11576 matches found
EUVD-2024-33676
The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletetmpuploadedfile function in all versions up to, and including, 16.6. This makes it possible for unauthenticated attackers to delete arbitrary files o...
CVE-2024-10828
The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.5 via deserialization of untrusted input during Order export when the "Try to convert serialized values" option is enabled. This makes it possible for...
CVE-2024-10828
CVE-2024-10828 affects the WordPress plugin Advanced Order Export For WooCommerce (
WordPress User Extra Fields Plugin <= 16.6 is vulnerable to Arbitrary File Deletion
Software User Extra Fields Type Plugin Vulnerable versions = 16.6 Fixed in 16.7 OWASP Top 10 A2: Broken Authentication Classification Arbitrary File Deletion CVE CVE-2024-11150 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 5b9352f46ad9 Credits Chloe Chamberland Require...
PT-2024-16790 · WordPress · Wordpress User Extra Fields
Name of the Vulnerable Software and Affected Versions: WordPress User Extra Fields plugin versions up to, and including, 16.6 Description: The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete tmp...
CVE-2024-32116
Multiple relative path traversal vulnerabilities CWE-23 in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5, FortiAnalyzer version 7.4.0 through 7.4.2 and before 7.2.5 and FortiAnalyzer-BigData version 7.4.0 and before 7.2.7 allows a privileged attacker to delete files from the...
CVE-2024-32116
Fortinet FortiManager/FortiAnalyzer vulnerability CVE-2024-32116 involves multiple relative path traversal flaws that allow a privileged attacker to delete files on the underlying filesystem via crafted CLI requests. Affected products and versions: FortiManager 7.4.0–7.4.2 and prior to 7.2.5; For...
CVE-2024-10672
The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the mpgupsertprojectsourceblock function in all versions up to, and including, 4.0.2. This makes it possible for authenticated attackers, with...
CVE-2024-10672
The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the mpgupsertprojectsourceblock function in all versions up to, and including, 4.0.2. This makes it possible for authenticated attackers, with...
CVE-2024-10672 Multiple Page Generator Plugin – MPG <= 4.0.2 - Authenticated (Editor+) Directory Traversal to Limited File Deletion
The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the mpgupsertprojectsourceblock function in all versions up to, and including, 4.0.2. This makes it possible for authenticated attackers, with...
CVE-2024-10672
CVE-2024-10672: The Multiple Page Generator Plugin – MPG for WordPress is vulnerable to directory traversal that enables authenticated attackers with editor-level access (and higher) to delete limited server files. Affected versions are
CVE-2024-10672 Multiple Page Generator Plugin – MPG <= 4.0.2 - Authenticated (Editor+) Directory Traversal to Limited File Deletion
The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the mpgupsertprojectsourceblock function in all versions up to, and including, 4.0.2. This makes it possible for authenticated attackers, with...
WordPress MPG plugin <= 4.0.2 - Authenticated (Editor+) Directory Traversal to Limited File Deletion vulnerability
Authenticated Editor+ Directory Traversal to Limited File Deletion vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin MPG versions = 4.0.2...
PT-2024-8518 · Fortinet · Fortimanager +2
Name of the Vulnerable Software and Affected Versions: FortiManager versions 7.4.0 through 7.4.2 and prior to 7.2.5 FortiAnalyzer versions 7.4.0 through 7.4.2 and prior to 7.2.5 FortiAnalyzer-BigData versions 7.4.0 and prior to 7.2.7 Description: The issue is related to errors in handling relativ...
Path traversal vulnerability in CLI commands
...
WordPress plugin Multiple Page Generator Plugin – MPG 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Multiple...
CVE-2024-51747
Kanboard is project management software that focuses on the Kanban methodology. An authenticated Kanboard admin can read and delete arbitrary files from the server. File attachments, that are viewable or downloadable in Kanboard are resolved through its path entry in the projecthasfiles SQLite db...
WordPress Global Gateway e4 plugin <= 2.0 - Arbitrary File Deletion vulnerability
Arbitrary File Deletion vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin Global Gateway e4 | Payeezy Gateway | versions = 2.0...
WordPress Global Gateway e4 | Payeezy Gateway | Plugin <= 2.0 is vulnerable to Arbitrary File Deletion
Software Global Gateway e4 | Payeezy Gateway | Type Plugin Vulnerable versions = 2.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Deletion CVE CVE-2024-52371 Patch priority High CVSS severity High 8.6 Developer Claim ownership PSID 8614ac115bc9 Credits stealthcopter...
