11576 matches found
CVE-2024-6312 Funnelforms Free <= 3.7.3.2 - Authenticated (Administrator+) Arbitrary File Deletion
The Funnelforms Free plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.7.3.2 via the 'af2DeleteFontFile' function. This is due to the plugin not properly validating a file or its path prior to deleting it. This makes it possible for...
CVE-2024-6312
CVE-2024-6312 affects the Funnelforms Free WordPress plugin (up to version 3.7.3.2). The flaw is in af2DeleteFontFile where the plugin does not validate the target file/path before deletion, allowing unauthenticated attackers to delete arbitrary files (including wp-config.php), enabling site take...
CVE-2024-6312 Funnelforms Free <= 3.7.3.2 - Authenticated (Administrator+) Arbitrary File Deletion
The Funnelforms Free plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.7.3.2 via the 'af2DeleteFontFile' function. This is due to the plugin not properly validating a file or its path prior to deleting it. This makes it possible for authenticate...
WordPress Funnelforms Free plugin <= 3.7.3.2 - Authenticated (Administrator+) Arbitrary File Deletion vulnerability
Authenticated Administrator+ Arbitrary File Deletion vulnerability discovered by István Márton in WordPress Plugin Funnelforms Free versions = 3.7.3.2...
WordPress Funnelforms Free Plugin <= 3.7.3.2 is vulnerable to Arbitrary File Deletion
Software Funnelforms Free Type Plugin Vulnerable versions = 3.7.3.2 Fixed in 3.7.4.1 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2024-6312 Patch priority Low CVSS severity Low 5.5 Developer Claim ownership PSID 8300ca56d7fc Credits István Márton Required...
WordPress plugin Funnelforms Free 路径遍历漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...
PT-2024-38633 · Sonaar · Mp3 Audio Player – Music Player
Name of the Vulnerable Software and Affected Versions: The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress versions up to, and including, 5.7.0.1 Description: The issue is related to unauthorized arbitrary file deletion due to a missing capability check on t...
PT-2024-37533 · WordPress · Funnelforms Free
Name of the Vulnerable Software and Affected Versions: Funnelforms Free plugin for WordPress versions up to, and including, 3.7.3.2 Description: The issue is related to arbitrary file deletion due to the plugin not properly validating a file or its path prior to deletion. This is made possible vi...
PT-2024-38758
Name of the Vulnerable Software and Affected Versions: The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin versions up to, and including, 2.0.3 Description: The issue is related to PHP Object...
CVE-2024-43356 WordPress oik plugin <= 4.12.0 - Arbitrary File Deletion vulnerability
Cross-Site Request Forgery CSRF vulnerability in bobbingwide.This issue affects oik: from n/a through 4.12.0...
CVE-2024-43356 WordPress oik plugin <= 4.12.0 - Arbitrary File Deletion vulnerability
Cross-Site Request Forgery CSRF vulnerability in bobbingwide.This issue affects oik: from n/a through 4.12.0...
WordPress Droip plugin < 2.5.2 - Arbitrary File Deletion vulnerability
Arbitrary File Deletion vulnerability discovered by Dave Jong Patchstack in WordPress Plugin Droip versions 2.5.2...
WordPress Favicon Generator plugin <= 1.5 - Cross-Site Request Forgery to Arbitrary File Deletion vulnerability
Cross-Site Request Forgery to Arbitrary File Deletion vulnerability discovered by Marco Wotschka in WordPress Plugin Favicon Generator versions = 1.5...
WordPress Droip Plugin <= 1.1.1 is vulnerable to Arbitrary File Deletion
Software Droip Type Plugin Vulnerable versions = 1.1.1 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2024-43955 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 09fa6dd06ae0 Credits Dave Jong Patchstack Required privileg...
Exploit for Deserialization of Untrusted Data in Givewp
This post is a research article published by EQSTLabhttps://g...
Exploit for Deserialization of Untrusted Data in Givewp
This post is a research article published by EQSTLabhttps://g...
CVE-2024-7351
The Simple Job Board plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.3 via deserialization of untrusted input when editing job applications. This makes it possible for authenticated attackers, with Editor-level access and above, to inject a PH...
CVE-2024-7568
The Favicon Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the outputsubadminpage0 function. This makes it possible for unauthenticated attackers to delete arbitrary files on...
CVE-2024-7568 Favicon Generator <= 1.5 - Cross-Site Request Forgery to Arbitrary File Deletion
The Favicon Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the outputsubadminpage0 function. This makes it possible for unauthenticated attackers to delete arbitrary files on...
CVE-2024-7568 Favicon Generator <= 1.5 - Cross-Site Request Forgery to Arbitrary File Deletion
The Favicon Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the outputsubadminpage0 function. This makes it possible for unauthenticated attackers to delete arbitrary files on...