emlog 安全漏洞

emlog is emlog open source a set of PHP and MySQL based CMS website building system. A security vulnerability exists in emlog pro version v2.5.7, which stems from an arbitrary file upload issue in the /views/plugin.php component that could lead to the execution of arbitrary code...

PT-2025-11693 · Emlog Pro · Emlog Pro

Name of the Vulnerable Software and Affected Versions: emlog pro version 2.5.7 Description: An arbitrary file upload vulnerability in the component /views/plugin.php of emlog pro allows attackers to execute arbitrary code via uploading a crafted PHP file. The vulnerability is located in the...

CVE-2024-49678

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Jinwen js allows Reflected XSS.This issue affects js paper: from n/a through 2.5.7...

PT-2024-16911 · WordPress · Aweber Forms

Name of the Vulnerable Software and Affected Versions: AWeber Forms by Optin Cat plugin for WordPress versions up to, and including, 2.5.7 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg without appropriate escaping on the URL. This allows...

WordPress plugin AWeber Forms by Optin Cat 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress...

CVE-2024-10113

The WP AdCenter – Ad Manager & Adsense Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpadcenterad shortcode in all versions up to, and including, 2.5.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

WordPress plugin js paper 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2024-33462 · Colorlib · Colorlib Simple Custom Post Order

Name of the Vulnerable Software and Affected Versions: Colorlib Simple Custom Post Order versions 2.5.7 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For...

WordPress Simple Custom Post Order Plugin <= 2.5.7 is vulnerable to Broken Access Control

Software Simple Custom Post Order Type Plugin Vulnerable versions = 2.5.7 Fixed in 2.5.8 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-49321 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 0c22de4a69ef Credits Rafie Muhammad...

WordPress plugin Mystique 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress Mystique theme <= 2.5.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Theme Mystique versions = 2.5.7...

CVE-2024-38706

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in HasThemes HT Mega allows Path Traversal.This issue affects HT Mega: from n/a through 2.5.7...

WordPress plugin HT Mega path traversal vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...

CVE-2024-5766

A vulnerability was found in Likeshop up to 2.5.7 and classified as problematic. This issue affects some unknown processing of the file /admin of the component Merchandise Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-267449 was...

PT-2024-37133 · Likeshop · Likeshop

Name of the Vulnerable Software and Affected Versions: Likeshop versions up to 2.5.7 Description: A vulnerability was found in the Merchandise Handler component, affecting some unknown processing of the file /admin. This issue leads to cross-site scripting and can be initiated remotely...

WordPress plugin Radio Station 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

CVE-2023-51803

LinuxServer.io Heimdall before 2.5.7 does not prevent use of icons that have non-image data such as the "" substring...

Likeshop Code Issue Vulnerability

Likeshop is a complete solution for social commerce strategy from Likeshop open source. A code issue vulnerability exists in Likeshop 2.5.7.20210311 and earlier versions, which stems from the parameter file in the file server/application/api/controller/File.php that can lead to unrestricted uploa...

CVE-2023-24000

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in GamiPress gamipress allows SQL Injection.This issue affects GamiPress: from n/a through 2.5.7...

PT-2023-19350

Name of the Vulnerable Software and Affected Versions GamiPress versions through 2.5.7 Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations For versions...