WordPress Plugin ElementsKit Elementor addons 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in...

CVE-2024-27476

Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show/tickets/newTicket...

CVE-2024-27477

In Leantime 3.0.6, a Cross-Site Scripting vulnerability exists within the ticket creation and modification functionality, allowing attackers to inject malicious JavaScript code into the title field of tickets also known as to-dos. This stored XSS vulnerability can be exploited to perform...

Leantime Systems Leantime 安全漏洞

Leantime Systems Leantime is an open source PHP and MySQL based project management system from Leantime Systems, Inc. A security vulnerability exists in Leantime Systems Leantime version 3.0.6, which stems from the presence of a cross-site scripting vulnerability that allows an attacker to inject...

PT-2024-21916 · Leantime · Leantime

Name of the Vulnerable Software and Affected Versions: Leantime version 3.0.6 Description: A Cross-Site Scripting issue exists within the ticket creation and modification functionality, allowing attackers to inject malicious JavaScript code into the title field of tickets. This stored XSS issue c...

CVE-2024-27474

Leantime 3.0.6 has a CSRF vulnerability allowing an attacker to perform unauthorized actions with admin privileges. Exploitation evidence exists (PoC repo) and multiple sources confirm the issue. No publicly documented fix version is provided in the connected documents; some sources indicate no i...

CVE-2024-27476

CVE-2024-27476 affects Leantime 3.0.6 and is reported as an HTML Injection vulnerability exposed via /dashboard/show#/tickets/newTicket. The public records consistently describe an HTML injection path in the Tickets UI, with CVSSv3.1 metrics: AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N, base score 4.7 (M...

Leantime Systems Leantime 安全漏洞

Leantime Systems Leantime is an open source PHP and MySQL based project management system from Leantime Systems, Inc. A security vulnerability exists in Leantime Systems Leantime version 3.0.6 that stems from vulnerability to HTML injection attacks...

PT-2024-21915 · Leantime · Leantime

Name of the Vulnerable Software and Affected Versions: Leantime version 3.0.6 Description: The issue allows for HTML Injection via the /dashboard/show/tickets/newTicket API endpoint. Recommendations: For Leantime version 3.0.6, update to a version that fixes this issue, however at the moment, the...

CVE-2024-27476

Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show/tickets/newTicket...

PT-2024-21914 · Leantime · Leantime

Name of the Vulnerable Software and Affected Versions: Leantime version 3.0.6 Description: This issue allows malicious actors to perform unauthorized actions on behalf of authenticated users, specifically administrators, due to a Cross Site Request Forgery CSRF weakness. Recommendations: For...

CVE-2024-27474

Leantime 3.0.6 is vulnerable to Cross Site Request Forgery CSRF. This vulnerability allows malicious actors to perform unauthorized actions on behalf of authenticated users, specifically administrators...

WordPress Top Bar Plugin <= 3.0.5 is vulnerable to Cross Site Scripting (XSS)

Software Top Bar Type Plugin Vulnerable versions = 3.0.5 Fixed in 3.0.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-31928 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 1fe06e1756b5 Credits Joel Indra Required privilege Administrator...

CVE-2024-27476

Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show/tickets/newTicket...

CVE-2024-2803

The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the countdown widget in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2024-22224 · WordPress · Elementskit Elementor Addons Plugin

Name of the Vulnerable Software and Affected Versions: ElementsKit Elementor addons plugin for WordPress versions up to, and including, 3.0.6 Description: The issue is related to Stored Cross-Site Scripting via the countdown widget due to insufficient input sanitization and output escaping on...

PT-2024-21997 · Leantime · Leantime

Name of the Vulnerable Software and Affected Versions: Leantime version 3.0.6 Description: The issue allows attackers to execute arbitrary code via the upload of a crafted PDF file to the "files/browse" endpoint. This enables the execution of malicious scripts, potentially leading to unauthorized...

WordPress ElementsKit Elementor addons plugin <= 3.0.6 - Authenticated (Contributor+) Local File Inclusion in render_raw vulnerability

Authenticated Contributor+ Local File Inclusion in renderraw vulnerability discovered by wesley wcraft in WordPress Plugin Elements kit Elementor addons versions = 3.0.6...

WordPress Elements kit Elementor addons Plugin <= 3.0.6 is vulnerable to Local File Inclusion

Software Elements kit Elementor addons Type Plugin Vulnerable versions = 3.0.6 Fixed in 3.0.7 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-2047 Patch priority Low CVSS severity Low 8.5 Developer Wpmet PSID 9c94438e55c2 Credits wesley wcraft Required privilege...

CVE-2024-2047

The ElementsKit Elementor addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.6 via the renderraw function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files o...