PT-2024-14997 · WordPress · Tj Shortcodes

Name of the Vulnerable Software and Affected Versions: TJ Shortcodes WordPress plugin versions 0.1.3 and earlier Description: The issue concerns the lack of validation and escaping of certain shortcode attributes in the TJ Shortcodes WordPress plugin, which can lead to Stored Cross-Site Scripting...

WordPress plugin TJ Shortcodes security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers running PHP and MySQL.WordPress plugin i...

PYSEC-2024-19

Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the element method in app/routes.py does not validate the user-controlled srctype and elementurl variables and passes them to the send method which sends a GET request on lines 339-343 in requests.py. The returned...

Server side request forgery (ssrf)

Whoogle Search is a self-hosted metasearch engine. In versions prior to 0.8.4, the element method in app/routes.py does not validate the user-controlled srctype and elementurl variables and passes them to the send method which sends a GET request on lines 339-343 in request.py, which leads to a...

whoogle-search path traversal vulnerability

whoogle-search is a software application. Self-hosted, ad-free, privacy-respecting metasearch engine. A path traversal vulnerability exists in whoogle-search versions prior to 0.8.4, which stems from the config function in app/routes.py that does not validate the user-controlled name variable and...

whoogle-search Code Issue Vulnerability

whoogle-search is a software application. Self-hosted, ad-free, privacy-respecting meta-search engine A code issue vulnerability exists in whoogle-search versions prior to 0.8.4, which stems from the element method in app/routes.py that does not validate user-controlled srctype and elementurl...

whoogle-search Cross-Site Scripting Vulnerability

whoogle-search is a software application. Self-hosted, ad-free, privacy-respecting meta-search engine A cross-site scripting vulnerability exists in whoogle-search versions prior to 0.8.4, which stems from the element method in app/routes.py that does not validate user-controlled srctype and...

Amazon Linux AMI : perl-Spreadsheet-ParseExcel (ALAS-2024-1905)

The version of perl-Spreadsheet-ParseExcel installed on the remote host is prior to 0.5900-5.3. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1905 advisory. Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel i...

PT-2024-15634

Name of the Vulnerable Software and Affected Versions paddlepaddle/paddle affected versions not specified Description The issue arises from the way the url parameter is incorporated into the command string without proper validation or sanitization. If the url is constructed from untrusted sources...

WordPress plugin Lana Shortcodes security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

PT-2024-11917 · WordPress · Customer Reviews For Woocommerce

Name of the Vulnerable Software and Affected Versions: Customer Reviews for WooCommerce WordPress plugin versions prior to 5.17.0 Description: The issue is related to the failure of the Customer Reviews for WooCommerce WordPress plugin to validate and escape some of its shortcode attributes befor...

WordPress plugin simple sort&search security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

WordPress plugin My Account Page Editor security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A security vulnerability in the WordPress plugin My...

WordPress Plugin JSM file_get_contents Shortcode Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability in the WordPress...

CVE-2023-49801 Lif Auth Server vulnerable to uncontrolled data in path expression

Lif Auth Server is a server for validating logins, managing information, and account recovery for Lif Accounts. The issue relates to the getpfp and getbanner routes on Auth Server. The issue is that there is no check to ensure that the file that Auth Server is receiving through these URLs is...

Arbitrary Code Execution

Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution. The vulnerability due to passing unvalidated input from a file into a string-type “eval”. It allows an attacker spreads malicious code which leads to arbitrary code execution...

Lif Authentication Server Security Vulnerability

Lif Authentication Server is a Lif Platforms open source server for authenticating Lif account logins, administrative information, and account recovery. A security vulnerability exists in versions of Lif Authentication Server prior to 1.4.0 that stems from a failure to check that files received b...

CentOS 8 : kernel (CESA-2024:0113)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:0113 advisory. - An integer overflow vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfxexecbuf.c in GPU component of Linux kernel with device file...

Bar Assistant Security Breach

Bar Assistant is a self-hosted application for managing home bars. A security vulnerability exists in Bar Assistant that stems from not validating parameters before making a request via Image::make, which could lead to arbitrary code execution...

GHSA-93P6-9CXV-5RPQ juzawebCMS Incorrect Access Control vulnerability

juzaweb = 3.4 is vulnerable to Incorrect Access Control, resulting in an application outage after a 500 HTTP status code. The payload in the timezone field was not correctly validated...