CVE-2024-13232 WordPress Awesome Import & Export Plugin - Import & Export WordPress Data <= 4.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary SQL Execution/Privilege Escalation

The WordPress Awesome Import & Export Plugin - Import & Export WordPress Data plugin for WordPress is vulnerable arbitrary SQL Execution and privilege escalation due to a missing capability check on the renderImport function in all versions up to, and including, 4.1.1. This makes it possible for...

CVE-2024-13811 Lafka - Multi Store Burger - Pizza & Food Delivery WooCommerce Theme <= 4.5.7 - Missing Authorization to Authenticated (Subscriber+) Demo Import

The Lafka - Multi Store Burger - Pizza & Food Delivery WooCommerce Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'lafkaimportlafka' AJAX actions in all versions up to, and including, 4.5.7. This makes it possible for authenticated attacker...

CVE-2024-13811

CVE-2024-13811 concerns the Lafka - Multi Store Burger - Pizza & Food Delivery WooCommerce Theme for WordPress (versions

WordPress plugin Lafka 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2024-37601

An issue was discovered in Mercedes Benz NTG New Telematics Generation 6. A possible heap buffer overflow exists in the user data import/export function of NTG 6 head units. To perform this attack, local access to the USB interface of the car is needed. With prepared data, an attacker can cause t...

CVE-2024-37601

An issue was discovered in Mercedes Benz NTG New Telematics Generation 6. A possible heap buffer overflow exists in the user data import/export function of NTG 6 head units. To perform this attack, local access to the USB interface of the car is needed. With prepared data, an attacker can cause t...

Mercedes-Benz NTG 安全漏洞

Mercedes-Benz NTG is an automobile from Mercedes-Benz Germany. A security vulnerability exists in Mercedes-Benz NTG 6 that originates from a heap buffer overflow in the User-Data import/export function. An attacker exploiting this vulnerability could cause the User-Data service to crash...

PT-2025-1392 · Mercedes Benz · Ntg 6

Name of the Vulnerable Software and Affected Versions: Mercedes Benz NTG 6 affected versions not specified Description: An issue exists in the user data import/export function of NTG 6 head units, where a possible integer overflow can occur. To exploit this, an attacker needs local access to the...

PT-2025-1199 · Mercedes Benz · Ntg 6

Name of the Vulnerable Software and Affected Versions: Mercedes Benz NTG New Telematics Generation 6 Description: A possible type confusion exists in the user data import/export function of NTG 6 head units. To perform this attack, local access to the USB interface of the car is needed. With...

PT-2025-1198 · Mercedes Benz · Ntg 6 +1

Name of the Vulnerable Software and Affected Versions: Mercedes Benz NTG New Telematics Generation 6 Description: A possible heap buffer overflow exists in the user data import/export function of NTG 6 head units. To perform this attack, local access to the USB interface of the car is needed. Wit...

CVE-2024-55924 Cross-Site Request Forgery in Scheduler Module in TYPO3

TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery CSRF. Additionally, state-changing actions in downstrea...

TYPO3 安全漏洞

TYPO3 is a free and open source content management system framework CMS/CMF from the Swiss TYPO3 Association. A security vulnerability exists in TYPO3 versions 11.0.0 to 11.5.41, which stems from the vulnerability of the back-end user interface deep-linking functionality to a cross-site request...

CVE-2024-55089

Rhymix 2.1.19 is vulnerable to Server-Side Request Forgery (SSRF) in the background import data function. The issue’s affected component is Rhymix (CMS/framework), with the root cause being insecure handling of server-side requests during the import process. Reported impact includes potential una...

CVE-2021-4448

The Kaswara Modern VC Addons plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.0.1 due to insufficient capability checking on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of unauthorized actions...

PT-2024-11045

Name of the Vulnerable Software and Affected Versions Kaswara Modern VC Addons plugin for WordPress versions up to, and including, 3.0.1 Description The issue is related to insufficient capability checking on various AJAX actions, allowing unauthenticated attackers to perform unauthorized actions...

CVE-2024-1804

The Tutor LMS – Migration Tool plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tutorimportfromxml function in all versions up to, and including, 2.2.0. This makes it possible for authenticated attackers, with subscriber-level access...

CVE-2024-1804 Tutor LMS – Migration Tool <= 2.2.0 - Missing Authorization in tutor_import_from_xml

The Tutor LMS – Migration Tool plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tutorimportfromxml function in all versions up to, and including, 2.2.0. This makes it possible for authenticated attackers, with subscriber-level access...

CVE-2024-6033

The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized data importation due to a missing capability check on the 'importfile' function in all versions up to, and including, 4.0.4. This makes it possible for authenticated attackers,...

WordPress Eventin plugin <= 4.0.4 - Missing Authorization to Authenticated (Contributor+) Event Data Import vulnerability

Missing Authorization to Authenticated Contributor+ Event Data Import vulnerability discovered by Peter Thaleikis in WordPress Plugin Eventin versions = 4.0.4...

PT-2024-37332 · WordPress · Eventin

Name of the Vulnerable Software and Affected Versions: Eventin plugin for WordPress versions up to, and including, 4.0.4 Description: The issue is related to unauthorized data importation due to a missing capability check on the import file function. This allows authenticated attackers with...