CVE-2023-5106

Removed by vendor...

CVE-2023-5106

CVE-2023-5106 affects Ultimate-licensed GitLab EE. Versions 13.12–before 16.2.8, 16.3.0–before 16.3.5, and 16.4.0–before 16.4.1 allow an attacker to impersonate users in CI pipelines via direct transfer group imports. The available documents do not specify a confirmed fixed version or patch detai...

CVE-2023-30493

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Themefic Ultimate Addons for Contact Form 7 plugin = 3.2.0 versions...

CVE-2023-30493

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Themefic Ultimate Addons for Contact Form 7 plugin = 3.2.0 versions...

Cross site scripting

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Themefic Ultimate Addons for Contact Form 7 plugin = 3.2.0 versions...

CVE-2023-30493

CVE-2023-30493 is an Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability affecting Themefic Ultimate Addons for Contact Form 7, version

WordPress plugin Ultimate Addons for Contact Form Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2023-30493: Improper Neutralization of Input During Web Page Generation

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Themefic Ultimate Addons for Contact Form 7 plugin = 3.2.0 versions...

CVE-2023-38516

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in WP OnlineSupport, Essential Plugin Audio Player with Playlist Ultimate plugin = 1.2.2 versions...

CVE-2023-38516 WordPress Audio Player with Playlist Ultimate Plugin <= 1.2.2 is vulnerable to Cross Site Scripting (XSS)

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in WP OnlineSupport, Essential Plugin Audio Player with Playlist Ultimate plugin = 1.2.2 versions...

WordPress plugin Audio Player with Playlist Ultimate Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...

CVE-2023-38516: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in WP OnlineSupport, Essential Plugin Audio Player with Playlist Ultimate plugin = 1.2.2 versions...

DarkGate Malware Activity Spikes as Developer Rents Out Malware to Affiliates

A new malspam campaign has been observed deploying an off-the-shelf malware called DarkGate. "The current spike in DarkGate malware activity is plausible given the fact that the developer of the malware has recently started to rent out the malware to a limited number of affiliates," Telekom...

WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate Addons for Contact Form 7 Type Plugin Vulnerable versions = 3.2.0 Fixed in 3.2.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-30493 Patch priority Medium CVSS severity Medium 7.1 Developer Themefic PSID 04b91a12da5a Credits LEE S...

WordPress Post Ticker Ultimate Plugin <= 1.5.5 is vulnerable to Broken Access Control

Software Post Ticker Ultimate Type Plugin Vulnerable versions = 1.5.5 Fixed in 1.5.6 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-40200 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 25c80b813ad7 Credits Abdi Pranata Required...

WordPress Post grid and filter ultimate Plugin <= 1.5.2 is vulnerable to Broken Access Control

Software Post grid and filter ultimate Type Plugin Vulnerable versions = 1.5.2 Fixed in 1.5.3 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-40200 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID e3f31b8b5385 Credits Abdi Pranata...

WordPress Countdown Timer Ultimate Plugin <= 2.4 is vulnerable to Broken Access Control

Software Countdown Timer Ultimate Type Plugin Vulnerable versions = 2.4 Fixed in 2.4.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-40200 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 02b1dc1f96b2 Credits Abdi Pranata Required...

Exploit for CVE-2023-3460

CVE-2023-3460 Exploit for CVE-2023-3460 - Unauthorized admin...

CVE-2023-2802

The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisi...

CVE-2023-2803

The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...