PT-2024-16427 · WordPress · Blogger 301 Redirect

Name of the Vulnerable Software and Affected Versions: Blogger 301 Redirect plugin for WordPress versions up to, and including, 2.5.3 Description: The issue is a blind time-based SQL Injection vulnerability via the br parameter. This vulnerability is due to insufficient escaping on the...

WordPress Blogger 301 Redirect plugin <= 2.5.3 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by kr0d in WordPress Plugin Blogger 301 Redirect versions = 2.5.3...

WordPress plugin JobSearch 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-30791 · Eyecix · Eyecix Jobsearch

Name of the Vulnerable Software and Affected Versions: eyecix JobSearch versions n/a through 2.5.3 Description: A Cross-Site Request Forgery CSRF issue affects eyecix JobSearch, allowing an attacker to forge requests on a user's behalf. This can lead to unauthorized actions being performed withou...

CVE-2024-43931

Deserialization of Untrusted Data vulnerability in eyecix JobSearch allows Object Injection.This issue affects JobSearch: from n/a through 2.5.3...

WordPress JobSearch WP Job Board WordPress Plugin plugin <= 2.5.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin JobSearch versions = 2.5.3...

PT-2024-27390 · Unknown · Kimili Flash Embed

Name of the Vulnerable Software and Affected Versions: Kimili Flash Embed versions 2.5.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations: For...

PT-2024-15190 · WordPress · Advanced File Manager Shortcodes

Name of the Vulnerable Software and Affected Versions: Advanced File Manager Shortcodes plugin for WordPress versions up to, and including, 2.5.3 Description: The issue allows authenticated attackers with contributor access or above to upload arbitrary files on the affected site's server, which m...

WordPress Kimili Flash Embed plugin <= 2.5.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin Kimili Flash Embed versions = 2.5.3...

CVE-2024-37156

The SuluFormBundle adds support for creating dynamic forms in Sulu Admin. The TokenController get parameter formName is not sanitized in the returned input field which leads to XSS. This vulnerability is fixed in 2.5.3...

CVE-2024-37156 TokenController formName not sanitized in hidden input

The SuluFormBundle adds support for creating dynamic forms in Sulu Admin. The TokenController get parameter formName is not sanitized in the returned input field which leads to XSS. This vulnerability is fixed in 2.5.3...

CVE-2024-37156 TokenController formName not sanitized in hidden input

The SuluFormBundle adds support for creating dynamic forms in Sulu Admin. The TokenController get parameter formName is not sanitized in the returned input field which leads to XSS. This vulnerability is fixed in 2.5.3...

SuluFormBundle Security Vulnerability

SuluFormBundle is an application from the Austrian company Sulu that creates dynamic forms. A security vulnerability exists in SuluFormBundle versions prior to 2.5.3, which stems from a cross-site scripting vulnerability due to returned input fields not being cleaned...

PT-2024-27340 · Unknown +1 · Suluformbundle +1

Name of the Vulnerable Software and Affected Versions: SuluFormBundle versions prior to 2.5.3 Description: The SuluFormBundle adds support for creating dynamic forms in Sulu Admin. The TokenController get parameter formName is not sanitized in the returned input field, which leads to XSS...

WordPress HT Mega Plugin <= 2.5.2 is vulnerable to Cross Site Scripting (XSS)

Software HT Mega Type Plugin Vulnerable versions = 2.5.2 Fixed in 2.5.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4876 Patch priority Low CVSS severity Low 6.5 Developer HTMega PSID feb0aa615e6b Credits wesley wcraft Required privilege...

WordPress Supreme Modules Lite plugin <= 2.5.3 - Authenticated (Contributor+) DOM-Based Cross-Site Scripting vulnerability

Authenticated Contributor+ DOM-Based Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Plugin Supreme Modules Lite versions = 2.5.3...

PT-2024-30506 · Unknown +1 · Divi Builder +4

Name of the Vulnerable Software and Affected Versions: The Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder plugin for WordPress versions up to, and including, 2.5.3 Description: The issue is related to DOM-Based Cross-Site Scripting due to insufficient input sanitization and outpu...

WordPress Plugin Code Insert Manager 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2024-24397 · Unknown · Kimili Flash Embed

Name of the Vulnerable Software and Affected Versions: Kimili Flash Embed versions 2.5.3 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application tha...

Pz-LinkCard < 2.5.3 - Contributor+ SSRF

Description The plugin does not prevent users from pinging arbitrary hosts via some of its shortcodes, which could allow high privilege users such as contributors to perform SSRF attacks. Setup a listener on a localhost/LAN host such as nc -l 127.0.0.1 9000, then as a contributor, put the followi...