endroid/qr-code-bundle File Disclosure via logo_path query parameter

Versions of endroid/qr-code-bundle prior to 3.4.2 are affected by a security vulnerability that allows disclosure of files through the logopath query parameter. The vulnerability arises from the improper handling of non-image data as the logo, which could lead to unintended file disclosure...

GHSA-MVF6-3F2G-XFXF endroid/qr-code-bundle File Disclosure via logo_path query parameter

Versions of endroid/qr-code-bundle prior to 3.4.2 are affected by a security vulnerability that allows disclosure of files through the logopath query parameter. The vulnerability arises from the improper handling of non-image data as the logo, which could lead to unintended file disclosure...

You get a passkey, you get a passkey, everyone should get a passkey

Microsoft is rolling out passkey support for all consumer accounts. Passkeys are a very secure replacement for passwords that cant be cracked, guessed or phished, and let you log in easily, without having to type a password every time. After enabling them in Windows 11 last year, Microsoft accoun...

PT-2024-20355 · Vaales Technologies · V Qrs

Name of the Vulnerable Software and Affected Versions: Vaales Technologies V QRS version 2024-01-17 Description: The issue allows a remote attacker to obtain sensitive information via the Models/FormModel.php and QRModel.php component. Recommendations: For Vaales Technologies V QRS version...

QR Code Composer < 2.0.4 - Subscriber+ Stored XSS

Description The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user...

CVE-2024-32560

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Sharabindu QR Code Composer allows Stored XSS.This issue affects QR Code Composer: from n/a through 2.0.3...

CVE-2024-32560 WordPress QR Code Composer plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Sharabindu QR Code Composer allows Stored XSS.This issue affects QR Code Composer: from n/a through 2.0.3...

CVE-2024-32560 WordPress QR Code Composer plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Sharabindu QR Code Composer allows Stored XSS.This issue affects QR Code Composer: from n/a through 2.0.3...

CVE-2024-32560

CVE-2024-32560 is a Stored XSS in QR Code Composer (Sharabindu) for WordPress. Affected: QR Code Composer up to version 2.0.3. The issue stems from improper input handling in web page generation. A patch is available (patched in Wordfence entries); remediation is to upgrade to the patched version...

WordPress Plugin QR Code Composer 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerabili...

WordPress QR Code Composer plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin QR Code Composer versions = 2.0.3...

WordPress QR Code Composer Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS)

Software QR Code Composer Type Plugin Vulnerable versions = 2.0.3 Fixed in 2.0.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32560 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 2b079e25db67 Credits stealthcopter Required privileg...

CVE-2024-3797

A vulnerability was found in SourceCodester QR Code Bookmark System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /endpoint/delete-bookmark.php?bookmark=1. The manipulation of the argument bookmark leads to sql injection. The attack can be initiated...

CVE-2024-3797

CVE-2024-3797 affects SourceCodester QR Code Bookmark System 1.0. The issue is an SQL injection in the /endpoint/delete-bookmark.php?bookmark=1 parameter, enabling remote attacker execution via the bookmark argument. There is public disclosure of the exploit. Affected component is the delete-book...

CVE-2024-3797 SourceCodester QR Code Bookmark System sql injection

A vulnerability was found in SourceCodester QR Code Bookmark System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /endpoint/delete-bookmark.php?bookmark=1. The manipulation of the argument bookmark leads to sql injection. The attack can be initiated...

CVE-2024-3797 SourceCodester QR Code Bookmark System sql injection

A vulnerability was found in SourceCodester QR Code Bookmark System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /endpoint/delete-bookmark.php?bookmark=1. The manipulation of the argument bookmark leads to sql injection. The attack can be initiated...

CVE-2024-2946

The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution formerly WooLentor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's QR Code Widget in all versions up to, and including, 2.8.4 due to insufficient input sanitization...

CVE-2024-2946

CVE-2024-2946 concerns ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules (formerly WooLentor). Red Hat confirms a Stored Cross-Site Scripting vulnerability in the QR Code Widget affecting all versions up to 2.8.4 due to insufficient input sanitization and output escaping on u...

PT-2024-22911 · WordPress · Shoplentor

Name of the Vulnerable Software and Affected Versions: The ShopLentor plugin for WordPress versions up to, and including, 2.8.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's QR Code Widget due to insufficient input sanitization and output escaping on...

WordPress ShopLentor plugin <= 2.8.4 - Authenticated (Contributor+) Stored Cross-site Scripting via QR Code Widget vulnerability

Authenticated Contributor+ Stored Cross-site Scripting via QR Code Widget vulnerability discovered by Phuoc Pham p3tl0v3r in WordPress Plugin ShopLentor versions = 2.8.4...