WordPress plugin Advanced Dewplayer 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-9308

An open redirect vulnerability in haotian-liu/llava version v1.2.0 LLaVA-1.6 allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL. This can be exploited for phishing attacks, malware distribution, and credential theft...

CVE-2024-11449

A vulnerability in haotian-liu/llava version 1.2.0 LLaVA-1.6 allows for Server-Side Request Forgery SSRF through the /run/predict endpoint. An attacker can gain unauthorized access to internal networks or the AWS metadata endpoint by sending crafted requests that exploit insufficient validation o...

CVE-2024-9311

A Cross-Site Request Forgery CSRF vulnerability in haotian-liu/llava v1.2.0 LLaVA-1.6 allows an attacker to upload files with malicious content without authentication or user interaction. The uploaded file is stored in a predictable path, enabling the attacker to execute arbitrary JavaScript code...

CVE-2024-9308

The CVE-2024-9308 entry concerns an open redirect in haotian-liu/llava v1.2.0 (LLaVA-1.6). The vulnerability stems from an open redirect that allows a remote, unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL. Documented impact mentions phishing, malware...

CVE-2024-9311

The vulnerability CVE-2024-9311 affects haotian-liu/llava v1.2.0 (LLaVA-1.6). A CSRF flaw lets an attacker upload files with malicious content without authentication, storing them in a predictable path and enabling arbitrary JavaScript execution in the victim’s browser when visiting the crafted f...

WordPress AHAthat Plugin plugin <= 1.6 - Authenticated (Administrator+) SQL Injection via id Parameter vulnerability

Authenticated Administrator+ SQL Injection via id Parameter vulnerability discovered by Régis SENET in WordPress Plugin AHAthat versions = 1.6...

Drupal Link field display mode formatter module < 1.6.0 - Unauthenticated Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS vulnerability discovered by Daniel Wehner dawehner in WordPress Module Link field display mode formatter versions 1.6.0...

WordPress BP Email Assign Templates By shanebp plugin <= 1.6 - Cross-Site Scripting vulnerability

Cross-Site Scripting vulnerability discovered by ch4r0n in WordPress Plugin BP Email Assign Templates versions = 1.6...

CVE-2025-28908

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in pipdig pipDisqus pipdisqus allows Stored XSS.This issue affects pipDisqus: from n/a through = 1.6...

CVE-2025-28875

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in shanebp BP Email Assign Templates bp-email-assign-templates allows Stored XSS.This issue affects BP Email Assign Templates: from n/a through = 1.6...

CVE-2025-28875

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in shanebp BP Email Assign Templates allows Stored XSS. This issue affects BP Email Assign Templates: from n/a through 1.6...

CVE-2025-28874

Authorization Bypass Through User-Controlled Key vulnerability in shanebp BP Email Assign Templates allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects BP Email Assign Templates: from n/a through 1.6...

WordPress plugin BP Email Assign Templates 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-23441

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in dkukral Attach Gallery Posts attach-gallery-posts allows Reflected XSS.This issue affects Attach Gallery Posts: from n/a through = 1.6...

CVE-2025-23441 WordPress Attach Gallery Posts plugin <= 1.6 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in dkukral Attach Gallery Posts attach-gallery-posts allows Reflected XSS.This issue affects Attach Gallery Posts: from n/a through = 1.6...

WordPress plugin NotFound Attach Gallery Posts 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in WordPress...

CVE-2025-27318 WordPress Simple Google Sitemap Plugin <= 1.6 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in ixiter Simple Google Sitemap simple-google-sitemap allows Cross Site Request Forgery.This issue affects Simple Google Sitemap: from n/a through = 1.6...

PT-2025-7743 · Unknown · Simple Google Sitemap

Name of the Vulnerable Software and Affected Versions: Simple Google Sitemap versions 1.6 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized requests. Recommendations: For Simple Google Sitemap versions 1.6 and earlier, update to a version...

WordPress plugin Reset 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...