12745 matches found
WordPress Advanced File Manager plugin <= 5.2.10 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability
Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by Joshua Provoste in WordPress Plugin Advanced File Manager versions = 5.2.10...
PT-2024-34900 · Aruba · Clearpass Policy Manager
Name of the Vulnerable Software and Affected Versions: ClearPass Policy Manager affected versions not specified Description: An authenticated remote code execution issue in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on t...
PT-2024-35803 · Aruba · Clearpass Policy Manager
Name of the Vulnerable Software and Affected Versions: ClearPass Policy Manager affected versions not specified Description: A vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. Successfu...
WordPress plugin BMLT Tabbed Map has a cross-site scripting vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
WordPress CMSMasters Elementor Addon plugin <= 1.14.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via Multiple Widgets vulnerability discovered by István Márton in WordPress Plugin CMSMasters Elementor Addon versions = 1.14.7...
PT-2024-9306 · Sap · Sap Netweaver Administrator
Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Administrator affected versions not specified Description: The issue allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests, potentially resulting in...
CVE-2024-8066
The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file uploads due to missing validation in the 'fsConnector' function in all versions up to, and including, 1.8.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted...
CVE-2024-9669
The File Manager Pro – Filester plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and including, 1.8.5 via the 'fmlocale' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute...
PT-2024-17239 · WordPress · Legalweb Cloud
Name of the Vulnerable Software and Affected Versions: LegalWeb Cloud plugin for WordPress versions up to, and including, 1.1.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's legalweb-popup shortcode due to insufficient input sanitization and output escaping on...
WordPress plugin EmbedPress has a cross-site scripting vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripti...
PT-2024-16987 · WordPress · Ragic Shortcode
Name of the Vulnerable Software and Affected Versions: Ragic Shortcode plugin for WordPress versions up to, and including, 1.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'ragic' shortcode due to insufficient input sanitization and output escaping on...
WordPress Primary Addon for Elementor plugin <= 1.6.2 - Authenticated (Contributor+) Post Disclosure vulnerability
Authenticated Contributor+ Post Disclosure vulnerability discovered by Francesco Carlucci in WordPress Plugin Primary Addon for Elementor versions = 1.6.2...
WordPress Ragic Shortcode plugin <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zakaria in WordPress Plugin Ragic Shortcode versions = 1.2...
WordPress LegalWeb Cloud plugin <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by SOPROBRO in WordPress Plugin LegalWeb Cloud versions = 1.1.2...
WordPress HLS Player plugin <= 1.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by SOPROBRO in WordPress Plugin HLS Player versions = 1.0.10...
CVE-2024-21703
This Medium severity Security Misconfiguration vulnerability was introduced in version 8.8.1 of Confluence Data Center and Server for Windows installations. This Security Misconfiguration vulnerability, with a CVSS Score of 6.4 allows an authenticated attacker of the Windows host to read sensitiv...
WordPress Internal Linking for SEO traffic & Ranking – Auto internal links (100% automatic) plugin <= 1.2.1 - Authenticated (Administrator+) SQL Injection via post_id Parameter vulnerability
Authenticated Administrator+ SQL Injection via postid Parameter vulnerability discovered by kr0d in WordPress Plugin Internal Linking for SEO traffic & Ranking – Auto internal links 100% automatic versions = 1.2.1...
CVE-2024-11025 SMA: SQL injection in Sunny Central UP
An authenticated attacker with low privileges may use a SQL Injection vulnerability in the affected products administration panel to gain read and write access to a specific log file of the device...
CVE-2024-10895 Counter Up – Animated Number Counter & Milestone Showcase <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Counter Up – Animated Number Counter & Milestone Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'lgx-counter' shortcode in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping on user supplied...