CVE-2024-11200

The Goodlayers Core WordPress plugin has a Reflected Cross-Site Scripting (font-family) in versions up to 2.0.7. It allows unauthenticated attackers to inject scripts in pages executed when a user clicks a crafted link. The vulnerability is marked as patched in the referenced sources; upgrading t...

CVE-2024-11326 Campaign Monitor Forms by Optin Cat <= 2.5.7 - Reflected Cross-Site Scripting

The Campaign Monitor Forms by Optin Cat plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.5.7. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2024-11326

CVE-2024-11326 relates to the WordPress plugin Campaign Monitor Forms by Optin Cat. It describes a Reflected Cross-Site Scripting vulnerability in all versions up to 2.5.7 caused by using add_query_arg without proper escaping on the URL. This enables unauthenticated attackers to inject JavaScript...

CVE-2024-11325

The AWeber Forms by Optin Cat plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.5.7. This makes it possible for unauthenticated attackers to inject arbitrary web script...

CVE-2024-11325

CVE-2024-11325 concerns the AWeber Forms by Optin Cat WordPress plugin. It is a Reflected Cross-Site Scripting vulnerability caused by improper escaping of add_query_arg usage, affecting all versions up to and including 2.5.7. Unauthenticated attackers could inject arbitrary scripts into pages ex...

CVE-2024-11325 AWeber Forms by Optin Cat <= 2.5.7 - Reflected Cross-Site Scripting

The AWeber Forms by Optin Cat plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.5.7. This makes it possible for unauthenticated attackers to inject arbitrary web script...

CVE-2024-11461

The Form Data Collector plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 2.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary we...

CVE-2024-11805 Quick License Manager – WooCommerce Plugin <= 2.4.17 - Reflected Cross-Site Scripting

The Quick License Manager – WooCommerce Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'submitqlmproducts' parameter in all versions up to, and including, 2.4.17 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-11805

CVE-2024-11805 refers to the WordPress plugin “Quick License Manager – WooCommerce Plugin” which is vulnerable to a Reflected Cross‑Site Scripting (XSS) due to insufficient input sanitization and output escaping in the submit_qlm_products parameter. Affected versions: all up to and including 2.4....

CVE-2024-11805 Quick License Manager – WooCommerce Plugin <= 2.4.17 - Reflected Cross-Site Scripting

The Quick License Manager – WooCommerce Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'submitqlmproducts' parameter in all versions up to, and including, 2.4.17 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-11461

The CVE CVE-2024-11461 affects the WordPress Form Data Collector plugin, up to version 2.2.3. It is a Reflected Cross-Site Scripting vulnerability triggered via the page parameter due to insufficient input sanitization and output escaping. Exploitation requires a user to click a crafted link, ena...

CVE-2024-11461 Form Data Collector <= 2.2.3 - Reflected Cross-Site Scripting

The Form Data Collector plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 2.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary we...

CVE-2024-11461 Form Data Collector <= 2.2.3 - Reflected Cross-Site Scripting

The Form Data Collector plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 2.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary we...

gimp: psp off-by-one RCE

A parsing vulnerability was found in the GNU Image Manipulation Program GIMP. This flaw allows an unauthenticated, remote attacker to trick a GIMP user into opening a malicious PSP file, possibly enabling the execution of unauthorized code within the GIMP process...

B&R Industrial Automation mapp 安全漏洞

B&R Industrial Automation mapp is a revolutionary software engineering platform from B&R Industrial Automation, Austria, that simplifies the development of new applications by integrating control process expertise into modular software, thereby shortening the development cycle of new machines and...

PT-2024-35857 · WordPress · Wp Mermaid

Name of the Vulnerable Software and Affected Versions: WP Mermaid versions 1.0.2 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows stored cross-site scripting XSS. This means an attacker can inject malicious scripts into the...

CVE-2024-11252

CVE-2024-11252 concerns the Social Sharing Plugin – Sassy Social Share for WordPress. The Red Hat and NVD entries describe a Reflected Cross-Site Scripting vulnerability in the heateor_mastodon_share parameter, affecting all versions up to and including 3.3.69. The issue stems from insufficient i...

CVE-2024-11981

Certain models of routers from Billion Electric has an Authentication Bypass vulnerability, allowing unautheticated attackers to retrive contents of arbitrary web pages...

CVE-2024-11981 Billion Electric router - Authentication Bypass

Certain models of routers from Billion Electric has an Authentication Bypass vulnerability, allowing unautheticated attackers to retrive contents of arbitrary web pages...

CVE-2024-11981

CVE-2024-11981 affects Billion Electric routers (e.g., M100, M150, M120N, M500). The vulnerability is an authentication bypass that allows unauthenticated attackers to retrieve contents of arbitrary web pages. Public details in multiple sources confirm the issue and affected models. No explicit r...