CVE-2024-23657 Path Traversal: '../filedir' in Nuxt Devtools

Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Nuxt Devtools is missing authentication on the getTextAssetContent RPC function which is vulnerable to path traversal. Combined with a lack of Origin checks on the WebSocket handler, an attack...

WordPress CM WordPress Search And Replace Plugin plugin < 1.3.9 - Plugin Reset via CSRF vulnerability

Plugin Reset via CSRF vulnerability discovered by Felipe Caon in WordPress Plugin CM On Demand Search And Replace versions 1.3.9...

CVE-2024-5028

The CM WordPress Search And Replace Plugin WordPress plugin before 1.3.9 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

CVE-2024-35717

Missing Authorization vulnerability in A WP Life Media Slider – Photo Sleder, Video Slider, Link Slider, Carousal Slideshow.This issue affects Media Slider – Photo Sleder, Video Slider, Link Slider, Carousal Slideshow: from n/a through 1.3.9...

WordPress plugin Media Slider security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-26667 · WordPress · A Wp Life Media Slider

Name of the Vulnerable Software and Affected Versions: A WP Life Media Slider – Photo Sleder, Video Slider, Link Slider, Carousal Slideshow versions 1.3.9 and earlier Description: The issue is related to a Missing Authorization vulnerability in the A WP Life Media Slider plugin. This vulnerabilit...

WordPress plugin Integrate Google Drive security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin Kenta Gutenberg Blocks Responsive Blocks and block templates library for Gutenberg Editor Cross-site scripting vulnerability

WordPress and the WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Kenta Gutenberg...

PT-2024-26683 · Unknown · Kenta Gutenberg Blocks

Name of the Vulnerable Software and Affected Versions: Kenta Gutenberg Blocks Responsive Blocks and block templates library for Gutenberg Editor versions 1.3.9 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site...

WordPress Kenta Gutenberg Blocks plugin <= 1.3.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by 4rCanJ0x! Patchstack Alliance in WordPress Plugin Kenta Gutenberg Blocks Responsive Blocks and block templates library for Gutenberg Editor versions = 1.3.9...

WordPress Media Slider plugin <= 1.3.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Steven Julian Patchstack Alliance in WordPress Plugin Media Slider – Photo Sleder, Video Slider, Link Slider, Carousal Slideshow versions = 1.3.9...

WordPress plugin Integration for Contact Form 7 and Salesforce 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

PT-2024-26162 · WordPress · Integration For Contact Form 7/Salesforce

Name of the Vulnerable Software and Affected Versions: Integration for Contact Form 7 and Salesforce versions 1.3.9 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the specified software, allowing unauthorized actions to be performed on behalf of a user without their...

WordPress Integrate Google Drive plugin <= 1.3.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Steven Julian Patchstack Alliance in WordPress Plugin Integrate Google Drive versions = 1.3.9...

PT-2024-24716 · Unknown · Attesa Extra

Name of the Vulnerable Software and Affected Versions: Attesa Extra versions 1.3.9 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...

WordPress Plugin Attesa Extra 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress Attesa Extra plugin <= 1.3.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Abu Hurayra Patchstack Alliance in WordPress Plugin Attesa Extra versions = 1.3.9...

WordPress Attesa Extra Plugin <= 1.3.9 is vulnerable to Cross Site Scripting (XSS)

Software Attesa Extra Type Plugin Vulnerable versions = 1.3.9 Fixed in 1.4.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32594 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 4bca51f18f29 Credits Khalid Yusuf Required privilege Contribut...

CVE-2023-7002

The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 1.3.9 via the 'url' parameter. This vulnerability allows authenticated attackers, with administrator-level permissions and above, to execute arbitrary commands on the host operati...

CVE-2023-7002 Backup Migration <= 1.3.9 - Authenticated (Admin+) OS Command Injection via url

The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 1.3.9 via the 'url' parameter. This vulnerability allows authenticated attackers, with administrator-level permissions and above, to execute arbitrary commands on the host operati...