PT-2024-36336 · Kurmi · Kurmi Provisioning Suite

Name of the Vulnerable Software and Affected Versions: Kurmi Provisioning Suite version 7.9.0.33 Description: An issue was discovered in the Kurmi Provisioning Suite. If an X-Forwarded-For header is received during authentication, the Kurmi application will record the possibly forged IP address...

CVE-2024-54450

An issue was discovered in Kurmi Provisioning Suite 7.9.0.33. If an X-Forwarded-For header is received during authentication, the Kurmi application will record the possibly forged IP address mentioned in that header rather than the real IP address that the user logged in from. This fake IP addres...

PT-2024-17683 · WordPress · Wplegalpages

Name of the Vulnerable Software and Affected Versions: WP Legal Pages plugin for WordPress versions up to, and including, 3.2.6 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the create popup delete process function. This allows...

CVE-2024-55998

Missing Authorization vulnerability in Eric Sloan Popup Surveys & Polls for WordPress Mare.io popup-surveys allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup Surveys & Polls for WordPress Mare.io: from n/a through = 1.36...

PT-2024-36652 · Mare.Io · Popup Surveys & Polls For Wordpress

Name of the Vulnerable Software and Affected Versions: Popup Surveys & Polls for WordPress Mare.io versions 1.36 and earlier Description: The issue is related to a missing authorization vulnerability in Popup Surveys & Polls for WordPress, which allows exploiting incorrectly configured access...

WordPress Popup Surveys & Polls for WordPress (Mare.io) plugin <= 1.36 - Settings Change vulnerability

Settings Change vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin Popup Surveys & Polls for WordPress Mare.io versions = 1.36...

CVE-2024-12458

CVE-2024-12458 – WordPress Smart PopUp Blaster Stored XSS : Affected plugin: Smart PopUp Blaster for WordPress. Vulnerable component: spb-button shortcode. Root cause: insufficient input sanitization and output escaping for user-supplied attributes. Impact: stored XSS that can execute scripts whe...

CVE-2024-12458 Smart PopUp Blaster <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Smart PopUp Blaster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spb-button' shortcode in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress plugin Smart PopUp Blaster 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

PT-2024-17601 · WordPress · Smart Popup Blaster

Name of the Vulnerable Software and Affected Versions: Smart PopUp Blaster plugin for WordPress versions up to, and including, 1.4.3 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'spb-button' shortcode due to insufficient input sanitization and output escaping ...

CVE-2024-54241

Missing Authorization vulnerability in Appsbd Elite Notification – Sales Popup, Social Proof, FOMO & WooCommerce Notification allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elite Notification – Sales Popup, Social Proof, FOMO & WooCommerce Notification:...

CVE-2023-39997

Missing Authorization vulnerability in supsystic.com Popup by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup by Supsystic: from n/a through 1.10.19...

CVE-2023-39997

Missing Authorization vulnerability in supsystic.com Popup by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup by Supsystic: from n/a through 1.10.19...

CVE-2022-47176

Missing Authorization vulnerability in Depicter Slider and Popup by Averta Depicter Slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Depicter Slider: from n/a through 1.9.0...

CVE-2022-45819

Missing Authorization vulnerability in Popup Maker Popup Maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup Maker: from n/a through 1.17.1...

CVE-2023-39997 WordPress Popup by Supsystic plugin <= 1.10.19 - Broken Access Control Vulnerability

Missing Authorization vulnerability in supsystic Popup by Supsystic popup-by-supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup by Supsystic: from n/a through = 1.10.19...

CVE-2023-39997

CVE-2023-39997 concerns the WordPress plugin Popup by Supsystic. Affected versions up to 1.10.19 expose a missing authorization check (broken access control), allowing unauthenticated access. The issue is mitigated by upgrading to version 1.10.20 or later, which fixes the flaw.

CVE-2023-39997 WordPress Popup by Supsystic plugin <= 1.10.19 - Broken Access Control Vulnerability

Missing Authorization vulnerability in supsystic.com Popup by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup by Supsystic: from n/a through 1.10.19...

CVE-2022-45819 WordPress Popup Maker plugin <= 1.17.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Daniel Iser Popup Maker popup-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup Maker: from n/a through = 1.17.1...

CVE-2022-45819

CVE-2022-45819 affects the WordPress Popup Maker plugin up to version 1.17.1. Root cause: broken access control due to missing authorization checks. Impact: potential missing authorization could lead to unauthorized access to plugin functionality (low-severity, CVSSv3.1 base score 3.5). Exploitat...