WordPress Telegram Bot & Channel Plugin <= 3.6.2 is vulnerable to Cross Site Scripting (XSS)

Software Telegram Bot & Channel Type Plugin Vulnerable versions = 3.6.2 Fixed in 3.6.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-34006 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID ffd28984fd7d Credits yuyudhn Required...

Warpinator path traversal vulnerability

Warpinator is an open source file sharing library for Linux Mint that shares files across a LAN. Files are sent and received over a local network. A security vulnerability exists in Warpinator versions prior to 1.6.0 that stems from allowing remote deletion of files via directory traversal in...

WordPress WP Coder Plugin <= 2.5.5 is vulnerable to Cross Site Scripting (XSS)

Software WP Coder Type Plugin Vulnerable versions = 2.5.5 Fixed in 2.5.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2362 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID f20e6f427663 Credits Erwan LR Required privilege...

Find APIs Hiding in the Shadows

What’s hiding in the shadows? It’s a well understood reality that unmanaged IT assets tend to be unmonitored IT assets, and that both introduce risk. Whether it’s a forgotten about application, or an unmanaged cloud storage volume, you can’t protect what you don’t know about. Attackers thrive on...

WordPress Recently Viewed Products Plugin <= 1.0.0 is vulnerable to PHP Object Injection

Software Recently Viewed Products Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2023-34027 Patch priority High CVSS severity High 8.3 Developer Claim ownership PSID 9c6c9d223c96 Credits Mika Required privilege...

WordPress Button Generator – easily Button Builder Plugin <= 2.3.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software Button Generator – easily Button Builder Type Plugin Vulnerable versions = 2.3.5 Fixed in 2.3.6 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-25443 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID ad530edff5de...

WordPress MStore API Plugin <= 3.9.2 is vulnerable to Broken Authentication

Software MStore API Type Plugin Vulnerable versions = 3.9.2 Fixed in 3.9.3 OWASP Top 10 A2: Broken Authentication Classification Broken Authentication CVE CVE-2023-2732 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 9a2f0204ce39 Credits Lana Codes Required privilege...

WordPress MStore API Plugin <= 3.9.1 is vulnerable to Broken Authentication

Software MStore API Type Plugin Vulnerable versions = 3.9.1 Fixed in 3.9.2 OWASP Top 10 A2: Broken Authentication Classification Broken Authentication CVE CVE-2023-2734 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 533a834d2d8a Credits Lana Codes Required privilege...

WordPress This Day In History Plugin <= 3.10.1 is vulnerable to Cross Site Scripting (XSS)

Software This Day In History Type Plugin Vulnerable versions = 3.10.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-34026 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID eee4a5e73546 Credits LEE SE HYOUNG...

WordPress Viral News Theme <= 1.4.5 is vulnerable to Broken Access Control

Software Viral News Type Theme Vulnerable versions = 1.4.5 Fixed in 1.4.6 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-33923 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 9e1913077f52 Credits Dave Jong Patchstack Required...

WordPress HashOne Theme <= 1.3.0 is vulnerable to Broken Access Control

Software HashOne Type Theme Vulnerable versions = 1.3.0 Fixed in 1.3.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-33923 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID db48b6df310a Credits Dave Jong Patchstack Required privileg...

CVE-2023-32681

A flaw was found in the Python-requests package, where it is vulnerable to potentially leaking Proxy-Authorization headers to destination servers, specifically during redirects to an HTTPS origin. This is a product of how rebuildproxies is used to recompute and reattach the Proxy-Authorization...

WordPress Elementor Website Builder Plugin <= 3.13.2 is vulnerable to Broken Access Control

Software Elementor Website Builder Type Plugin Vulnerable versions = 3.13.2 Fixed in 3.13.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-33922 Patch priority Low CVSS severity Low 4.3 Developer Elementor PSID b1fff5eee484 Credits Rafie Muhammad Patchsta...

WordPress Tutor LMS Plugin <= 2.1.8 is vulnerable to Broken Access Control

Software Tutor LMS Type Plugin Vulnerable versions = 2.1.8 Fixed in 2.1.9 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-25799 Patch priority High CVSS severity High 8.3 Developer Claim ownership PSID c5a261a00ca9 Credits Rafie Muhammad Patchstack Require...

WordPress OAuth Single Sign On – SSO (OAuth Client) Plugin <= 6.23.3 is vulnerable to Broken Authentication

Software OAuth Single Sign On – SSO OAuth Client Type Plugin Vulnerable versions = 6.23.3 Fixed in 6.23.4 OWASP Top 10 A2: Broken Authentication Classification Broken Authentication CVE CVE-2022-34155 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 74c6748a10df Credits...

WordPress Download Theme Plugin <= 1.0.9 is vulnerable to Cross Site Request Forgery (CSRF)

Software Download Theme Type Plugin Vulnerable versions = 1.0.9 Fixed in 1.1.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-38062 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 6801cc6f9ede Credits István Márton Requir...

WordPress Flickr Justified Gallery Plugin <= 3.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software Flickr Justified Gallery Type Plugin Vulnerable versions = 3.5 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-25473 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID e930ab154fff Credits Mika Required...

WordPress Download Plugin Plugin <= 2.0.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Download Plugin Type Plugin Vulnerable versions = 2.0.4 Fixed in 2.0.5 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-36345 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 8585091ec14a Credits István Márton...

WordPress Yoast SEO: Local Plugin <= 14.9 is vulnerable to Cross Site Scripting (XSS)

Software Yoast SEO: Local Type Plugin Vulnerable versions = 14.9 Fixed in 15.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-28785 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 24eda6213577 Credits Rafie Muhammad Patchstac...

WordPress Ultimate Dashboard Plugin < 3.7.6 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate Dashboard Type Plugin Vulnerable versions 3.7.6 Fixed in 3.7.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID b3d7a5a0fa5a Credits Unknown Required privilege...