CVE-2020-26253

Kirby is a CMS. In Kirby CMS getkirby/cms before version 3.3.6, and Kirby Panel before version 2.5.14 there is a vulnerability in which the admin panel may be accessed if hosted on a .dev domain. In order to protect new installations on public servers that don't have an admin account for the Pane...

SUSE CVE-2025-32431

Traefik pronounced traffic is an HTTP reverse proxy and load balancer. In versions prior to 2.11.24, 3.3.6, and 3.4.0-rc2. There is a potential vulnerability in Traefik managing the requests using a PathPrefix, Path or PathRegex matcher. When Traefik is configured to route the requests to a backe...

GHSA-RCQJ-3FMP-5CQX Apache Pulsar Kafka Connector Logs Sensitive Information in Application Logs

Apache Pulsar contains multiple connectors for integrating with Apache Kafka. The Pulsar IO Apache Kafka Source Connector, Sink Connector, and Kafka Connect Adaptor Sink Connector log sensitive configuration properties in plain text in application logs. This vulnerability can lead to unintended...

Medium: ruby3.2

Issue Overview: REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the...

WordPress plugin Gutentor 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2024-36078 · WordPress · Gutentor

Name of the Vulnerable Software and Affected Versions: Gutentor WordPress plugin versions prior to 3.3.6 Description: The issue concerns the Gutentor WordPress plugin, which does not validate and escape some of its block options before outputting them back in a page or post where the block is...

UBUNTU-CVE-2024-43398

REXML is an XML toolkit for Ruby. The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes. If you need to parse untrusted XMLs with tree parser API like REXML::Document.new, you may be impacted to this vulnerability...

CVE-2024-43398 REXML denial of service vulnerability

REXML is an XML toolkit for Ruby. The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes. If you need to parse untrusted XMLs with tree parser API like REXML::Document.new, you may be impacted to this vulnerability...

WordPress AliExpress Dropshipping with AliNext Lite plugin <= 3.3.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Lucio Sá in WordPress Plugin AliNext versions = 3.3.6...

CVE-2024-3268

The YouTube Video Gallery by YouTube Showcase – Video Gallery Plugin for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the emdformbuilderlitesubmitform function in all versions up to, and including, 3.3.6. This makes it...

PT-2024-24765 · WordPress · The Youtube Video Gallery By Youtube Showcase

Name of the Vulnerable Software and Affected Versions: The YouTube Video Gallery by YouTube Showcase – Video Gallery Plugin for WordPress versions up to, and including, 3.3.6 Description: The issue allows unauthorized modification of data due to a missing capability check on the emd form builder...

VulnCheck KEV: CVE-2021-32790

Woocommerce is an open source eCommerce plugin for WordPress. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce plugin between version 3.3.0 and 3.3.6. Malicious actors already having admin access, or API keys to the WooCommerce site can exploit vulnerable...

affiliate-toolkit < 3.4.3 - Unauthenticated SSRF

Description The plugin lacks authorization and authentication for requests to it's affiliate-toolkit-starter/tools/atkpimagereceiver.php endpoint, allowing unauthenticated visitors to make requests to arbitrary URL's, including RFC1918 private addresses, leading to a Server Side Request Forgery...

PT-2023-30589 · Aazztech · Aazztech Woocommerce Product Carousel Slider

Name of the Vulnerable Software and Affected Versions: AazzTech WooCommerce Product Carousel Slider plugin versions prior to 3.3.6 Description: The issue is related to improper neutralization of input during web page generation, which can lead to Cross-site Scripting. Recommendations: For version...

vantage6 Code Issue Vulnerability

vantage6 is a vantage6 open source priVAcy preserviNg federalTed leArningG infrastructure for Secure Insight eXchange. A code issue vulnerability exists in versions prior to vantage6 3.3.6 that stems from deleting a collaboration without deleting the linked resources e.g., tasks in that...

CVE-2023-4471 Order Tracking Pro <= 3.3.6 - Reflected Cross-Site Scripting

The Order Tracking Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the startdate and enddate parameters in versions up to, and including, 3.3.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

WordPress Order Tracking Plugin <= 3.3.6 is vulnerable to Cross Site Scripting (XSS)

Software Order Tracking Type Plugin Vulnerable versions = 3.3.6 Fixed in 3.3.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4471 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 29d4142f0f03 Credits Marco Wotschka...

WordPress NextGEN Gallery Plugin <= 3.3.6 is vulnerable to Cross Site Scripting (XSS)

Software NextGEN Gallery Type Plugin Vulnerable versions = 3.3.6 Fixed in 3.4.7 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 1895dd78f517 Credits Rafie Muhammad Patchstack Required...

SUSE CVE-2014-2554

OTRS 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote attackers to conduct clickjacking attacks via an IFRAME element...

VMware Workspace One Access和VMware Identity Manager 访问控制错误漏洞

VMware Workspace One Access and VMware Identity Manager are both products of VMware, Inc.VMware Workspace One Access is a centralized management console that enables you to manage users and groups, set and manage authentication and access policies, and add resources to a directory and manage...