CVE-2023-6855 Paid Memberships Pro <= 2.12.5 - Missing Authorization via API

The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to unauthorized modification of membership levels created by the plugin due to an incorrectly implemented capability check in the pmprorestapigetpermissionscheck function in...

WordPress Plugin EventON Pro Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. Cross-site request forgery...

WordPress Plugin Paid Memberships Pro Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on PHP and MySQL servers.WordPress plugin is an...

The vulnerability of the Struts2 software component for managing power supply sources in Voltronic Power View allows a perpetrator to execute arbitrary code.

The vulnerability of the Struts2 component in the software for managing power sources of Voltronic Power ViewPower Pro is related to improper code generation. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially created file...

The vulnerability of the MySQL software component used for managing power supply sources in Voltronic Power View. This allows a hacker to elevate their privileges to the level of an administrator.

The vulnerability of the MySQL component in the software for managing power sources in Voltronic Power ViewPower Pro lies in the use of rigidly encoded credentials. Exploiting this vulnerability could allow an attacker to elevate their privileges to the level of an administrator...

WordPress Plugin EventON Pro Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. Cross-site request forgery...

PT-2024-15034 · Unknown +1 · Happy Addons For Elementor Pro +2

Name of the Vulnerable Software and Affected Versions: Happy Addons for Elementor versions up to 3.9.1.1 Happy Addons for Elementor Pro versions up to 2.9.1.1 Description: The issue is related to Reflected Cross-Site Scripting via DOM due to insufficient input sanitization and output escaping. Th...

The vulnerability of the updateManagerPassword function in the software for managing power sources of Voltronic Power ViewPower Pro allows a intruder to bypass the authentication process and gain unauthorized access to the software.

The vulnerability of the updateManagerPassword function in the software for managing power sources of Voltronic Power ViewPower Pro is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker, operating remotely, to bypass the authentication...

The vulnerability of the SocketService module in the software for managing power sources of Voltronic Power ViewPower Pro allows a intruder to trigger a service failure.

The vulnerability of the SocketService module in the software for managing power sources of Voltronic Power ViewPower Pro is related to the lack of authentication. Exploiting this vulnerability could allow a malicious actor, operating remotely, to cause a service failure through a specially craft...

The vulnerability of the getMacAddressByIP function in the software for controlling power sources of Voltronic Power ViewPower Pro allows a hacker to execute arbitrary code.

The vulnerability of the “getMacAddressByIP” function in the software for controlling power sources of Voltronic Power ViewPower Pro is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability could allow a malicious actor, operating remotely, to...

The vulnerability of the RMI interface in software for controlling power sources in Voltronic Power ViewPower Pro allows a intruder to execute arbitrary code.

The vulnerability of the RMI software interface for controlling power sources in Voltronic Power ViewPower Pro relates to the restoration of unreliable data in memory. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code using a specially created...

The vulnerability of the doDocument method in software for managing power sources in Voltronic Power View allows attackers to perform XXE attacks.

The vulnerability of the doDocument method in the software for managing power sources of Voltronic Power ViewPower Pro is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability could allow an attacker to perform XXE attacks remotely...

The vulnerability of the selectEventConfig method in the software for managing power sources of Voltronic Power ViewPower Pro allows a hacker to execute arbitrary SQL code.

The vulnerability of the selectEventConfig method in the software for managing power supply sources of Voltronic Power ViewPower Pro relates to the lack of measures taken to protect the SQL query structure when data cleaning is insufficient. Exploiting this vulnerability could allow an attacker...

CVE-2023-6158

The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the evoeventpostupdatemeta function in all versions up to, and including, 4.5.4 for Pro and 2.2.7 for free. This make...

WordPress EventON Pro Plugin <= 4.5.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software EventON Pro Type Plugin Vulnerable versions = 4.5.4 Fixed in 4.5.5 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-6244 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 5cacf0b27060 Credits Francesco Carlucci...

WordPress Profile Builder Pro Plugin <= 3.10.0 is vulnerable to Cross Site Scripting (XSS)

Software Profile Builder Pro Type Plugin Vulnerable versions = 3.10.0 Fixed in 3.10.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-22142 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 458e79568c87 Credits Dave Jong Patchstack...

WordPress Profile Builder Pro Plugin <= 3.10.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Profile Builder Pro Type Plugin Vulnerable versions = 3.10.0 Fixed in 3.10.1 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-22140 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID 81245bbcdd5e Credits Dave Jong...

WordPress Profile Builder Pro Plugin <= 3.10.0 is vulnerable to Sensitive Data Exposure

Software Profile Builder Pro Type Plugin Vulnerable versions = 3.10.0 Fixed in 3.10.1 OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2024-22141 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID d6301bb29b09 Credits Dave Jong...

Intel NUC Security Vulnerability

The Intel NUC is a small minicomputer from Intel Corporation USA. A security vulnerability exists in the Intel NUC that originates from an uncontrolled search path in the Pro Software Suite Configuration Tool. This could allow an authenticated user to potentially enable denial of service via loca...

WordPress EventON Pro Plugin <= 4.5.4 is vulnerable to Broken Access Control

Software EventON Pro Type Plugin Vulnerable versions = 4.5.4 Fixed in 4.5.5 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-6158 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID b43943b2a15f Credits Francesco Carlucci Required...