WordPress plugin WP Team 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...

CVE-2024-10223: Improper Neutralization of Input During Web Page Generation

The WP Team – WordPress Team Member Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's htteamember shortcode in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

WordPress HT Team Member plugin <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via htteamember Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via htteamember Shortcode vulnerability discovered by Peter Thaleikis in WordPress Plugin HT Team Member versions = 1.1.4...

GHSA-F77Q-R5QM-W4M8 sp1-recursion-gnark-ffi has insufficient range checks of BabyBear arithmetic

The Gnark recursion circuit constrains arithmetic over BabyBear when the native field of the ZKP circuit is the BN254 scalar field. Proper implementation of this logic requires range checking Bn254 values to be less than the BabyBear modulus. In versions 1.2.0, functions like InvF and InvE used...

WordPress HT Team Member Plugin <= 1.1.4 is vulnerable to Cross Site Scripting (XSS)

Software HT Team Member Type Plugin Vulnerable versions = 1.1.4 Fixed in 1.1.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10223 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 7be4209fc593 Credits Peter Thaleikis Required...

CVE-2024-50469 WordPress Textboxes plugin <= 0.1.3.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in brightvesseldev Textboxes textboxes allows DOM-Based XSS.This issue affects Textboxes: from n/a through = 0.1.3.1...

CVE-2024-50469 WordPress Textboxes plugin <= 0.1.3.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in brightvesseldev Textboxes textboxes allows DOM-Based XSS.This issue affects Textboxes: from n/a through = 0.1.3.1...

CVE-2024-50469

CVE-2024-50469 is a DOM-based XSS vulnerability in the WordPress Textboxes plugin (versions up to 0.1.3.1). The issue is described as Improper Neutralization of Input During Web Page Generation (XSS) affecting Textboxes; CVSS 3.1 base score 6.5 (Network, Low Privileges, User Interaction required,...

CVE-2024-50443

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Post Grid Team by WPXPO PostX allows Stored XSS.This issue affects PostX: from n/a through 4.1.12...

CVE-2024-50443

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPXPO PostX ultimate-post.This issue affects PostX: from n/a through = 4.1.12...

CVE-2024-50443 WordPress PostX plugin <= 4.1.12 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPXPO PostX ultimate-post.This issue affects PostX: from n/a through = 4.1.12...

CVE-2024-50443 WordPress PostX plugin <= 4.1.12 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPXPO PostX ultimate-post.This issue affects PostX: from n/a through = 4.1.12...

PT-2024-34245 · Unknown · Team Bright Vessel Textboxes

Name of the Vulnerable Software and Affected Versions: Team Bright Vessel Textboxes versions 0.1.3.1 and earlier Description: The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This is a DOM-Based XSS vulnerability...

Mitel MiCollab Cross-Site Scripting Vulnerability (CNVD-2024-42929)

Mitel MiCollab is a mobile application from Mitel Canada that provides voice, video, messaging, audio conferencing and team collaboration for employees. Mitel MiCollab suffers from a cross-site scripting vulnerability that can be exploited by attackers to inject malicious script or HTML code...

CVE-2024-9930

The Extensions by HocWP Team plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 0.2.3.2. This is due to missing validation on the user being supplied in the 'verifyemail' action. This makes it possible for unauthenticated attackers to log in as any...

CVE-2024-9930 Extensions by HocWP Team <= 0.2.3.2 - Authentication Bypass

The Extensions by HocWP Team plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 0.2.3.2. This is due to missing validation on the user being supplied in the 'verifyemail' action. This makes it possible for unauthenticated attackers to log in as any...

CVE-2024-9930

CVE-2024-9930 (Extensions by HocWP Team, WordPress) is an authentication bypass vulnerability in the Account extension of the plugin, affecting versions up to and including 0.2.3.2. The issue arises from missing validation on the user supplied to the verify_email action, enabling unauthenticated ...

WordPress plugin Extensions by HocWP Team 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

CVE-2024-9930: Authentication Bypass Using an Alternate Path or Channel

The Extensions by HocWP Team plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 0.2.3.2. This is due to missing validation on the user being supplied in the 'verifyemail' action. This makes it possible for unauthenticated attackers to log in as any...

RKE2 allows privilege escalation in Windows nodes due to Insecure Access Control Lists

Impact A vulnerability has been identified whereby RKE2 deployments in Windows nodes have weak Access Control Lists ACL, allowing BUILTIN\Users or NT AUTHORITY\Authenticated Users to view or edit sensitive files which could lead to privilege escalation. The affected files include binaries, script...