CVE-2024-51818 WordPress Fancy Product Designer plugin <= 6.4.3 - Unauthenticated SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in NotFound Fancy Product Designer. This issue affects Fancy Product Designer: from n/a through 6.4.3...

CVE-2024-49688 WordPress ARPrice plugin <= 4.1.3 - Unauthenticated PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in reputeinfosystems ARPrice arprice allows Object Injection.This issue affects ARPrice: from n/a through = 4.1.3...

CVE-2024-49655

CVE-2024-49655 is an unauthenticated SQL Injection affecting WordPress ARPrice pricing plugin (versions up to 4.0.3). The provided documents confirm a high-severity, network-exploit vector (CVSS 3.1: 9.3) but do not specify a patched fixed version or concrete remediation steps in the supplied data.

Cleo LexiCom / VLTrader / Harmony 5.8.0.23 Remote Code Execution Exploit

This Metasploit module exploits an unauthenticated file write vulnerability in Cleo LexiCom, VLTrader, and Harmony versions 5.8.0.23 and below. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule...

Drupal Profile Private module * - Unauthenticated Other Vulnerability Type vulnerability

Unauthenticated Other Vulnerability Type vulnerability discovered by Dezső Biczó in WordPress Module Profile Private versions...

CVE-2024-12313 Compare Products for WooCommerce <= 3.2.1 - Unauthenticated PHP Object Injection

The Compare Products for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.1 via deserialization of untrusted input from the 'woocomparelist' cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No know...

PT-2025-20233

Name of the Vulnerable Software and Affected Versions SysAid On-Prem versions 23.3.40 and earlier Description SysAid On-Prem software is affected by an unauthenticated XML External Entity XXE issue in the lshw processing functionality. Exploitation of this issue may allow a remote attacker to tak...

CVE-2024-11733 WordPress Popular Posts <= 7.1.0 - Unauthenticated Arbitrary Shortcode Execution

The The WordPress Popular Posts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 7.1.0. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possib...

WordPress Fancy Product Designer plugin <= 6.4.3 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin Fancy Product Designer versions = 6.4.3...

CVE-2023-40327 WordPress Putler Connector for WooCommerce plugin <= 2.12.0 - Unauthenticated Broken Access Control vulnerability

Missing Authorization vulnerability in Putler / Storeapps Putler Connector for WooCommerce.This issue affects Putler Connector for WooCommerce: from n/a through 2.12.0...

CVE-2023-47689 WordPress Animator plugin <= 3.0.10 - Unauthenticated Plugin Settings Change Vulnerability

Missing Authorization vulnerability in Toast Plugins Animator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Animator: from n/a through 3.0.10...

CVE-2024-56040 WordPress VibeBP plugin <= 1.9.9.4.1 - Unauthenticated Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in VibeThemes VibeBP allows Privilege Escalation.This issue affects VibeBP: from n/a through 1.9.9.4.1...

WordPress Jetpack plugin 13.0-14.0 - Unauthenticated DOM-XSS vulnerability

Unauthenticated DOM-XSS vulnerability discovered by Eldar hakupiku in WordPress Plugin Jetpack versions 13.0-14.0...

CVE-2024-10858

CVE-2024-10858 concerns the Jetpack WordPress plugin (versions 13.x and earlier, with 14.1 as the fixed release). The root cause is improper validation of the postMessage origin, enabling a DOM-based cross-site scripting (XSS) bypass. Impact is DOM-XSS on affected sites, with notes indicating the...

WordPress kk Star Ratings plugin <= 5.4.10 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by mikemyers in WordPress Plugin kk Star Ratings versions = 5.4.10...

Cleo Harmony < 5.8.0.24 Unauthenticated Arbitrary Command Execution (CVE-2024-55956)

The version of Cleo Harmony running on the remote host is prior to 5.8.0.24. It is, therefore, affected by an unauthenticated arbitrary command execution vulnerability. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number...

WordPress The Events Calendar plugin < 6.8.2.1 - Unauthenticated Password Protected Event Disclosure vulnerability

Unauthenticated Password Protected Event Disclosure vulnerability discovered by Felipe Caon in WordPress Plugin The Events Calendar versions 6.8.2.1...

CVE-2022-46838 WordPress JS Help Desk plugin <= 2.7.1 - Unauthenticated Settings Change Vulnerability

Missing Authorization vulnerability in JoomSky JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through = 2.7.1...

ABB Cylon Aspect 3.08.01 Unauthenticated DB Download

Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description An unauthenticated vulnerability in ABB Cylon Aspect BMS/BAS allows t...

WordPress Woffice theme <= 5.4.14 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Rafie Muhammad Patchstack in WordPress Theme Woffice versions = 5.4.14...