CVE-2024-3813 tagDiv Composer <= 4.8 - Authenticated (Contributor+) Local File Inclusion via Shortcode

The tagDiv Composer plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.8 via the 'tdblocktitle' shortcode 'blocktemplateid' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and...

CVE-2024-3813

The CVE-2024-3813 entry affects the WordPress plugin tagDiv Composer (versions up to 4.8). The vulnerability is Local File Inclusion via the td_block_title shortcode’s block_template_id attribute, enabling authenticated attackers with contributor-level permissions to include and execute arbitrary...

CVE-2024-3813 tagDiv Composer <= 4.8 - Authenticated (Contributor+) Local File Inclusion via Shortcode

The tagDiv Composer plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.8 via the 'tdblocktitle' shortcode 'blocktemplateid' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and...

PT-2024-31670 · Yotuwp · The Video Gallery – Youtube Playlist

Name of the Vulnerable Software and Affected Versions: The Video Gallery – YouTube Playlist, Channel Gallery by YotuWP plugin for WordPress versions up to, and including, 1.3.13 Description: The issue allows authenticated attackers with contributor access or higher to include and execute arbitrar...

CVE-2024-5577 Where I Was, Where I Will Be <= 1.1.1 - Unauthenticated Remote File Inclusion

The Where I Was, Where I Will Be plugin for WordPress is vulnerable to Remote File Inclusion in version = 1.1.1 via the WIWHEADER parameter of the /system/include/includeuser.php file. This makes it possible for unauthenticated attackers to include and execute arbitrary files hosted on external...

PT-2024-18206 · Megabip · Megabip

Name of the Vulnerable Software and Affected Versions: MegaBIP software versions through 5.10 Description: The issue allows an attacker to upload any file to the server, including a PHP code file, without authentication. This enables potential execution of malicious code on the server...

CVE-2024-5179

The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.2 via the 'itemstyle' and 'style' parameters. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute...

CVE-2024-5179

The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.1 via the 'itemstyle' and 'style' parameters. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute...

Insecure Deserialization

typo3/cms-form is vulnerable to Insecure Deserialization. The vulnerability is due to the PECL package "yaml" with the PHP setting yml.decodephp enabled, which allows an attacker to deserialize arbitrary YAML to PHP code. An attacker must have a valid backend user account as well yaml.decodephp...

CVE-2024-5345

CVE-2024-5345 affects the WordPress plugin Responsive Owl Carousel for Elementor. The vulnerability is a Local File Inclusion (LFI) in all versions up to 1.2.0, exploitable via the layout parameter. Authenticated attackers with Contributor-level access and above can cause the server to include an...

PT-2024-34642 · Wpzoom · Wpzoom Addons For Elementor

Name of the Vulnerable Software and Affected Versions: WPZOOM Addons for Elementor Templates, Widgets plugin for WordPress versions up to, and including, 1.1.37 Description: The issue allows unauthenticated attackers to include and execute arbitrary files on the server via the grid style paramete...

CVE-2024-3812

The Salient Core plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.7 via the 'nectaricon' shortcode 'iconlinea' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute...

CVE-2024-3810

The Salient Shortcodes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.5.3 via the 'icon' shortcode 'image' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute...

CVE-2024-3810

CVE-2024-3810 : The Salient Shortcodes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to and including 1.5.3 via the icon/image attribute used in shortcodes. Authenticated attackers with contributor-level permissions or higher can include and execute arbitrary PHP f...

CVE-2024-25641

Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, an arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import Templates" permission to execute arbitrary PHP code on the web...

Cacti 安全漏洞

Cacti is a suite of open source network traffic monitoring and analysis tools from the Cacti team. The tool obtains data via snmpget, analyzes it using RRDtool drawing graphs, and provides data and user management features. A security vulnerability exists in Cacti versions prior to 1.2.27, which...

CVE-2024-3809

The Porto Theme – Functionality plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.9 via the ‘slideshowtype’ post meta. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute...

CVE-2024-3808 Porto Theme - Functionality <= 3.1.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode

The Porto Theme - Functionality plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.0 via the 'portoportfolios' shortcode 'portfoliolayout' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions,...

CVE-2024-3808

CVE-2024-3808 pertains to the Porto Theme – Functionality plugin for WordPress. The vulnerability enables authenticated attackers with contributor-level privileges or higher to perform a Local File Inclusion via the porto_portfolios shortcode and its portfolio_layout attribute, enabling arbitrary...

CVE-2024-3807 Porto <= 7.1.0 - Authenticated (Contributor+) Local File Inclusion via Post Meta

The Porto theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.1.0 via 'portopageheadershortcodetype', 'slideshowtype' and 'postlayout' post meta. This makes it possible for authenticated attackers, with contributor-level and above permissions, to...