WordPress Stellissimo Text Box Plugin <= 1.1.4 is vulnerable to Cross Site Scripting (XSS)

Software Stellissimo Text Box Type Plugin Vulnerable versions = 1.1.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35752 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 765d260bef25 Credits Cronus Required privilege...

WordPress plugin Easy Social Like Box - Popup - Sidebar Widget Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress Easy Social Like Box plugin <= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by Krzysztof Zając in WordPress Plugin Easy Social Like Box – Popup – Sidebar Widget versions = 4.0...

Easy Social Like Box – Popup – Sidebar Widget <= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Description The Easy Social Like Box – Popup – Sidebar Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cardozafacebooklikebox' shortcode in all versions up to, and including, 4.0 due to insufficient input sanitization and output escaping on user supplied...

PT-2024-35136 · WordPress · The Easy Social Like Box – Popup – Sidebar Widget

Name of the Vulnerable Software and Affected Versions: The Easy Social Like Box – Popup – Sidebar Widget plugin for WordPress versions up to, and including, 4.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'cardoza facebook like box' shortcode due to...

WordPress Easy Social Like Box – Popup – Sidebar Widget Plugin <= 4.0 is vulnerable to Cross Site Scripting (XSS)

Software Easy Social Like Box – Popup – Sidebar Widget Type Plugin Vulnerable versions = 4.0 Fixed in 4.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5224 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 595d5823e3e8 Credit...

PT-2024-29756 · WordPress · Themesflat Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Themesflat Addons For Elementor plugin for WordPress versions up to, and including, 2.1.1 Description: The issue is related to Stored Cross-Site Scripting in the Themesflat Addons For Elementor plugin for WordPress. This is due to insufficien...

CVE-2024-35592

An arbitrary file upload vulnerability in the Upload function of Box-IM v2.0 allows attackers to execute arbitrary code via uploading a crafted PDF file...

CVE-2024-35592

An arbitrary file upload vulnerability in the Upload function of Box-IM v2.0 allows attackers to execute arbitrary code via uploading a crafted PDF file...

CVE-2024-35592

The open-source chat tool Box-IM v2.0 is affected by an arbitrary file upload vulnerability within its Upload function . An attacker can exploit this by uploading a crafted PDF file to achieve arbitrary code execution . As of the current documentation, no patched version is available. To mitigate...

CVE-2024-35592

An arbitrary file upload vulnerability in the Upload function of Box-IM v2.0 allows attackers to execute arbitrary code via uploading a crafted PDF file...

Box-IM 安全漏洞

Box-IM is an open source Box-IM chat tool modeled after WeChat. A security vulnerability exists in Box-IM v2.0, which originates from an arbitrary file upload vulnerability in the upload function, allowing an attacker to execute arbitrary code by uploading a well-designed PDF file...

PT-2024-26564 · Box-Im · Box-Im

Name of the Vulnerable Software and Affected Versions: Box-IM version 2.0 Description: The issue allows attackers to execute arbitrary code via uploading a crafted PDF file, exploiting an arbitrary file upload vulnerability in the Upload function. Recommendations: For Box-IM version 2.0, consider...

CVE-2024-35592: Improper Neutralization of Input During Web Page Generation

An arbitrary file upload vulnerability in the Upload function of Box-IM v2.0 allows attackers to execute arbitrary code via uploading a crafted PDF file...

PT-2024-18653 · WordPress · Applyonline

Name of the Vulnerable Software and Affected Versions: ApplyOnline – Application Form Builder and Manager plugin for WordPress versions up to, and including, 2.6 Description: The issue allows authenticated attackers with subscriber access or higher to view Application submissions due to a missing...

PT-2024-26552 · Tenda · Tenda Ax1806

Name of the Vulnerable Software and Affected Versions: Tenda AX1806 version 1.0.0.1 Description: The issue is related to a stack overflow that can occur via the iptv.stb.mode parameter in the formSetIptv function. Recommendations: For Tenda AX1806 version 1.0.0.1, as a temporary workaround,...

Foxit PDF Reader ComboBox Code Execution

The vulnerability of the ComboBox control in the PDF document viewing application of the Foxit PDF Reader formerly Foxit Reader is related to the use of memory after it is freed. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code using a specially created file...

CVE-2024-4370: Improper Neutralization of Input During Web Page Generation

The WPZOOM Addons for Elementor Templates, Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget Image Box in all versions up to, and including, 1.1.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

Mozilla Firefox Security Bypass Vulnerability (CNVD-2024-23348)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security bypass vulnerability exists in Mozilla Firefox, which can be exploited by attackers to bypass security restrictions due to a window being disabled even after the file dialog box is displayed...

CVE-2024-4370 WPZOOM Addons for Elementor (Templates, Widgets) <= 1.1.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Box Widget

The WPZOOM Addons for Elementor Templates, Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget Image Box in all versions up to, and including, 1.1.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...