CVE-2023-26687: Improper Limitation of a Pathname to a Restricted Directory

Directory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to obtain sensitive information via the productdata parameter in the PDF Add-on...

CVE-2023-26691: Improper Limitation of a Pathname to a Restricted Directory

Directory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via crafted zip file when installing a new add-on...

CVE-2023-26687

Directory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to obtain sensitive information via the productdata parameter in the PDF Add-on...

CVE-2023-26687

A Directory Traversal vulnerability exists in CS-Cart MultiVendor version 4.16.1 within the PDF Add-on . Remote attackers can exploit this flaw by manipulating the product_data parameter to access sensitive files or directories that should be restricted. As a workaround, it is recommended to disa...

CVE-2023-26687

Directory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to obtain sensitive information via the productdata parameter in the PDF Add-on...

CVE-2023-26691

A Directory Traversal vulnerability exists in CS-Cart MultiVendor version 4.16.1 due to insufficient control over resources with dynamic management. Remote attackers can exploit this flaw by providing a crafted zip file during the installation of a new add-on, which can lead to arbitrary code exe...

PT-2024-12108 · Cs Cart Multivendor +1 · Pdf Add-On +1

Name of the Vulnerable Software and Affected Versions: CS-Cart MultiVendor version 4.16.1 Description: The issue allows remote attackers to obtain sensitive information via the product data parameter in the PDF Add-on. This is a Directory Traversal vulnerability, which can be exploited to access...

PT-2024-29967 · Openhab · Cometvisu Add-On +1

Name of the Vulnerable Software and Affected Versions: openHAB CometVisu add-on versions prior to 4.2.1 Description: The issue affects several endpoints in the CometVisu add-on of openHAB that do not require authentication, allowing unauthenticated attackers to modify or steal sensitive data. Thi...

PT-2024-29965 · Openhab +1 · Openhab +1

Name of the Vulnerable Software and Affected Versions: openHAB versions prior to 4.2.1 Description: The issue concerns the CometVisu add-on of openHAB, which has file system endpoints that do not require authentication. Additionally, the endpoint to update an existing file is susceptible to path...

PT-2024-29963

Name of the Vulnerable Software and Affected Versions openHAB's CometVisu add-on versions prior to 4.2.1 Description The proxy endpoint of openHAB's CometVisu add-on can be accessed without authentication, allowing for Server-Side Request Forgery SSRF and Cross-Site Scripting XSS vulnerabilities...

CVE-2024-41696

Priority PRI WEB Portal Add-On for Priority ERP on prem - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor...

WordPress Paid Memberships Pro - Member Directory Add On plugin < 1.2.6 - Contributor+ Sensitive Information Disclosure and SQLi vulnerability

WordPress Paid Memberships Pro - Member Directory Add On plugin 1.2.6 - Contributor+ Sensitive Information Disclosure and SQLi vulnerability discovered by Scott Kingsley Clark in WordPress Plugin Paid Memberships Pro - Member Directory Add On versions 1.2.6...

CVE-2024-1287 Paid Memberships Pro - Member Directory Add On < 1.2.6 - Contributor+ Sensitive Information Disclosure via SQLi

The pmpro-member-directory WordPress plugin before 1.2.6 does not prevent users with at least the contributor role from leaking other users' sensitive information, including password hashes via an SQLi vector...

CVE-2024-1287 Paid Memberships Pro - Member Directory Add On < 1.2.6 - Contributor+ Sensitive Information Disclosure via SQLi

The pmpro-member-directory WordPress plugin before 1.2.6 does not prevent users with at least the contributor role from leaking other users' sensitive information, including password hashes via an SQLi vector...

CVE-2024-1286 Paid Memberships Pro - Membership Maps Add On < 0.7 - Contributor+ Sensitive Information Disclosure

The pmpro-membership-maps WordPress plugin before 0.7 does not prevent users with at least the contributor role from leaking sensitive information about users with a membership on the site...

CVE-2024-41696: Exposure of Sensitive Information to an Unauthorized Actor

Priority PRI WEB Portal Add-On for Priority ERP on prem - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor...

PT-2024-29517 · Priority · Pri Web Portal Add-On For Priority Erp

Name of the Vulnerable Software and Affected Versions: PRI WEB Portal Add-On for Priority ERP on prem affected versions not specified Description: The issue concerns exposure of sensitive information to an unauthorized actor, as described by CWE-200. Recommendations: At the moment, there is no...

CVE-2024-4544: Authentication Bypass Using an Alternate Path or Channel

The Pie Register - Social Sites Login Add on plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.7. This is due to insufficient verification on the user being supplied during a social login through the plugin. This makes it possible for unauthenticate...

PT-2024-31629

Name of the Vulnerable Software and Affected Versions: The Pie Register - Social Sites Login Add on plugin for WordPress versions up to, and including, 1.7.7 PHP versions 8.3 up to 8.3.8 PHP versions 8.2 up to 8.2.20 PHP versions 8.1 up to 8.1.29 Description: The issue is due to insufficient...

CVE-2023-47220

An OS command injection vulnerability has been reported to affect Media Streaming add-on. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following version: Media Streaming add-on 500.1.1.5...