WordPress Ali2Woo Lite Plugin <= 3.3.6 is vulnerable to Broken Access Control

Software Ali2Woo Lite Type Plugin Vulnerable versions = 3.3.6 Fixed in 3.3.7 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-4450 Patch priority Medium CVSS severity Medium 6.3 Developer Claim ownership PSID f7ad6ff2580e Credits Lucio Sá Required privilege...

WordPress Sirv Plugin <= 7.2.6 is vulnerable to Arbitrary File Upload

Software Sirv Type Plugin Vulnerable versions = 7.2.6 Fixed in 7.2.7 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-5853 Patch priority Medium CVSS severity Medium 9.9 Developer Sirv PSID b8d1b016bf81 Credits Lucio Sá Required privilege Contributor Published 18 June,...

WordPress Custom Product List Table Plugin <= 3.0.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Custom Product List Table Type Plugin Vulnerable versions = 3.0.0 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-4541 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 880a62dd6058 Credits Benedictus...

WordPress Page Builder: Live Composer Plugin <= 1.5.50 is vulnerable to Cross Site Scripting (XSS)

Software Page Builder: Live Composer Type Plugin Vulnerable versions = 1.5.50 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35768 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID b331f6102ccd Credits savphill Required privilege...

WordPress WordPress Picture / Portfolio / Media Gallery Plugin <= 3.0.1 is vulnerable to Server Side Request Forgery (SSRF)

Software WordPress Picture / Portfolio / Media Gallery Type Plugin Vulnerable versions = 3.0.1 Fixed in N/A OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2024-5021 Patch priority Low CVSS severity Low 7.2 Developer Claim ownership PSID 4f6e62e03ba9 Credits...

WordPress Squeeze Plugin <= 1.4 is vulnerable to Arbitrary File Upload

Software Squeeze Type Plugin Vulnerable versions = 1.4 Fixed in 1.4.1 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-35767 Patch priority Low CVSS severity Low 9.1 Developer Claim ownership PSID 475c5115f4ba Credits YCInfosec Required privilege Administrator Publishe...

WordPress Login with phone number Plugin <= 1.7.34 is vulnerable to Broken Access Control

Software Login with phone number Type Plugin Vulnerable versions = 1.7.34 Fixed in 1.7.35 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-6125 Patch priority Low CVSS severity Low 8.1 Developer Hamid Alinia PSID b1915aa020d8 Credits István Márton Required...

WordPress WP Magazine Modules Lite Plugin <= 1.1.2 is vulnerable to Local File Inclusion

Software WP Magazine Modules Lite Type Plugin Vulnerable versions = 1.1.2 Fixed in 1.1.3 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-5574 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID 60f52a06449e Credits stealthcopter Required privilege...

Firefly III has a MFA bypass in oauth flow

Impact A MFA bypass in the Firefly III OAuth flow may allow malicious users to bypass the MFA-check. This allows malicious users to use password spraying to gain access to your Firefly III data using passwords stolen from other sources. As OAuth applications are easily enumerable using an...

api.almapay.co Open Redirect vulnerability OBB-3936000

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

groschbau.de Cross Site Scripting vulnerability OBB-3935996

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

kartoffel-salat.de Cross Site Scripting vulnerability OBB-3935995

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

sosyre.de Cross Site Scripting vulnerability OBB-3935994

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

sg-balk.de Cross Site Scripting vulnerability OBB-3935993

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

mixedcocktails.de Cross Site Scripting vulnerability OBB-3935992

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

studyator.de Cross Site Scripting vulnerability OBB-3935991

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

motu-almanach.de Cross Site Scripting vulnerability OBB-3935989

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

bunifoto.de Cross Site Scripting vulnerability OBB-3935988

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

d-zent-web.de Cross Site Scripting vulnerability OBB-3935987

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

diepianistin.de Cross Site Scripting vulnerability OBB-3935985

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...