CVE-2024-6557 SchedulePress <= 5.1.3 - Unauthenticated Full Path Disclosure

The SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 5.1.3. This is due the plugin utilizing the wpdeveloper library and...

CVE-2024-6557

The CVE-2024-6557 issue concerns the WordPress plugin SchedulePress (wp-scheduled-posts) with versions up to 5.1.3. The root cause is Full Path Disclosure caused by the plugin using the wpdeveloper library and leaving demo files in place while display_errors is enabled, enabling unauthenticated u...

WordPress Glossary plugin <= 2.2.26 - Unauthenticated Full Path Disclosure vulnerability

Unauthenticated Full Path Disclosure vulnerability discovered by stealthcopter in WordPress Plugin Glossary versions = 2.2.26...

WordPress AForms plugin <= 2.2.6 - Unauthenticated Full Path Disclosure vulnerability

Unauthenticated Full Path Disclosure vulnerability discovered by stealthcopter in WordPress Plugin AForms versions = 2.2.6...

WordPress XCloner plugin <= 4.7.3 - Unauthenticated Full Path Disclosure vulnerability

Unauthenticated Full Path Disclosure vulnerability discovered by stealthcopter in WordPress Plugin XCloner versions = 4.7.3...

WordPress SchedulePress plugin <= 5.1.3 - Unauthenticated Full Path Disclosure vulnerability

Unauthenticated Full Path Disclosure vulnerability discovered by stealthcopter in WordPress Plugin SchedulePress versions = 5.1.3...

PT-2024-37716 · WordPress · Xcloner Plugin

Name of the Vulnerable Software and Affected Versions: XCloner Plugin versions up to, and including, 4.7.3 Description: The XCloner Plugin for WordPress is vulnerable to Full Path Disclosure due to its utilization of sabre without preventing direct access to the files. This allows unauthenticated...

WordPress Laposta plugin <= 1.12 - Unauthenticated Full Path Disclosure vulnerability

Unauthenticated Full Path Disclosure vulnerability discovered by stealthcopter in WordPress Plugin Laposta versions = 1.12...

CVE-2024-6574

The Laposta plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.12. This is due to the plugin not preventing direct access to several test files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application,...

CVE-2024-6574 Laposta <= 1.12 - Unauthenticated Full Path Disclosure

The Laposta plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.12. This is due to the plugin not preventing direct access to several test files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application,...

CVE-2024-6574

CVE-2024-6574 affects the Laposta plugin for WordPress, with Full Path Disclosure in all versions up to and including 1.12 due to direct access to test files. Unauthenticated attackers could retrieve the web app’s full path, aiding other attacks. The plugin is no longer maintained and has been cl...

CVE-2024-6574 Laposta <= 1.12 - Unauthenticated Full Path Disclosure

The Laposta plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.12. This is due to the plugin not preventing direct access to several test files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application,...

WordPress plugin Laposta security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security...

CVE-2024-6555

The WP Popups – WordPress Popup builder plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.2.0.1. This is due the plugin utilizing mobiledetect without preventing direct access to the files. This makes it possible for unauthenticated attackers to...

CVE-2024-6555 WP Popups – WordPress Popup builder <= 2.2.0.1 - Unauthenticated Full Path Disclosure

The WP Popups – WordPress Popup builder plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.2.0.1. This is due the plugin utilizing mobiledetect without preventing direct access to the files. This makes it possible for unauthenticated attackers to...

CVE-2024-6555

CVE-2024-6555 affects the WP Popups – WordPress Popup builder plugin for WordPress (typically WP Popups Lite) up to version 2.2.0.1. The issue is a Full Path Disclosure caused by using mobiledetect without access restrictions, allowing unauthenticated attackers to retrieve server file paths. Expl...

CVE-2024-6555 WP Popups – WordPress Popup builder <= 2.2.0.1 - Unauthenticated Full Path Disclosure

The WP Popups – WordPress Popup builder plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.2.0.1. This is due the plugin utilizing mobiledetect without preventing direct access to the files. This makes it possible for unauthenticated attackers to...

WordPress plugin WP Popups security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2024-37712 · WordPress · Wp Popups

Name of the Vulnerable Software and Affected Versions: WP Popups – WordPress Popup builder plugin versions up to, and including, 2.2.0.1 Description: The issue is related to Full Path Disclosure, which occurs because the plugin utilizes mobiledetect without preventing direct access to the files...

RHEL 9 : podman (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - podman: Path disclosure CVE-2022-4123 Note that Nessus has not tested for this issue but has instead relied on the...