VulnCheck KEV: CVE-2020-36837

The ThemeGrill Demo Importer plugin for WordPress is vulnerable to authentication bypass due to a missing capability check on the resetwizardactions function in versions 1.3.4 through 1.6.1. This makes it possible for authenticated attackers to reset the WordPress database. After which, if...

CVE-2024-9860

The Bridge Core plugin for WordPress is vulnerable to unauthorized modification of data or loss of data due to a missing capability check on the 'importaction' and 'installpluginperdemo' functions in versions up to, and including, 3.3. This makes it possible for authenticated attackers with...

CVE-2024-9860 Bridge Core <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Demo Import

The Bridge Core plugin for WordPress is vulnerable to unauthorized modification of data or loss of data due to a missing capability check on the 'importaction' and 'installpluginperdemo' functions in versions up to, and including, 3.3. This makes it possible for authenticated attackers with...

PT-2024-39892 · WordPress · The Bridge Core

Name of the Vulnerable Software and Affected Versions: The Bridge Core plugin for WordPress versions up to, and including, 3.3 Description: The issue allows authenticated attackers with subscriber-level permissions or above to modify or lose data due to a missing capability check on the import...

WordPress Bridge Core plugin <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Demo Import vulnerability

Missing Authorization to Authenticated Subscriber+ Demo Import vulnerability discovered by István Márton in WordPress Plugin Bridge Core versions = 3.3...

angular-base64-upload 安全漏洞

angular-base64-upload is a library by the individual developers of Adones Pitogo. A security vulnerability exists in angular-base64-upload prior to version 0.1.21, which stems from vulnerability to an unauthenticated remote code execution attack via demo/server.php...

Auto-Identification Smart Glasses

Two students have created a demo of a smart-glasses app that performs automatic facial recognition and then information lookups. Kind of obvious--something similar was done in 2011--but the sort of creepy demo that gets attention. News article...

Malicious code in buy-sell-opensea-sdk-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 387f6a252dc97ef83ae3456d6a7d81fa5f49202e6cd416597e3d07d7317ae014 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9136 Malicious code in buy-sell-opensea-sdk-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 387f6a252dc97ef83ae3456d6a7d81fa5f49202e6cd416597e3d07d7317ae014 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Exploit for Improper Restriction of XML External Entity Reference in Adobe Commerce

CVE 2024-34102 - CosmicSting XXE Vulnerability in Adobe Commer...

WordPress Easy Demo Importer plugin <= 1.1.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by Francesco Carlucci in WordPress Plugin Easy Demo Importer versions = 1.1.2...

CVE-2024-9071

The Easy Demo Importer – A Modern One-Click Demo Import Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2024-9071

The Easy Demo Importer – A Modern One-Click Demo Import Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2024-9071 Easy Demo Importer – A Modern One-Click Demo Import Solution <= 1.1.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The Easy Demo Importer – A Modern One-Click Demo Import Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2024-9071

CVE-2024-9071 relates to the WordPress plugin “Easy Demo Importer – A Modern One-Click Demo Import Solution.” The vulnerability is a stored XSS via SVG file uploads in all versions up to 1.1.2, caused by insufficient input sanitization and output escaping. Exploitation requires authentication at ...

PT-2024-39405 · WordPress · The Easy Demo Importer

Name of the Vulnerable Software and Affected Versions: The Easy Demo Importer – A Modern One-Click Demo Import Solution plugin for WordPress versions up to, and including, 1.1.2 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input...

WordPress Easy Demo Importer Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)

Software Easy Demo Importer Type Plugin Vulnerable versions = 1.1.2 Fixed in 1.1.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9071 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 21cb9fa43790 Credits Francesco Carlucci...

WordPress plugin Easy Demo Importer 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2024-9172

The Demo Importer Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

CVE-2024-9172 Demo Importer Plus <= 2.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The Demo Importer Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...