WordPress plugin SeventhQueen Kleo 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security...

CVE-2024-56209 WordPress Kleo theme < 5.4.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in SeventhQueen Kleo allows Reflected XSS.This issue affects Kleo: from n/a before 5.4.4...

WordPress plugin Kleo 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...

PT-2024-35929 · Analytify · Analytify

Name of the Vulnerable Software and Affected Versions: Analytify versions prior to 5.4.4 Description: The issue is related to the exposure of sensitive system information to an unauthorized control sphere. This could potentially allow unauthorized access to sensitive data. Recommendations: For...

Acronis Cyber Infrastructure Default Password Remote Code Execution Exploit

Acronis Cyber Infrastructure ACI is an IT infrastructure solution that provides storage, compute, and network resources. Businesses and Service Providers are using it for data storage, backup storage, creating and managing virtual machines and software-defined networks, running cloud-native...

Cerberus Helpdesk User Hash Disclosure

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Cerberus Helpdesk User Hash Disclosure', 'Description' = %q This module extracts usernames and password hashes from the Cerberus Helpdesk through...

CVE-2023-45249

Remote command execution due to use of default passwords. The following products are affected: Acronis Cyber Infrastructure ACI before build 5.0.1-61, Acronis Cyber Infrastructure ACI before build 5.1.1-71, Acronis Cyber Infrastructure ACI before build 5.2.1-69, Acronis Cyber Infrastructure ACI...

CVE-2022-28805 affecting package lua for versions less than 5.4.4-2

CVE-2022-28805 affecting package lua for versions less than 5.4.4-2. A patched version of the package is available...

CVE-2022-33099 affecting package lua for versions less than 5.4.4-2

CVE-2022-33099 affecting package lua for versions less than 5.4.4-2. A patched version of the package is available...

CentOS 9 : lua-5.4.4-3.el9

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the lua-5.4.4-3.el9 build changelog. - singlevar in lparser.c in Lua from including 5.4.0 up to excluding 5.4.4 lacks a certain luaKexp2anyregup call, leading to a heap-based buffer over-re...

CVE-2023-32121

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Highfivery LLC Zero Spam for WordPress allows SQL Injection.This issue affects Zero Spam for WordPress: from n/a through 5.4.4...

Cross site scripting

XWiki Platform is a generic wiki platform. Starting in version 5.4.4 and prior to versions 14.4.8, 14.10.4, and 15.0, a stored cross-site scripting vulnerability can be exploited by users with edit rights by adding a AppWithinMinutes.FormFieldCategoryClass class on a page and setting the payload ...

XWiki Platform 跨站脚本漏洞

XWiki Platform is a suite of Wiki platforms for creating web collaboration applications from the XWiki Foundation in France. A security vulnerability exists in XWiki Platform 5.4.4 and earlier versions, which stems from a stored cross-site scripting XSS vulnerability in the name parameter...

CVE-2023-27429

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Automattic - Jetpack CRM team Jetpack CRM plugin = 5.4.4 versions...

PT-2023-21117 · WordPress · Jetpack Crm

Name of the Vulnerable Software and Affected Versions: Jetpack CRM plugin versions prior to 5.4.4 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin or higher privileges. Recommendations: For versions prior to 5.4.4, update...

CVE-2021-44964 affecting package lua for versions less than 5.4.4-1

CVE-2021-44964 affecting package lua for versions less than 5.4.4-1. An upgraded version of the package is available that resolves this issue...

WordPress Zero Spam Plugin <= 5.4.4 is vulnerable to SQL Injection

Software Zero Spam Type Plugin Vulnerable versions = 5.4.4 Fixed in 5.4.5 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-32121 Patch priority Low CVSS severity Low 7.6 Developer Highfivery PSID e207350207ef Credits OZ1NG TOOR, LISA Required privilege Administrator Published ...

WordPress Coupon Affiliates Plugin <= 5.4.3 is vulnerable to Cross Site Scripting (XSS)

Software Coupon Affiliates Type Plugin Vulnerable versions = 5.4.3 Fixed in 5.4.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-28992 Patch priority Medium CVSS severity Medium 7.1 Developer RelyWP PSID 3cc060340a7c Credits thiennv Required privile...

lua security update

5.4.4-2 - Resolves CVE-2021-43519 5.4.4-1 - Rebase to lua 5.4.4 - Resolves CVE-2021-44964 5.4.2-7 - Fix up CVE-2022-33099 patch 5.4.2-6 - Enable gating 5.4.2-5 - apply upstream fix for CVE-2022-33099...

CVE-2023-23941

SwagPayPal is a PayPal integration for shopware/platform. If JavaScript-based PayPal checkout methods are used PayPal Plus, Smart Payment Buttons, SEPA, Pay Later, Venmo, Credit card, the amount and item list sent to PayPal may not be identical to the one in the created order. The problem has bee...