WordPress plugin Raptive Ads 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress Raptive Ads plugin <= 3.6.3 - Missing Authorization to Unauthenticated Data/Settings Reset vulnerability

Missing Authorization to Unauthenticated Data/Settings Reset vulnerability discovered by Tieu Pham Trong Nhan in WordPress Plugin Raptive Ads versions = 3.6.3...

WordPress Shortlinks by Pretty Links Plugin <= 3.6.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Shortlinks by Pretty Links Type Plugin Vulnerable versions = 3.6.3 Fixed in 3.6.4 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-2326 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 02d57a965c0b Credits Webbernau...

WordPress Plugin Pretty Links 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

PT-2024-19754 · WordPress · Pretty Links – Affiliate Links

Name of the Vulnerable Software and Affected Versions: The Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress versions up to, and including, 3.6.3 Description: The issue is due to missing or incorrect nonce validation when saving plugin settings,...

SSRF vulnerability using the Aegis DataBinding in Apache CXF

A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings including the default databinding are not impacted...

Symphony Communication ServicesHp Symphony Security Vulnerability

Symphony Communication ServicesHp Symphony is a solution from Symphony Communication ServicesHp, Inc. for connecting and liquefying financial transaction workflows. A security vulnerability exists in Symphony Communication ServicesHp Symphony v.3.6.3 and earlier versions, which originates from a...

PT-2024-19644 · Symphony +1 · Symphony +1

Name of the Vulnerable Software and Affected Versions: symphony versions 3.6.3 and earlier Description: An issue in the software allows a remote attacker to execute arbitrary code via the log4j component. Recommendations: For versions 3.6.3 and earlier, consider disabling the log4j component unti...

WordPress BSK Forms Blacklist Plugin <= 3.6.3 is vulnerable to Cross Site Scripting (XSS)

Software BSK Forms Blacklist Type Plugin Vulnerable versions = 3.6.3 Fixed in 3.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5980 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 330a6bb4d39e Credits Bob Matyas Required...

CVE-2020-36753

The Hueman theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.6.3. This is due to missing or incorrect nonce validation on the savemetabox function. This makes it possible for unauthenticated attackers to save metabox data via a forged request...

PrestaShop SQL注入漏洞

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides multiple payment methods, short message alerts and product image zoom. A security vulnerability exists in PrestaShop, which originates from a SQL injection vulnerability in the...

CVE-2018-25086

A vulnerability was found in sea75300 FanPress CM up to 3.6.3. It has been classified as problematic. This affects the function getArticlesPreview of the file inc/controller/action/system/templatepreview.php of the component Template Preview. The manipulation leads to cross site scripting. It is...

CVE-2018-25086

A vulnerability was found in sea75300 FanPress CM up to 3.6.3. It has been classified as problematic. This affects the function getArticlesPreview of the file inc/controller/action/system/templatepreview.php of the component Template Preview. The manipulation leads to cross site scripting. It is...

FanPress CM 跨站脚本漏洞

FanPress CM is a lightweight but powerful content management system from the individual developer Stefan Seehafer. A cross-site scripting vulnerability exists in FanPress CM 3.6.3 and earlier versions, which stems from a problem with the component Template Preview and can be exploited by an...

PT-2023-10826 · Sea75300 · Fanpress Cm

Name of the Vulnerable Software and Affected Versions: sea75300 FanPress CM versions up to 3.6.3 Description: A vulnerability was found in the Template Preview component, specifically affecting the getArticlesPreview function of the file inc/controller/action/system/templatepreview.php. This issu...

WordPress Telegram Bot & Channel Plugin <= 3.6.2 is vulnerable to Cross Site Scripting (XSS)

Software Telegram Bot & Channel Type Plugin Vulnerable versions = 3.6.2 Fixed in 3.6.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-34006 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID ffd28984fd7d Credits yuyudhn Required...

WordPress Plugin ShortPixel Adaptive Images 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

SUSE CVE-2019-3836

It was discovered in gnutls before version 3.6.7 upstream that there is an uninitialized pointer access in gnutls versions 3.6.3 or later which can be triggered by certain post-handshake messages...

SUSE CVE-2019-18798

LibSass before 3.6.3 allows a heap-based buffer over-read in Sass::weaveParents in astselweave.cpp...

SUSE CVE-2023-23942

The Nextcloud Desktop Client is a tool to synchronize files from a Nextcloud Server with your computer. Versions prior to 3.6.3 are missing sanitisation on qml labels which are used for basic HTML elements such as strong, em and head lines in the UI of the desktop client. The lack of sanitisation...