OTRS Security Vulnerabilities

OTRS is a software application from the German company OTRS. A service management software. A security vulnerability exists in OTRS and OTRS Community Edition that stems from a path traversal vulnerability in the file upload functionality that allows an authenticated user to upload potentially...

GHSA-WR3C-6C22-M9V6 Privilege Escalation in TYPO3 Neos

It has been discovered that TYPO3 Neos is vulnerable to Privilege Escalation. Logged in editors could access, create and modify content nodes that exist in the workspace of other editors...

Privilege Escalation in TYPO3 Neos

It has been discovered that TYPO3 Neos is vulnerable to Privilege Escalation. Logged in editors could access, create and modify content nodes that exist in the workspace of other editors...

CVE-2024-36267

Path traversal vulnerability exists in Redmine DMSF Plugin versions prior to 3.1.4. If this vulnerability is exploited, a logged-in user may obtain or delete arbitrary files on the server within the privilege of the Redmine process...

CVE-2024-4531

The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions such as editing cards via CSRF attacks...

CVE-2024-4532

The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions such as deleting cards via CSRF attacks...

CVE-2024-4535

The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

CVE-2024-4529

The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions such as deleting card categories via CSRF attacks...

CVE-2024-4531

CVE-2024-4531: The WordPress Business Card plugin (

CVE-2024-4531 Business Card <= 1.0.0 - Card Edit via CSRF

The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions such as editing cards via CSRF attacks...

CVE-2024-4530

CVE-2024-4530 concerns the WordPress plugin “Business Card” up to version 1.0.0, which lacks CSRF checks in several areas. The public records state this could enable attackers to induce logged-in users to perform actions such as editing card categories via CSRF attacks. Technical details from con...

CVE-2024-35110

A reflected XSS vulnerability has been found in YzmCMS 7.1. The vulnerability exists in yzmphp/core/class/application.class.php: when logged-in users access a malicious link, their cookies can be captured by an attacker...

CVE-2024-35110

A reflected XSS vulnerability has been found in YzmCMS 7.1. The vulnerability exists in yzmphp/core/class/application.class.php: when logged-in users access a malicious link, their cookies can be captured by an attacker...

YzmCMS 安全漏洞

Yzmcms is an open source CMS Content Management System by the individual developer of Yzmcms. A security vulnerability exists in YzmCMS version 7.1, which stems from the presence of a reflective cross-site scripting vulnerability that allows an attacker to capture a logged-in user's cookie when...

CVE-2024-3824

The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin reset them via a CSRF attack...

CVE-2024-3749

The SP Project & Document Manager WordPress plugin through 4.71 lacks proper access controllers and allows a logged in user to view and download files belonging to another user...

CVE-2024-3407

The WP Prayer WordPress plugin through 2.0.9 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

CVE-2024-3405

The WP Prayer WordPress plugin through 2.0.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-3749 SP Project & Document Manager <= 4.71 - Subscriber+ File Download via IDOR

The SP Project & Document Manager WordPress plugin through 4.71 lacks proper access controllers and allows a logged in user to view and download files belonging to another user...

CVE-2024-3590

The LetterPress WordPress plugin through 1.2.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks, such as delete arbitrary subscribers...