CVE-2024-10033 Aap-gateway: xss on aap-gateway

A vulnerability was found in aap-gateway. A Cross-site Scripting XSS vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the "?next=" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions a...

MAL-2024-9811 Malicious code in sap-actions (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in sap-actions (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-9585 Malicious code in directlinetoactionsongooglelib (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2021-4452

The Google Language Translator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in versions up to, and including, 6.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary we...

CVE-2020-36842

The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to arbitrary file uploads in versions up to and including 0.9.35 . The root cause is a missing capability check on the wpvivid_upload_import_files and wpvivid_upload_files AJAX actions, which allows low-level authenticate...

CVE-2021-4448

The Kaswara Modern VC Addons plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.0.1 due to insufficient capability checking on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of unauthorized actions...

CVE-2021-4448

The Kaswara Modern VC Addons plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.0.1 due to insufficient capability checking on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of unauthorized actions...

CVE-2020-36834

The Discount Rules for WooCommerce plugin for WordPress is vulnerable to missing authorization via several AJAX actions in versions up to, and including, 2.0.2 due to missing capability checks on various functions. This makes it possible for subscriber-level attackers to execute various actions a...

CVE-2020-36833

The Indeed Membership Pro plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on various AJAX actions in versions 7.3 - 8.6. This makes it possible for authenticated attacker, with minimal permission, such as a subscriber, to perform a variety of actions su...

CVE-2020-36831

The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on multiple user privilege/security functions provided in versions up to, and including 4.3.17. This makes it possible for low-privileged attackers, like...

CVE-2020-36831

The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on multiple user privilege/security functions provided in versions up to, and including 4.3.17. This makes it possible for low-privileged attackers, like...

CVE-2019-25214

The ShopWP plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST API routes in versions up to, and including, 2.0.4. This makes it possible for unauthenticated attackers to call the endpoints and perform unauthorized actions such as updating...

CVE-2020-36839 WP Lead Plus X <= 0.99 - Cross-Site Request Forgery

The WP Lead Plus X plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.99. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to perform administrative actions, such as...

CVE-2020-36839

The CVE covers the WordPress plugin WP Lead Plus X, affected through version 0.99. The vulnerability is a Cross-Site Request Forgery due to missing or incorrect nonce validation on several functions, enabling unauthenticated attackers to trigger administrative actions such as adding pages or inje...

CVE-2020-36833

The CVE concerns the Indeed Membership Pro plugin for WordPress (versions 7.3–8.6). The underlying issue is missing capability checks on various AJAX actions, leading to an authorization bypass. This can allow an authenticated attacker with minimal privileges (e.g., a subscriber) to perform actio...

CVE-2020-36833 Indeed Membership Pro 7.3 - 8.6 - Missing Authorization Checks

The Indeed Membership Pro plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on various AJAX actions in versions 7.3 - 8.6. This makes it possible for authenticated attacker, with minimal permission, such as a subscriber, to perform a variety of actions su...

CVE-2020-36833 Indeed Membership Pro 7.3 - 8.6 - Missing Authorization Checks

The Indeed Membership Pro plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on various AJAX actions in versions 7.3 - 8.6. This makes it possible for authenticated attacker, with minimal permission, such as a subscriber, to perform a variety of actions su...

CVE-2020-36837 ThemeGrill Demo Importer 1.3.4 - 1.6.1 - Authorization Bypass to Site Reset

The ThemeGrill Demo Importer plugin for WordPress is vulnerable to authentication bypass due to a missing capability check on the resetwizardactions function in versions 1.3.4 through 1.6.1. This makes it possible for authenticated attackers to reset the WordPress database. After which, if there ...

CVE-2019-25215

The ARI-Adminer plugin for WordPress is vulnerable to authorization bypass in versions up to and including 1.1.14 . The root cause is a lack of file access controls in nearly every file of the plugin, allowing unauthenticated attackers to call files directly. This could lead to unauthorized actio...