PT-2024-23472 · Unknown · Wholesalex

Name of the Vulnerable Software and Affected Versions: WholesaleX versions 1.3.2 and earlier Description: The issue is related to Improper Privilege Management, allowing Privilege Escalation in WholesaleX. Recommendations: For versions 1.3.2 and earlier, update to a version that contains a fix fo...

WordPress Popup4Phone Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)

Software Popup4Phone Type Plugin Vulnerable versions = 1.3.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3231 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 3a2ba7555452 Credits Bob Matyas Required...

PT-2024-24498 · WordPress · Popup4Phone

Name of the Vulnerable Software and Affected Versions: Popup4Phone WordPress plugin versions 1.3.2 and earlier Description: The issue allows unauthenticated users to perform Cross-Site Scripting attacks against admins due to the plugin not sanitising and escaping some parameters. Recommendations:...

PT-2024-26745 · WordPress · Popup4Phone Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Popup4Phone WordPress plugin versions 1.3.2 and earlier Description: The issue allows high privilege users, such as Editors, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, ...

WordPress plugin Testimonial Slider 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress Testimonial Slider plugin <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Krzysztof Zając in WordPress Plugin Testimonial Slider versions = 1.3.2...

mujs: Multiple Vulnerabilities

Background mujs is an embeddable Javascript interpreter in C. Description Multiple vulnerabilities have been discovered in mujs. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no known workaround...

WordPress Where Did You Hear About Us Checkout Field for WooCommerce Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)

Software Where Did You Hear About Us Checkout Field for WooCommerce Type Plugin Vulnerable versions = 1.3.1 Fixed in 1.3.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2752 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID...

PT-2024-24852 · Unknown · Vikrentcar

Name of the Vulnerable Software and Affected Versions: VikRentCar versions 1.3.2 and earlier Description: The issue is related to the exposure of sensitive information to an unauthorized actor. This is a problem where sensitive data is made available to individuals who should not have access to i...

WordPress VikRentCar Car Rental Management System plugin <= 1.3.2 - Sensitive Data Exposure via Invoices vulnerability

Sensitive Data Exposure via Invoices vulnerability discovered by Steven Julian Patchstack Alliance in WordPress Plugin VikRentCar versions = 1.3.2...

Trainme Academy 安全漏洞

Trainme Academy is a leading quality education and training solution from Trainme, Inc. A security vulnerability exists in Trainme Academy version v.1.3.2. A remote attacker exploits the vulnerability to obtain sensitive information via the informacion, idcurso, and tit parameters...

CVE-2024-27574

SQL Injection vulnerability in Trainme Academy version Ichin v.1.3.2 allows a remote attacker to obtain sensitive information via the informacion, idcurso, and tit parameters...

CVE-2024-32091

Cross-Site Request Forgery CSRF vulnerability in Tonjoo Sangar Slider.This issue affects Sangar Slider: from n/a through 1.3.2...

CVE-2024-32091

Technical details about CVE-2024-32091 (Sangar Slider CSRF) are not present in the provided documents. No affected versions, impact, or remediation are specified here; monitor official advisories or connected sources for updates.

PT-2024-24396 · Tonjoo · Sangar Slider

Name of the Vulnerable Software and Affected Versions: Sangar Slider versions 1.3.2 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability in Tonjoo Sangar Slider. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a...

WordPress Sangar Slider plugin <= 1.3.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Khalid Patchstack Alliance in WordPress Plugin Sangar Slider versions = 1.3.2...

CVE-2024-2348

The Gum Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Meta widget in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level acce...

WordPress WP Sort Order Plugin <= 1.3.1 is vulnerable to Broken Access Control

Software WP Sort Order Type Plugin Vulnerable versions = 1.3.1 Fixed in 1.3.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31294 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID fa1bc46c4a98 Credits CatFather Required privilege...

CVE-2024-30250

Astro-Shield is an integration to enhance website security with SubResource Integrity hashes, Content-Security-Policy headers, and other techniques. Versions from 1.2.0 to 1.3.1 of Astro-Shield allow bypass to the allow-lists for cross-origin resources by introducing valid integrity attributes to...

CVE-2024-30248 Piccolo Admin's raw SVG loading may lead to complete data compromise from admin page

Piccolo Admin is an admin interface/content management system for Python, built on top of Piccolo. Piccolo's admin panel allows media files to be uploaded. As a default, SVG is an allowed file type for upload. An attacker can upload an SVG which when loaded can allow arbitrary access to the admin...