CVE-2024-36694

OpenCart 4.0.2.3 is vulnerable to Server-Side Template Injection SSTI via the Theme Editor Function...

CVE-2024-12293

The User Role Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.64.3. This is due to missing or incorrect nonce validation on the updateroles function. This makes it possible for unauthenticated attackers to add or remove roles for...

CVE-2024-12293 User Role Editor <= 4.64.3 - Cross-Site Request Forgery to Privilege Escalation

The User Role Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.64.3. This is due to missing or incorrect nonce validation on the updateroles function. This makes it possible for unauthenticated attackers to add or remove roles for...

CVE-2024-12293

CVE-2024-12293 concerns the WordPress plugin User Role Editor. The vulnerability is a CSRF flaw in update_roles() that allows unauthenticated attackers to add or remove roles for arbitrary users, potentially escalating privileges to administrator. Affected versions are all up to and including 4.6...

WordPress Plugin User Role Editor Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site request forge...

PT-2024-17531 · WordPress · User Role Editor

Name of the Vulnerable Software and Affected Versions: User Role Editor plugin for WordPress versions up to, and including, 4.64.3 Description: The issue is due to missing or incorrect nonce validation on the update roles function, making it possible for unauthenticated attackers to add or remove...

Foxit PDF Editor < 13.1.5 / 2024.4 Multiple Vulnerabilities

According to its version, the Foxit PDF Editor application previously named Foxit PhantomPDF installed on the remote Windows host is prior to 2024.4/13.1.5. It is, therefore affected by multiple vulnerabilities: - A use-after-free vulnerability exists in the way Foxit Reader 2024.3.0.26795 handle...

CVE-2024-12293: Cross-Site Request Forgery (CSRF)

The User Role Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.64.3. This is due to missing or incorrect nonce validation on the updateroles function. This makes it possible for unauthenticated attackers to add or remove roles for...

Input Method Editor (IME) Code Execution

The vulnerability of the Input Method Editor IME component in Microsoft Windows systems is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

Foxit PDF Editor < 11.2.12 / 12.1.9 Multiple Vulnerabilities

According to its version, the Foxit PDF Editor application previously named Foxit PhantomPDF installed on the remote Windows host is prior to 12.1.9/11.2.12. It is, therefore affected by multiple vulnerabilities: - A use-after-free vulnerability exists in the way Foxit Reader 2024.3.0.26795 handl...

WordPress User Role Editor plugin <= 4.64.3 - Cross-Site Request Forgery to Privilege Escalation vulnerability

Cross-Site Request Forgery to Privilege Escalation vulnerability discovered by vgo0 in WordPress Plugin User Role Editor versions = 4.64.3...

CVE-2024-54249

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jules Colle Advanced Options Editor allows Reflected XSS.This issue affects Advanced Options Editor: from n/a through 1.0...

CVE-2024-54249

The CVE-2024-54249 entry covers a Reflected Cross-Site Scripting vulnerability in the WordPress plugin “Advanced Options Editor” (versions n/a through 1.0). The root cause is improper neutralization of input during web page generation, enabling reflected XSS. Affected component is the plugin’s in...

CVE-2024-54249 WordPress Advanced Options Editor plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jules Colle Advanced Options Editor allows Reflected XSS.This issue affects Advanced Options Editor: from n/a through 1.0...

CVE-2024-55973

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in rnystrom TSB Occasion Editor tsb-occasion-editor allows SQL Injection.This issue affects TSB Occasion Editor: from n/a through = 1.2.1...

CVE-2024-55973 WordPress TSB Occasion Editor plugin <= 1.2.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in rnystrom TSB Occasion Editor tsb-occasion-editor allows SQL Injection.This issue affects TSB Occasion Editor: from n/a through = 1.2.1...

CVE-2024-55973 WordPress TSB Occasion Editor plugin <= 1.2.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in rnystrom TSB Occasion Editor tsb-occasion-editor allows SQL Injection.This issue affects TSB Occasion Editor: from n/a through = 1.2.1...

CVE-2024-55973

CVE-2024-55973 is an SQL Injection vulnerability in the WordPress plugin "TSB Occasion Editor" (affected: TSB Occasion Editor: from n/a through 1.2.1). Root cause: improper neutralization of inputs used in SQL commands. Public references identify the issue as an authenticated SQL injection (Subsc...

WordPress plugin TSB Occasion Editor has a SQL injection vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

PT-2024-36625

Name of the Vulnerable Software and Affected Versions TSB Occasion Editor versions 1.2.1 and earlier Description The issue is related to an improper neutralization of special elements used in an SQL command, also known as 'SQL Injection'. This allows attackers to inject SQL code, potentially...