638 matches found
CVE-2025-32230
Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Themeum Tutor LMS tutor.This issue affects Tutor LMS: from n/a through = 3.4.0...
CVE-2025-32230
Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Themeum Tutor LMS tutor.This issue affects Tutor LMS: from n/a through = 3.4.0...
CVE-2025-3097
The wp Time Machine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.4.0. This is due to missing or incorrect nonce validation on the 'wpTimeMachineCore.php' page. This makes it possible for unauthenticated attackers to update settings and...
PT-2025-14475 · WordPress · Time Machine
Name of the Vulnerable Software and Affected Versions: wp Time Machine plugin for WordPress versions up to, and including, 3.4.0 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the 'wpTimeMachineCore.php' page. This allows...
WordPress plugin Viral Loops WP Integration 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exist...
CVE-2025-24972 Discourse may bypass user preference when adding users to chat groups
Discourse is an open-source discussion platform. Prior to versions 3.3.4 on the stable branch and 3.4.0.beta5 on the beta branch, in specific circumstances, users could be added to group direct messages despite disabling direct messaging in their preferences. Versions 3.3.4 and 3.4.0.beta5 contai...
PT-2025-12890 · Discourse · Discourse
Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.3.4 on the stable branch and prior to 3.4.0.beta5 on the beta branch Description: The issue affects an open-source discussion platform, where a race condition allows someone about to reach the user limit in a gro...
Discourse 安全漏洞
Discourse is an open source community discussion platform from Discourse Open Source. The platform includes features such as communities, email and chat rooms. A security vulnerability exists in Discourse stable prior to version 3.3.4 and beta prior to version 3.4.0.beta5, which stems from a...
JoomlaUX JUX Real Estate 代码注入漏洞
JoomlaUX JUX Real Estate is a Joomla component from JoomlaUX designed to meet a wide range of real estate related needs. A code injection vulnerability exists in JoomlaUX JUX Real Estate version 3.4.0, which stems from a cross-site scripting attack that could lead to a remote attack...
JoomlaUX JUX Real Estate 注入漏洞
JoomlaUX JUX Real Estate is a Joomla component from JoomlaUX designed to meet a variety of real estate related needs. An injection vulnerability exists in JoomlaUX JUX Real Estate version 3.4.0, which stems from the fact that incorrect manipulation of the parameter title can lead to SQL injection...
WordPress ElementsKit Elementor addons plugin <= 3.4.0 - Unauthenticated Information Exposure via get_megamenu_content Function vulnerability
Unauthenticated Information Exposure via getmegamenucontent Function vulnerability discovered by stealthcopter in WordPress Plugin ElementsKit Elementor addons Lite versions = 3.4.0...
WordPress plugin ElementsKit Elementor addons 访问控制错误漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An access control...
User Impersonation
Overview SPID.AspNetCore.Authentication is a custom implementation of an AspNetCore RemoteAuthenticationHandler for SPID a.k.a. the Italian 'Sistema Pubblico di Identità Digitale'. Affected versions of this package are vulnerable to User Impersonation due to the insufficient validation of SAML...
WordPress plugin ElementsKit Elementor addons 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
PT-2025-6820 · WordPress · Elementskit Elementor Addons
Name of the Vulnerable Software and Affected Versions: ElementsKit Elementor addons plugin for WordPress versions up to, and including, 3.4.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Image Accordion widget due to insufficient input sanitization and output...
org.jeecgframework.boot:jeecg-boot-starter-cloud (>=3.4.0 <=3.7.2), org.jeecgframework.boot:jeecg-boot-starter-lock (>=3.4.0 <=3.7.2) +3 more potentially affected by CVE-2024-57606 via org.jeecgframework.boot:jeecg-boot-common (>=3.4.0 <=3.7.2)
org.jeecgframework.boot:jeecg-boot-common MAVEN version =3.4.0, =3.4.0, =3.4.0, =3.4.0, =3.6.3, =3.7.2 Source cves: CVE-2024-57606 Source advisory: OSV:GHSA-WFPM-QCHC-6CF9...
CVE-2024-1385
The WP-Stateless – Google Cloud Storage plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the dismissnotices function in all versions up to, and including, 3.4.0. This makes it possible for authenticated attackers, with subscriber-level access an...
CVE-2025-24747 WordPress Houzez theme <= 3.4.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in favethemes Houzez houzez.This issue affects Houzez: from n/a through = 3.4.0...
