11868 matches found
Keycloak Denial of Service via account lockout
In any realm set with "User Self registration" a user that is registered with a username in email format can be "locked out" denied from logging in using his username...
WooCommerce has a Cross-Site Scripting (XSS) Vulnerability in checkout & registration forms
Impact A vulnerability introduced in WooCommerce 8.8 allows for cross-site scripting. A bad actor can manipulate a link to include malicious HTML & JavaScript content. While the content is not saved to the database, the links may be sent to victims for malicious purposes. The injected JavaScript...
PT-2024-27454 · Unknown · Woocommerce +1
Name of the Vulnerable Software and Affected Versions: WooCommerce versions 8.8 through 8.8.4 WooCommerce versions 8.9 through 8.9.2 Description: A cross-site scripting vulnerability in WooCommerce allows a bad actor to manipulate a link to include malicious HTML and JavaScript content. The...
CVE-2024-3668
The PowerPack Pro for Elementor plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.10.17. This is due to the plugin not restricting low privileged users from setting a default role for a registration form. This makes it possible for authenticated...
CVE-2024-3668
The PowerPack Pro for Elementor plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.10.17. This is due to the plugin not restricting low privileged users from setting a default role for a registration form. This makes it possible for authenticated...
CVE-2024-3668 PowerPack Pro for Elementor <= 2.10.17 - Authenticated (Contributor+) Privilege Escalation
The PowerPack Pro for Elementor plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.10.17. This is due to the plugin not restricting low privileged users from setting a default role for a registration form. This makes it possible for authenticated...
CVE-2024-3668
CVE-2024-3668 affects PowerPack Pro for Elementor (WordPress). It allows privilege escalation in all versions up to 2.10.17 by not restricting low-privilege users from selecting a default role for a registration form. This enables authenticated attackers with contributor-level access or higher to...
WordPress plugin PowerPack Pro for Elementor security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...
TYPO3 Denial of Service in Frontend Record Registration
TYPO3’s built-in record registration functionality aka basic shopping cart using recs URL parameters is vulnerable to denial of service. Failing to properly ensure that anonymous user sessions are valid, attackers can use this vulnerability in order to create an arbitrary amount of individual...
GHSA-G585-CRJF-VHWQ TYPO3 Denial of Service in Frontend Record Registration
TYPO3’s built-in record registration functionality aka basic shopping cart using recs URL parameters is vulnerable to denial of service. Failing to properly ensure that anonymous user sessions are valid, attackers can use this vulnerability in order to create an arbitrary amount of individual...
PT-2024-27123 · WordPress · Powerpack Pro For Elementor
Name of the Vulnerable Software and Affected Versions: PowerPack Pro for Elementor plugin for WordPress versions up to, and including, 2.10.17 Description: The issue is due to the plugin not restricting low privileged users from setting a default role for a registration form. This makes it possib...
CGA-QJ23-2J5C-346P
Bulletin has no description...
CGA-PMQ6-PWG7-874J
Bulletin has no description...
CGA-WQ9P-47VF-VG24
Bulletin has no description...
CGA-7V6W-28FF-CF45
Bulletin has no description...
CGA-2GM7-VJH8-HRXP
Bulletin has no description...
CVE-2024-5324 XootiX Framework <= Various Plugin Versions - Missing Authorization to Arbitrary Options Update
Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'importsettings' function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...
CVE-2024-4870
The Frontend Registration – Contact Form 7 plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1 due to insufficient restriction on the 'cf7frr' post meta. This makes it possible for authenticated attackers, with editor-level access and above, to modify...
WordPress Frontend Registration – Contact Form 7 plugin <= 5.1 - Authenticated (Editor+) Privilege Escalation vulnerability
Authenticated Editor+ Privilege Escalation vulnerability discovered by István Márton in WordPress Plugin Frontend Registration – Contact Form 7 versions = 5.1...
WordPress User Registration plugin <= 3.2.0.1 - Missing Authorization to Privilege Escalation vulnerability
Missing Authorization to Privilege Escalation vulnerability discovered by Thanh Nam Tran in WordPress Plugin User Registration versions = 3.2.0.1...