PT-2024-16549

Name of the Vulnerable Software and Affected Versions Admin and Site Enhancements ASE plugin for WordPress versions prior to 7.5.2 Description The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows...

CVE-2024-5792

CVE-2024-5792 affects Houzez CRM (WordPress) plugin up to version 1.4.2, exposing a time-based SQL Injection via the notes parameter bel ong_to, exploitable by authenticated users with Custom-level (seller) access or higher. Root cause: insufficient escaping/parameter handling in the existing SQL...

CVE-2024-5792: Improper Neutralization of Special Elements used in an SQL Command

The Houzez CRM plugin for WordPress is vulnerable to time-based SQL Injection via the notes ‘belongto’ parameter in all versions up to, and including, 1.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...