CVE-2024-4742

The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the orderby shortcode attribute in all versions up to, and including, 1.2.5 due to insufficient escaping on the user supplied parameter and la...

PT-2024-32622 · WordPress · Youzify – Buddypress Community

Name of the Vulnerable Software and Affected Versions: The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress versions 1.2.5 and earlier Description: The issue allows authenticated attackers with Contributor-level access and above to perform SQL Injecti...

WordPress plugin Youzify security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress Typing Text plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by vps1- Patchstack Alliance in WordPress Plugin Typing Text versions = 1.2.5...

WordPress Typing Text Plugin <= 1.2.5 is vulnerable to Cross Site Scripting (XSS)

Software Typing Text Type Plugin Vulnerable versions = 1.2.5 Fixed in 1.2.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-5058 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 91cc21022825 Credits vps1- Required privilege Contributor...

WordPress Serious Slider Plugin <= 1.2.4 is vulnerable to Cross Site Scripting (XSS)

Software Serious Slider Type Plugin Vulnerable versions = 1.2.4 Fixed in 1.2.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35762 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 57f1f13032c5 Credits Steven Julian Required privilege Editor...

CVE-2024-5248 Improper Access Control in lunary-ai/lunary

In lunary-ai/lunary version 1.2.5, an improper access control vulnerability exists due to a missing permission check in the GET /v1/users/me/org endpoint. The platform's role definitions restrict the Prompt Editor role to prompt management and project viewing/listing capabilities, explicitly...

WordPress GDPR Compliance plugin <= 1.2.5 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by CatFather Patchstack Alliance in WordPress Plugin GDPR Compliance versions = 1.2.5...

PT-2024-25178 · Hero · Hfheropayment

Name of the Vulnerable Software and Affected Versions: Hero hfheropayment versions 1.2.5 and earlier Description: The issue allows an attacker to escalate privileges via the HfHeropaymentGatewayBackModuleFrontController::initContent function. This is a SQL Injection vulnerability. Recommendations...

CVE-2024-33267

CVE-2024-33267 describes a SQL Injection vulnerability in Hero hfheropayment versions

PrestaShop SQL注入漏洞

PrestaShop is an open source e-commerce solution from the American company PrestaShop. The solution provides multiple payment methods, short message alerts and product image zoom and other features. A SQL injection vulnerability exists in PrestaShop Hero hfhero payment v.1.2.5 and earlier version...

WordPress Serious Slider Plugin <= 1.2.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Serious Slider Type Plugin Vulnerable versions = 1.2.4 Fixed in 1.2.5 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-33650 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID e5af7123ddcc Credits Steven Julian Requir...

PT-2024-24811 · Unknown · Advanced Floating Content

Name of the Vulnerable Software and Affected Versions: Advanced Floating Content versions 1.2.5 and earlier Description: The issue is related to improper neutralization of input during web page generation, which leads to a Cross-site Scripting XSS vulnerability. Specifically, it is a Stored XSS...

WordPress plugin Advanced Floating Content Lite 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2024-24810 · Unknown · Coupon & Discount Code Reveal Button

Name of the Vulnerable Software and Affected Versions: Coupon & Discount Code Reveal Button versions 1.2.5 and earlier Description: The issue is related to improper neutralization of input during web page generation, which leads to a Stored XSS vulnerability. This allows for the storage of...

WordPress Advanced Floating Content plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin Advanced Floating Content versions = 1.2.5...

WordPress Coupon & Discount Code Reveal Button plugin <=1.2.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by emad Patchstack Alliance in WordPress Plugin Coupon & Discount Code Reveal Button versions = 1.2.5...

Moderate: Red Hat Security Advisory: Migration Toolkit for Runtimes security, bug fix and enhancement update

Migration Toolkit for Runtimes 1.2.5 release Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

WordPress Plugin Christmas Greetings 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

PT-2024-18835 · WordPress · Christmas Greetings

Name of the Vulnerable Software and Affected Versions: Christmas Greetings plugin for WordPress versions 1.2.5 and earlier Description: The issue is related to Reflected Cross-Site Scripting via the code parameter due to insufficient input sanitization and output escaping. This allows...