrary type of file into the device. Recommendations:...