WordPress The Ultimate WordPress Toolkit plugin <= 3.0.11 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution vulnerability

Missing Authorization to Authenticated Subscriber+ Remote Code Execution vulnerability discovered by stealthcopter in WordPress Plugin The Ultimate WordPress Toolkit – WP Extended versions = 3.0.11...

CVE-2024-54007 Authenticated Remote Command Injection Vulnerability in the Web Interface of a 501 Wireless Client Bridge

Multiple command injection vulnerabilities exist in the web interface of the 501 Wireless Client Bridge which could lead to authenticated remote command execution. Successful exploitation of these vulnerabilities result in the ability of an attacker to execute arbitrary commands as a privileged...

WordPress Coupon Plugin plugin <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by SOPROBRO in WordPress Plugin Coupon versions = 1.2.1...

WordPress App Embed plugin <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zakaria in WordPress Plugin App Embed versions = 2.3.2...

WordPress YOGO Booking plugin <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zaim in WordPress Plugin YOGO Booking versions = 1.6.2...

WordPress Chat Support for Viber plugin <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin Chat Support for Viber versions = 1.7.3...

WordPress Elementor AI Addons plugin <= 2.2.1 - Authenticated (Contributor+) Private Templates Content Disclosure vulnerability

Authenticated Contributor+ Private Templates Content Disclosure vulnerability discovered by Nishiv in WordPress Plugin Elementor AI Addons versions = 2.2.1...

CVE-2024-53345

An authenticated arbitrary file upload vulnerability in Car Rental Management System v1.0 to v1.3 allows attackers to execute arbitrary code via uploading a crafted file...

HPESBNW04763 rev.1 - HPE Aruba Networking 501 Wireless Client Bridge Authenticated Remote Command Injection Vulnerabilities

Potential Security Impact: Remote: Arbitrary Code Execution, Arbitrary Command Execution, Code Execution SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba 501 Client Bridge - Please refer to the "Vulnerability Summary" for version details. HP 501 Wireless Client Bridge - Pleas...

WordPress Marketplace Items plugin <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by zaim in WordPress Plugin Marketplace Items versions = 1.5.5...

WordPress RightMessage WP plugin <= 0.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zaim in WordPress Plugin RightMessage WP versions = 0.9.7...

WordPress Chatroll Live Chat plugin <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin Chatroll Live Chat versions = 2.5.0...

WordPress Sellsy plugin <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by SOPROBRO in WordPress Plugin Sellsy versions = 2.3.3...

ABB Cylon Aspect 3.08.03 (MapServicesHandler) Authenticated Reflected XSS

Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description The ABB BMS/BAS controller suffers from an authenticated reflected...

WordPress Dynamics 365 Integration plugin <= 1.3.23 - Authenticated (Contributor+) Remote Code Execution and Arbitrary File Read via Twig Server-Side Template Injection vulnerability

Authenticated Contributor+ Remote Code Execution and Arbitrary File Read via Twig Server-Side Template Injection vulnerability discovered by Peter Thaleikis in WordPress Plugin Dynamics 365 Integration versions = 1.3.23...

ABB Cylon Aspect 3.08.03 MapServicesHandler Cross Site Scripting Vulnerability

ABB Cylon Aspect version 3.08.03 suffers from an authenticated reflected cross site scripting vulnerability. Input passed to the GET parameters name and id is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML/JS code in a user's browser...

WordPress Avada Builder plugin <= 3.11.12 - Authenticated (Contributor+) Protected Post Disclosure vulnerability

Authenticated Contributor+ Protected Post Disclosure vulnerability discovered by Webbernaut in WordPress Plugin Fusion Builder versions = 3.11.12...

WordPress WP Travel Engine plugin <= 1.3.7 - Authenticated (Contributor+) Local File Inclusion vulnerability

Authenticated Contributor+ Local File Inclusion vulnerability discovered by Webbernaut in WordPress Plugin WP Travel Engine versions = 1.3.7...

WordPress Booking Calendar plugin <= 3.2.19 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by Peter Thaleikis in WordPress Plugin Booking calendar, Appointment Booking System versions = 3.2.19...

WordPress Loan Comparison plugin <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by SOPROBRO in WordPress Plugin Loan Comparison versions = 2.0...