CVE-2024-49772

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. In SuiteCRM versions 7.14.4, poor input validation allows authenticated user do a SQL injection attack. Authenticated user with low pivilege can leak all data in database. This issue has been...

CVE-2024-50523

Unrestricted Upload of File with Dangerous Type vulnerability in RainbowLink Inc. All Post Contact Form allows Upload a Web Shell to a Web Server.This issue affects All Post Contact Form: from n/a through 1.7.3...

CVE-2024-50523 WordPress All Post Contact Form plugin <= 1.8.2 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in RainbowLink Inc. All Post Contact Form allpost-contactform allows Upload a Web Shell to a Web Server.This issue affects All Post Contact Form: from n/a through = 1.8.2...

CVE-2024-50523 WordPress All Post Contact Form plugin <= 1.8.2 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in RainbowLink Inc. All Post Contact Form allpost-contactform allows Upload a Web Shell to a Web Server.This issue affects All Post Contact Form: from n/a through = 1.8.2...

CVE-2024-50523

The CVE-2024-50523 entry documents an Unrestricted Upload of File with Dangerous Type vulnerability in the WordPress plugin All Post Contact Form, allowing an unauthenticated attacker to upload a web shell to the target server. Affected versions include

PT-2024-34300 · Unknown · All Post Contact Form

Name of the Vulnerable Software and Affected Versions: All Post Contact Form versions 1.7.3 and earlier Description: The issue affects the All Post Contact Form, allowing an unrestricted upload of files with dangerous types, such as a web shell, to a web server. This enables attackers to compromi...

CVE-2024-50523: Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type vulnerability in RainbowLink Inc. All Post Contact Form allpost-contactform allows Upload a Web Shell to a Web Server.This issue affects All Post Contact Form: from n/a through = 1.8.2...

WordPress plugin All Post Contact Form 代码问题漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in...

SUSE CVE-2024-47825

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.16 and 1.15.10, a policy rule denying a prefix that is broader than /32 may be ignored if there is a policy rule referencing a more narrow prefix CIDRSe...

CVE-2024-37444: Missing Authorization

Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Defender Security defender-security.This issue affects Defender Security: from n/a through = 4.7.1...

CVE-2024-43118: Missing Authorization

Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hummingbird hummingbird-performance.This issue affects Hummingbird: from n/a through = 3.9.1...

WordPress All Post Contact Form plugin <= 1.8.2 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin All Post Contact Form versions = 1.8.2...

WordPress All Post Contact Form Plugin <= 1.7.8 is vulnerable to Arbitrary File Upload

Software All Post Contact Form Type Plugin Vulnerable versions = 1.7.8 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-50523 Patch priority High CVSS severity High 10 Developer Claim ownership PSID f181d8f37094 Credits stealthcopter Required privilege...

CVE-2024-42041

The com.videodownload.browser.videodownloader aka AppTool-Browser-Video All Video Downloader application 20-30.05.24 for Android allows an attacker to execute arbitrary JavaScript code via the acr.browser.lightning.DefaultBrowserActivity component...

CVE-2024-42041: Improper Control of Generation of Code

The com.videodownload.browser.videodownloader aka AppTool-Browser-Video All Video Downloader application 20-30.05.24 for Android allows an attacker to execute arbitrary JavaScript code via the acr.browser.lightning.DefaultBrowserActivity component...

GHSA-C4Q5-6C82-3QPW Spring Security vulnerable to Authorization Bypass of Static Resources in WebFlux Applications

Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances. For this to impact an application, all of the following must be true: It must be a WebFlux application It must be using Spring's static resources support It...

WordPress All-in-One WP Migration and Backup plugin <= 7.86 - Authenticated (Administrator+) Arbitrary PHP Code Injection vulnerability

Authenticated Administrator+ Arbitrary PHP Code Injection vulnerability discovered by Ryan Kozak in WordPress Plugin All-in-One WP Migration versions = 7.86...

PT-2024-39464

Name of the Vulnerable Software and Affected Versions All-in-One WP Migration and Backup plugin for WordPress versions up to, and including, 7.86 Description The issue allows authenticated attackers with Administrator-level access and above to inject arbitrary PHP code into an export file due to...

WordPress plugin All-in-One WP Migration and Backup 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code injection vulnerability exis...

WordPress All-in-One WP Migration Plugin <= 7.86 is vulnerable to PHP Object Injection

Software All-in-One WP Migration Type Plugin Vulnerable versions = 7.86 Fixed in 7.87 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-9162 Patch priority Low CVSS severity Low 7.2 Developer ServMask, Inc PSID 44c4c1ddd033 Credits Ryan Kozak Required privilege...