WordPress Miniorange OTP Verification with Firebase plugin <= 3.6.0 - Authentication Bypass vulnerability

Authentication Bypass vulnerability discovered by István Márton in WordPress Plugin Miniorange OTP Verification with Firebase versions = 3.6.0...

WordPress Timetable and Event Schedule by MotoPress plugin <= 2.3.8 - Missing Authorization vulnerability

Missing Authorization vulnerability discovered by Ram in WordPress Plugin Timetable and Event Schedule versions = 2.3.8...

CVE-2023-22650 Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider

A vulnerability has been identified in which Rancher does not automatically clean up a user which has been deleted from the configured authentication provider AP. This characteristic also applies to disabled or revoked users, Rancher will not reflect these modifications which may leave the user’s...

PT-2024-10573

Name of the Vulnerable Software and Affected Versions Kento Post View Counter plugin for WordPress versions up to, and including, 2.8 Description The issue allows unauthenticated attackers to perform SQL Injection via the kento pvc geo parameter due to insufficient escaping on the user-supplied...

PT-2024-39513 · WordPress · Redi Restaurant Reservation

Name of the Vulnerable Software and Affected Versions: ReDi Restaurant Reservation plugin for WordPress versions up to, and including, 24.0902 Description: The ReDi Restaurant Reservation plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add query arg without...

PT-2024-32945 · Boyan Raichev · Ip Loc8

Name of the Vulnerable Software and Affected Versions: Boyan Raichev IP Loc8 versions n/a through 1.1 Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection in Boyan Raichev IP Loc8. This vulnerability can be exploited due to the deserialization of...

WordPress plugin Disc Golf Manager 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

AZL-50406 CVE-2024-21199 affecting package mysql for versions less than 8.0.40-1

Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise...

WordPress Job Board Manager for WordPress plugin <= 1.0 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin Job Board Manager for WordPress versions = 1.0...

WordPress My Reading Library plugin <= 1.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin My Reading Library versions = 1.0...

WordPress Kama SpamBlock plugin <= 1.8.2 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Kama SpamBlock versions = 1.8.2...

WordPress Zoho CRM Lead Magnet plugin <= 1.7.9.7 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Trương Hữu Phúc Patchstack Alliance in WordPress Plugin Zoho CRM Lead Magnet versions = 1.7.9.7...

WordPress WP SendFox plugin <= 1.3.1 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin WP SendFox versions = 1.3.1...

encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion

A flaw was found in the encoding/gob package of the Golang standard library. Calling Decoder.Decoding, a message that contains deeply nested structures, can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635...

encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion

A flaw was found in the encoding/gob package of the Golang standard library. Calling Decoder.Decoding, a message that contains deeply nested structures, can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635...

kernel: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Release hbalock before calling lpfcworkerwakeup lpfcworkerwakeup calls the lpfcworkdone routine, which takes the hbalock. Thus, lpfcworkerwakeup should not be called while holding the hbalock to avoid potential deadlo...

VulnCheck KEV: CVE-2023-7288

The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the updateprofilepreference function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with...

VulnCheck KEV: CVE-2019-25214

The ShopWP plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST API routes in versions up to, and including, 2.0.4. This makes it possible for unauthenticated attackers to call the endpoints and perform unauthorized actions such as...

WordPress VOD Infomaniak plugin <= 1.5.7 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin VOD Infomaniak versions = 1.5.7...

WordPress Crazy Call To Action Box plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Crazy Call To Action Box versions = 1.0.5...