WordPress Elementor – Header, Footer & Blocks Template Plugin <= 1.6.26 is vulnerable to Content Injection

Software Elementor – Header, Footer & Blocks Template Type Plugin Vulnerable versions = 1.6.26 Fixed in 1.6.27 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2024-2619 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID e650ff9528ff Credits wesley wcraft...

RHEL 5 : mailman (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - mailman: Missing CSRF protection in admin web interface CVE-2016-7123 - Cross-site request forgery CSRF...

RHEL 6 : mailman (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - mailman: CSRF token bypass allows to perform CSRF attacks and account takeover CVE-2021-42097 - mailman:...

GHSA-PWGC-W4X9-GW67 changedetection.io Cross-site Scripting vulnerability

Summary Input in parameter notificationurls is not processed resulting in javascript execution in the application Details changedetection.io version: v0.45.21 https://github.com/dgtlmoon/changedetection.io/blob/0.45.21/changedetectionio/forms.pyL226 for serverurl in field.data: if not...

Car Dealer < 4.16 - Admin+ Content Injection

Description The Car Dealer Dealership and Vehicle sales plugin for WordPress is vulnerable to unauthorized content injection due to insufficient input validation in all versions up to, and including, 4.15. This makes it possible for authenticated attackers, with administrator-level access and...

Pricing Table by Supsystic < 1.9.13 - Admin+ Content Injection

Description The Pricing Table by Supsystic plugin for WordPress is vulnerable to content injection in all versions up to, and including, 1.9.12. This makes it possible for authenticated attackers, with admin-level access and above, to inject arbitrary content. This is not a security issue by...

WordPress WordPress Meta Data and Taxonomies Filter (MDTF) Plugin <= 1.3.3.2 is vulnerable to Content Injection

Software WordPress Meta Data and Taxonomies Filter MDTF Type Plugin Vulnerable versions = 1.3.3.2 Fixed in 1.3.3.3 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2024-34434 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID 6429b28a33b1 Credits...

WordPress cardealer plugin <= 4.15 - Content Injection vulnerability

Content Injection vulnerability discovered by Yash Chauhan Patchstack Alliance in WordPress Plugin Car Dealer versions = 4.15...

WordPress Car Dealer Plugin <= 4.15 is vulnerable to Content Injection

Software Car Dealer Type Plugin Vulnerable versions = 4.15 Fixed in 4.16 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2024-4214 Patch priority Low CVSS severity Low 2.7 Developer Claim ownership PSID 9f6801c987d5 Credits Yash Chauhan Required privilege Administrator Publish...

The vulnerability of the Go language’s html/template package lies in the lack of checks for input values, allowing attackers to insert arbitrary content into templates.

The vulnerability of the Go language’s html/template package is related to the lack of checks on input values. Exploiting this vulnerability allows a remote attacker to insert arbitrary content into templates...

CVE-2023-48763 WordPress JetFormBuilder plugin <= 3.1.4 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Crocoblock JetFormBuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.1.4...

CVE-2023-48763 WordPress JetFormBuilder plugin <= 3.1.4 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Crocoblock JetFormBuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.1.4...

CVE-2023-23989 WordPress RegistrationMagic plugin <= 5.1.9.2 - Content Injection

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Code Injection.This issue affects RegistrationMagic: from n/a through = 5.1.9.2...

CVE-2023-23989 WordPress RegistrationMagic plugin <= 5.1.9.2 - Content Injection

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Metagauss RegistrationMagic.This issue affects RegistrationMagic: from n/a through 5.1.9.2...

WordPress Pricing Table by Supsystic plugin <= 1.9.12 - Content Injection vulnerability

Content Injection vulnerability discovered by Steven Julian Patchstack Alliance in WordPress Plugin Pricing Table by Supsystic versions = 1.9.12...

WordPress Pricing Table by Supsystic Plugin <= 1.9.12 is vulnerable to Content Injection

Software Pricing Table by Supsystic Type Plugin Vulnerable versions = 1.9.12 Fixed in 1.9.13 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2024-32790 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 432ab1264c03 Credits Steven Julian Required privilege...

CVE-2024-1463

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Course, Lesson, and Quiz title and content in all versions up to, and including, 4.2.6.3 due to insufficient input sanitization and output escaping. This makes it possible for...

WordPress Post Type Builder (PTB) Plugin < 2.1.4 is vulnerable to Content Injection

Software Post Type Builder PTB Type Plugin Vulnerable versions 2.1.4 Fixed in 2.1.4 OWASP Top 10 A1: Broken Access Control Classification Content Injection CVE CVE-2024-31366 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 60019a0448c7 Credits Dave Jong Patchstack...

Sensitive Information Disclosure

go is vulnerable to Sensitive Information Disclosure. The vulnerability is due to errors returned from MarshalJSON methods containing user-controlled data, which can break contextual auto-escaping behavior, leading to unexpected content injection into templates...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.22 (SUSE-SU-2024:0812-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0812-1 advisory. - Upgrade go to version 1.22.1 - CVE-2023-45289: net/http, net/http/cookiejar: incorrect...