ABB Cylon FLXeon 9.3.4 (upload.js) Authenticated Root Remote Code Execution

Summary BACnet® Smart Building Controllers. ABB's BACnet portfolio features a series of BACnet® IP and BACnet MS/TP field controllers for ASPECT® and INTEGRA™ building management solutions. ABB BACnet controllers are designed for intelligent control of HVAC equipment such as central plant, boiler...

WordPress MultiLoca plugin <= 4.1.11 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Aiden Thái An in WordPress Plugin MultiLoca versions = 4.1.11...

WordPress Jupiter X Core plugin <= 4.8.7 - Authenticated (Contributor+) SVG Upload to Local File Inclusion (Remote Code Execution) vulnerability

Authenticated Contributor+ SVG Upload to Local File Inclusion Remote Code Execution vulnerability discovered by stealthcopter in WordPress Plugin JupiterX Core versions = 4.8.7...

WordPress Jupiterx Core plugin <= 4.8.7 - Authenticated (Contributor+) Arbitrary File Read vulnerability

Authenticated Contributor+ Arbitrary File Read vulnerability discovered by stealthcopter in WordPress Plugin JupiterX Core versions = 4.8.7...

WordPress eHive Objects Image Grid plugin <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin eHive Objects Image Grid versions = 2.4.1...

WordPress BuddyForms plugin <= 2.8.13 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Max Boll b0lli in WordPress Plugin BuddyForms versions = 2.8.13...

WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Podcast RSS Feed vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Podcast RSS Feed vulnerability discovered by Webbernaut in WordPress Plugin MP3 Audio Player for Music, Radio & Podcast by Sonaar versions = 5.9.3...

WordPress Borderless plugin <= 1.6.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG Upload vulnerability discovered by Francesco Carlucci in WordPress Plugin Borderless versions = 1.6.2...

WordPress SeatReg plugin <= 1.56.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zakaria in WordPress Plugin SeatReg versions = 1.56.0...

WordPress WP Dispensary plugin <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zaim in WordPress Plugin WP Dispensary versions = 4.5.0...

WordPress Typer Core plugin <= 1.9.6 - Authenticated (Contributor+) Post Disclosure vulnerability

Authenticated Contributor+ Post Disclosure vulnerability discovered by Francesco Carlucci in WordPress Plugin Typer Core versions = 1.9.6...

WordPress WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress plugin <= 1.7.5 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by Peter Thaleikis in WordPress Plugin WordPress Survey & Poll versions = 1.7.5...

WordPress Storely plugin <= 16.6 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by stealthcopter in WordPress Theme Storely versions = 16.6...

WordPress WP Post List Table plugin <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin WP Post List Table versions = 1.0.3...

WordPress Embed Swagger UI plugin <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by SOPROBRO in WordPress Plugin Embed Swagger UI versions = 1.0.0...

WordPress Divi Torque Lite plugin <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Multiple Widgets vulnerability discovered by Webbernaut in WordPress Plugin DiviTorque – Divi Theme, Divi Builder and Extra Theme versions = 4.1.0...

Drupal Drupal Admin LTE theme module * - Authenticated Other Vulnerability Type vulnerability

Authenticated Other Vulnerability Type vulnerability discovered by Drupal Security Site in WordPress Module Drupal Admin LTE theme versions...

WordPress Philantro plugin <= 5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via donate Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via donate Shortcode vulnerability discovered by SOPROBRO in WordPress Plugin Philantro versions = 5.3...

WordPress MPG plugin <= 4.0.5 - Authenticated (Editor+) Server-Side Request Forgery via fileUrl vulnerability

Authenticated Editor+ Server-Side Request Forgery via fileUrl vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin MPG versions = 4.0.5...

WordPress Masy Gallery plugin <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin Masy Gallery versions = 1.7...