WordPress plugin Product Catalog Enquiry for WooCommerce by MultiVendorX Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in PHP. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPress plugin Product Catalog...

WordPress WP Dark Mode plugin <= 5.0.4 - Missing Authorization vulnerability

Missing Authorization vulnerability discovered by Peter Thaleikis in WordPress Plugin WP Dark Mode versions = 5.0.4...

WordPress WP Dark Mode Plugin <= 5.0.4 is vulnerable to Broken Access Control

Software WP Dark Mode Type Plugin Vulnerable versions = 5.0.4 Fixed in 5.0.5 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-5449 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID fcf51369e44e Credits Peter Thaleikis Required privileg...

PT-2024-36355 · WordPress · Wp Dark Mode

Name of the Vulnerable Software and Affected Versions: WP Dark Mode – WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing plugin for WordPress versions up to, and including, 5.0.4 Description: The issue allows authenticated attackers with...

WordPress Flash Video Player plugin <= 5.0.4 - CSRF to XSS vulnerability

CSRF to XSS vulnerability discovered by Dimas Maulana Patchstack Alliance in WordPress Plugin Flash Video Player versions = 5.0.4...

GHSA-MGV8-W49F-822W Mautic: MST-48 Server-Side Request Forgery in Asset section

Impact Prior to the patched version, an authenticated user of Mautic could read system files and access the internal addresses of the application due to a Server-Side Request Forgery SSRF vulnerability. Patches Update to 4.4.12 or 5.0.4 Workarounds None References -...

PT-2024-11537 · Mautic · Mautic

Name of the Vulnerable Software and Affected Versions: Mautic versions prior to 4.4.12 Mautic versions prior to 5.0.4 Description: The issue affects logged in users of Mautic, making them vulnerable to an SQL injection vulnerability in the Reports bundle. This vulnerability allows an attacker to...

PT-2024-10912 · Mautic +1 · Mautic +1

Name of the Vulnerable Software and Affected Versions: Mautic versions prior to 4.4.12 Mautic versions prior to 5.0.4 Description: Prior to the patched version, logged in users of Mautic are vulnerable to Relative Path Traversal/Arbitrary File Deletion. Regardless of the level of access the Mauti...

CVE-2023-49134

A command execution vulnerability exists in the tddpd enabletestmode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point EAP225 V3 v5.1.0 Build 20220926 and Tp-Link N300 Wireless Access Point EAP115 V4 v5.0.4 Build 20220216. A specially crafted series of network requests can lea...

Dell Grab 安全漏洞

Dell Grab is a configuration technology from Dell, Inc. It is used to collect data on hosts connected to Dell EMC storage devices. A security vulnerability exists in Dell Grab version 5.0.4 and earlier, which stems from a system containing an incorrect file permission vulnerability that results i...

BIT-MONGODB-2021-32040 Large aggregation pipelines with a specific stage can crash mongod under default configuration

It may be possible to have an extremely long aggregation pipeline in conjunction with a specific stage/operator and cause a stack overflow due to the size of the stack frames used by that stage. If an attacker could cause such an aggregation to occur, they could maliciously crash MongoDB in a DoS...

$1,275 Bounty Awarded For Arbitrary File Deletion Vulnerability Patched in MW WP Form WordPress Plugin

Did you know were running a Bug Bounty Extravaganza again? Earn over 6x our usual bounty rates, up to $10,000, for all vulnerabilities submitted through February 29th, 2024 when you opt to have Wordfence handle responsible disclosure! On December 5th, 2023, shortly after the launch of our Holiday...

Security feature bypass

OroCalendarBundle enables a Calendar feature and related functionality in Oro applications. Back-office users can access information from any call event, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.4 and 5.1.1...

CVE-2023-32063 OroCRMCallBundle has incorrect call view page visibility

OroCalendarBundle enables a Calendar feature and related functionality in Oro applications. Back-office users can access information from any call event, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in version 5.0.4 and 5.1.1...

PT-2023-32563 · WordPress · Audio Merchant

Name of the Vulnerable Software and Affected Versions: The Audio Merchant plugin for WordPress versions up to, and including, 5.0.4 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the audio merchant save settings function. This allow...

PT-2023-29363 · Best Practical · Request Tracker

Name of the Vulnerable Software and Affected Versions: Best Practical Request Tracker RT versions 5.0.0 through 5.0.4 Description: The issue allows Information Disclosure via a transaction search in the transaction query builder. Recommendations: For versions 5.0.0 through 5.0.4, update to versio...

WordPress SAML SP Single Sign On Plugin <= 5.0.4 is vulnerable to Broken Access Control

Software SAML SP Single Sign On Type Plugin Vulnerable versions = 5.0.4 Fixed in 5.0.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-41873 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 3a9125d095f6 Credits Abdi Pranata Required...

CVE-2022-45366 WordPress Slimstat Analytics Plugin <= 5.0.4 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Jason Crouse, VeronaLabs Slimstat Analytics plugin = 5.0.4 versions...

CVE-2022-45366 WordPress Slimstat Analytics Plugin <= 5.0.4 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Jason Crouse, VeronaLabs Slimstat Analytics plugin = 5.0.4 versions...

WordPress plugin The Post Grid 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...