CVE-2025-28872

CVE-2025-28872 concerns Block Spam By Math Reloaded (WordPress plugin). The issue is Missing Authorization, allowing access to functionality not constrained by ACLs in versions up to 2.2.4. Public records (NVD, Red Hat, CVE, Patchstack) classify this as a high-severity vulnerability (CVSS v3.1 ba...

WordPress plugin Block Spam By Math Reloaded 跨站脚本漏洞

WordPress and WordPress plugin are products of the WordPress Foundation, a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress plugin Block...

CVE-2024-53718

Cross-Site Request Forgery CSRF vulnerability in Eric Teubert Multi Feed Reader multi-feed-reader allows Stored XSS.This issue affects Multi Feed Reader: from n/a through = 2.2.4...

ATutor 2.2.4 Cross Site Scripting

ATutor version 2.2.4 suffers from a cross site scripting vulnerability. Exploit Title: Reflected XSS - atutorv2.2.4 Date: 01/2025 Exploit Author: Andrey Stoykov Version: 2.2.4 Tested on: Ubuntu 22.04 Blog: https://msecureltd.blogspot.com/2025/01/friday-fun-pentest-series-17-reflected.html...

ATutor 2.2.4 Host Header Injection

ATutor version 2.2.4 suffers from a host header injection vulnerability. Exploit Title: Host Header Injection - atutorv2.2.4 Date: 01/2025 Exploit Author: Andrey Stoykov Version: 2.2.4 Tested on: Ubuntu 22.04 Blog: https://msecureltd.blogspot.com/2025/01/friday-fun-pentest-series-18-host.html...

WordPress plugin Themesflat Addons For Elementor 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress plugin WP Job Portal 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2025-1761 · WordPress · Wp Job Portal

Name of the Vulnerable Software and Affected Versions: WP Job Portal – A Complete Recruitment System plugin for WordPress versions up to, and including, 2.2.4 Description: The WP Job Portal plugin for WordPress is vulnerable to Insecure Direct Object Reference due to missing validation on a user...

DEBIAN-CVE-2024-52046

The ObjectSerializationDecoder in Apache MINA uses Java’s native deserialization protocol to process incoming serialized data but lacks the necessary security checks and defenses. This vulnerability allows attackers to exploit the deserialization process by sending specially crafted malicious...

CVE-2023-47849

Missing Authorization vulnerability in Blossom Themes BlossomThemes Email Newsletter blossomthemes-email-newsletter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BlossomThemes Email Newsletter: from n/a through = 2.2.4...

CVE-2024-53718

Cross-Site Request Forgery CSRF vulnerability in Eric Teubert Multi Feed Reader multi-feed-reader allows Stored XSS.This issue affects Multi Feed Reader: from n/a through = 2.2.4...

WordPress plugin Multi Feed Reader 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site request forgery...

WordPress Multi Feed Reader Plugin <=2.2.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Multi Feed Reader Type Plugin Vulnerable versions =2.2.4 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-53718 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID d3cb59a47389 Credits Joshua Chan Required...

WordPress plugin Yaad Sarig Payment Gateway For WC 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in the...

WordPress Yaad Sarig Payment Gateway For WC plugin <= 2.2.4 - Missing Authorization to Authenticated (Subscriber+) Log Read/Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Log Read/Deletion vulnerability discovered by BrokenAC ignore in WordPress Plugin Yaad Sarig Payment Gateway For WC versions = 2.2.4...

PT-2024-39352 · WordPress · The Social Proof (Testimonial) Slider

Name of the Vulnerable Software and Affected Versions: The Social Proof Testimonial Slider plugin for WordPress versions up to, and including, 2.2.4 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's spslider-block...

CVE-2024-43260

Missing Authorization vulnerability in Creative Motion Clearfy Cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clearfy Cache: from n/a through 2.2.4...

CVE-2024-43260 WordPress Clearfy Cache plugin <= 2.2.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in Creative Motion Clearfy Cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clearfy Cache: from n/a through 2.2.4...

WordPress plugin Clearfy Cache 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Debian dla-3924 : php-horde-mime-viewer - security update

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-3924 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3924-1 [email protected] https://www.debian.org/lts/security/...