PT-2024-31917 · WordPress · Exclusive Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Exclusive Addons for Elementor plugin for WordPress versions up to, and including, 2.6.9.6 Description: The issue arises from insufficient input sanitization and output escaping on the user-supplied url attribute in the Team Member widget,...

TYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageController

Problem The ShowImageController eID txcmsshowpic lacks a cryptographic HMAC-signature on the frame HTTP query parameter e.g. /index.php?eID=txcmsshowpic?file=3&...&frame=12345. This allows adversaries to instruct the system to produce an arbitrary number of thumbnail images on the server side...

CVE-2024-35166

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ninja Team Filebird.This issue affects Filebird: from n/a through 5.6.3...

CVE-2024-34699

GZ::CTF is a capture the flag platform. Prior to 0.20.1, unprivileged user can perform cross-site scripting attacks on other users by constructing malicious team names. This problem has been fixed in v0.20.1...

CVE-2024-32776

Missing Authorization vulnerability in AppPresser Team AppPresser.This issue affects AppPresser: from n/a through 4.3.0...

CVE-2024-29800

Deserialization of Untrusted Data vulnerability in Timber Team & Contributors Timber.This issue affects Timber: from n/a through 1.23.0...

Exclusive Addons for Elementor < 2.6.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Widget

Description The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Team Member widget in all versions up to, and including, 2.6.9.6 due to insufficient input sanitization and output escaping on user supplied 'url' attribute. This makes it...

GZ::CTF 安全漏洞

GZ::CTF is an open source CTF platform based on ASP.NET Core by GZTime Individual Developers. A security vulnerability exists in GZ::CTF versions prior to 0.20.1, which originates from a cross-site scripting attack that can be performed by an unprivileged user on other users by constructing a...

CVE-2024-35166: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ninja Team Filebird.This issue affects Filebird: from n/a through 5.6.3...

CVE-2024-34699: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

GZ::CTF is a capture the flag platform. Prior to 0.20.1, unprivileged user can perform cross-site scripting attacks on other users by constructing malicious team names. This problem has been fixed in v0.20.1...

CVE-2024-34699 GZ::CTF allows unprivileged user can perform XSS attacks by constructing malicious team names.

GZ::CTF is a capture the flag platform. Prior to 0.20.1, unprivileged user can perform cross-site scripting attacks on other users by constructing malicious team names. This problem has been fixed in v0.20.1...

CVE-2024-34699

GZ::CTF (prior to v0.20.1) is vulnerable to cross-site scripting by unprivileged users attempting to craft team names; fixed in v0.20.1. The CVE-2024-34699 entry shows CVSS 3.1 base score 6.5 (Medium) with Adjacent access, no privileges, user interaction none, and high availability impact. Remedi...

CVE-2024-34699 GZ::CTF allows unprivileged user can perform XSS attacks by constructing malicious team names.

GZ::CTF is a capture the flag platform. Prior to 0.20.1, unprivileged user can perform cross-site scripting attacks on other users by constructing malicious team names. This problem has been fixed in v0.20.1...

PT-2024-26116 · Gz::Ctf · Gz::Ctf

Name of the Vulnerable Software and Affected Versions: GZ::CTF versions prior to 0.20.1 Description: The issue allows an unprivileged user to perform cross-site scripting attacks on other users by constructing malicious team names. Recommendations: For versions prior to 0.20.1, update to version...

CVE-2024-34220

creationtimestamp| type| source ---|---|--- 2024-05-11 07:42:05+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/7271...

VulnCheck KEV: CVE-2024-34826

Missing Authorization vulnerability in Saleswonder Team: Tobias CF7 WOW Styler cf7-styler.This issue affects CF7 WOW Styler: from n/a through = 1.6.4...

CVE-2024-26517

creationtimestamp| type| source ---|---|--- 2024-05-08 20:34:28+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/7251...

Soccer Engine – Soccer Plugin for WordPress < 1.13 - Cross-Site Request Forgery

Description The Soccer Engine – Soccer Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12. This is due to missing or incorrect nonce validation when saving match and team settings. This makes it possible for...

CVE-2024-34367

Cross-Site Request Forgery CSRF vulnerability in Popup Box Team Popup box allows Cross-Site Scripting XSS.This issue affects Popup box: from n/a through 4.1.2...

CVE-2024-34367

CVE-2024-34367: CSRF leads to XSS in Popup Box – Popup Box plugin (ays-popup-box) for WordPress; affected versions up to 4.1.2. Patch status: Patched (fix details not provided in the supplied docs).