PT-2024-39775

Name of the Vulnerable Software and Affected Versions Easy SVG Upload plugin for WordPress version 1.0 and earlier Description The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows authenticated attackers...

PT-2024-39612

Name of the Vulnerable Software and Affected Versions The Black Widgets For Elementor plugin for WordPress versions up to, and including, 1.3.7 Description The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This...

PT-2024-34154

Name of the Vulnerable Software and Affected Versions: I, Librarian versions prior to 5.11.2 Description: The issue arises from a broken logic in handling Supplemental Files, allowing unsafe files with Javascript to be executed within the application context. An attacker can exploit this by...

CVE-2024-5982

A path traversal vulnerability exists in the latest version of gaizhenbiao/chuanhuchatgpt. The vulnerability arises from unsanitized input handling in multiple features, including user upload, directory creation, and template loading. Specifically, the loadchathistory function in...

CVE-2024-5982

CVE-2024-5982 affects gaizhenbiao/chuanhuchatgpt. Vulnerabilities stem from unsanitized user input used with directory paths via os.path.join, impacting: load_chat_history (arbitrary file uploads potentially enabling RCE), get_history_names (arbitrary directory creation), and load_template (possi...

CVE-2024-9376

The Kata Plus – Addons for Elementor – Widgets, Extensions and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.4.7 due to insufficient input sanitization and output escaping. This makes it possible for...

WordPress plugin aDirectory 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress plugin SurveyJS 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

WordPress plugin Multi Purpose Mail Form 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in...

WordPress plugin Ajar in5 Embed 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

CVE-2024-9376: Improper Neutralization of Input During Web Page Generation

The Kata Plus – Addons for Elementor – Widgets, Extensions and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.4.7 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2024-34201 · WordPress · Surveyjs: Drag & Drop Wordpress Form Builder

Name of the Vulnerable Software and Affected Versions: SurveyJS: Drag & Drop WordPress Form Builder versions 1.9.136 and earlier Description: The issue is related to an Unrestricted Upload of File with Dangerous Type vulnerability. This means that the software may allow uploading files of dangero...

WordPress plugin Automatic Translation 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in...

WordPress plugin Woocommerce Product Design 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

PT-2024-34259 · Unknown · Woocommerce Product Design

Name of the Vulnerable Software and Affected Versions: WooCommerce Product Design versions prior to 1.0.0 Description: The issue allows for the unrestricted upload of files with dangerous types, potentially enabling an attacker to upload a web shell to a web server. Recommendations: For versions...

PT-2024-34261 · Unknown · Mahlamusa Multi Purpose Mail Form

Name of the Vulnerable Software and Affected Versions: Mahlamusa Multi Purpose Mail Form versions 1.0.2 and earlier Description: The issue allows for the unrestricted upload of files with dangerous types, potentially enabling an attacker to upload a web shell to a web server. Recommendations: For...

ChuanhuChatGPT 路径遍历漏洞

ChuanhuChatGPT is an application by the individual developer Chuan Hu. It provides a fast and easy-to-use web graphical interface and many additional features for various LLMs such as ChatGPT. A path traversal vulnerability exists in ChuanhuChatGPT, which stems from the presence of a path travers...

PT-2024-34273 · Widgilabs · Widgilabs Plugin Propagator

Name of the Vulnerable Software and Affected Versions: WidgiLabs Plugin Propagator versions 0.1 and earlier Description: The issue allows for the unrestricted upload of files with dangerous types, enabling the upload of a web shell to a web server. This can be exploited to gain unauthorized acces...

PT-2024-16257 · Sourcecodester · Sourcecodester Online Hotel Reservation System

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Hotel Reservation System version 1.0 Description: A critical issue has been found in the function upload of the file /guest/update.php, where the manipulation of the image argument leads to unrestricted upload. This issu...

CVE-2024-9116

The Monkee-Boy Essentials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...