9968 matches found
CVE-2025-22961
A critical information disclosure vulnerability exists in the web-based management interface of GatesAir Maxiva UAXT, VAXT transmitters due to Incorrect Access Control CWE-284. Unauthenticated attackers can directly access sensitive database backup files snapshotusers.db via publicly exposed URLs...
CVE-2024-13010
The WP Foodbakery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on the 'searchtype' parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...
CVE-2025-26345
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to edit user group permissions via crafted HTTP requests...
CVE-2024-13532
The Small Package Quotes – Purolator Edition plugin for WordPress is vulnerable to SQL Injection via the 'editid' and 'dropshipeditid' parameters in all versions up to, and including, 3.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2025-0511
The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 2.11.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
CVE-2024-13477
The LTL Freight Quotes – Unishippers Edition plugin for WordPress is vulnerable to SQL Injection via the 'editid' parameter in all versions up to, and including, 2.5.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...
CVE-2024-12386
The WP Abstracts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.3. This is due to missing nonce validation on multiple functions. This makes it possible for unauthenticated attackers to delete arbitrary accounts via a forged request...
CVE-2024-13480
The LTL Freight Quotes – For Customers of FedEx Freight plugin for WordPress is vulnerable to SQL Injection via the 'editid' and 'dropshipeditid' parameters in all versions up to, and including, 3.4.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation o...
CVE-2024-12386
The WP Abstracts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.3. This is due to missing nonce validation on multiple functions. This makes it possible for unauthenticated attackers to delete arbitrary accounts via a forged request...
CVE-2024-13480
CVE-2024-13480 affects the WordPress plugin “LTL Freight Quotes – For Customers of FedEx Freight”. The vulnerability is an unauthenticated SQL Injection in versions up to 3.4.1, caused by insufficient escaping of user-supplied inputs and inadequate query preparation for the edit_id and dropship_e...
CVE-2025-0511
CVE-2025-0511 : Welcart e-Commerce plugin for WordPress is vulnerable to unauthenticated stored cross-site scripting via the name parameter in versions up to and including 2.11.9 due to insufficient input sanitization and output escaping. Exploitation could cause arbitrary scripts to run when use...
CVE-2024-13477
The CVE-2024-13477 entry describes an SQL Injection in WordPress plugin LTL Freight Quotes – Unishippers Edition (affected versions up to 2.5.8) via the edit_id parameter due to insufficient escaping and unprepared SQL queries. Connected sources (Wordfence, Patchstack, CVE listings) confirm unaut...
CVE-2024-13475
The Small Package Quotes – UPS Edition plugin for WordPress is vulnerable to SQL Injection via the 'editid' parameter in all versions up to, and including, 4.5.16 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes i...
CVE-2024-13490
The LTL Freight Quotes – XPO Edition plugin for WordPress is vulnerable to SQL Injection via the 'editid' and 'dropshipeditid' parameters in all versions up to, and including, 4.3.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
CVE-2024-13437
CVE-2024-13437 : The Book a Room WordPress plugin (versions
CVE-2024-13475
CVE-2024-13475 affects the WordPress plugin Small Package Quotes – UPS Edition . The vulnerability is an unauthenticated SQL Injection via the parameter named edit_id in all versions up to and including 4.5.16 , caused by insufficient escaping of user input and lack of proper query preparation. A...
CVE-2024-13437 Book a Room <= 2.9 - Cross-Site Request Forgery to Settings Update
The Book a Room plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.9. This is due to missing or incorrect nonce validation on the 'bookaroomSettings' page. This makes it possible for unauthenticated attackers to update the plugin's settings vi...
CVE-2024-13475 Small Package Quotes – UPS Edition <= 4.5.16 - Unauthenticated SQL Injection
The Small Package Quotes – UPS Edition plugin for WordPress is vulnerable to SQL Injection via the 'editid' parameter in all versions up to, and including, 4.5.16 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes i...
CVE-2024-13490
CVE-2024-13490 affects the LTL Freight Quotes – XPO Edition WordPress plugin. The vulnerability is an unauthenticated SQL Injection caused by insufficient escaping and poor query prep in the edit_id and dropship_edit_id parameters, exploitable in all versions up to 4.3.7. Remediation: upgrade to ...
CVE-2024-13435
The CVE-2024-13435 case concerns the Ebook Downloader WordPress plugin. The vulnerability is an unauthenticated SQL Injection in the download parameter, affecting all versions up to 1.0, caused by insufficient escaping of user input and a poorly prepared SQL query. Exploitation could allow an att...