PT-2024-28617 · WordPress · Cooked

Name of the Vulnerable Software and Affected Versions: Cooked versions up to, and including, 1.7.15.4 Description: The Cooked plugin for WordPress is affected by a Cross-Site Request Forgery CSRF issue due to missing or incorrect nonce validation on the AJAX action handler. This could allow an...

AZL-50565 CVE-2024-21127 affecting package mysql for versions less than 8.0.40-1

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DDL. Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

WordPress The Pack Elementor addons plugin <= 2.0.8.6 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro Soares de Alcântara Kinorth in WordPress Plugin The Pack Elementor addons versions = 2.0.8.6...

WordPress HUSKY plugin <= 1.3.6 - Unauthenticated Time-Based SQL Injection vulnerability

Unauthenticated Time-Based SQL Injection vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin HUSKY versions = 1.3.6...

CVE-2024-38706

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in HasThemes HT Mega allows Path Traversal.This issue affects HT Mega: from n/a through 2.5.7...

WordPress Matomo Analytics plugin <= 5.1.1 - Cross Site Request Forgery (CSRF) leading to Notice Dismissal vulnerability

Cross Site Request Forgery CSRF leading to Notice Dismissal vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin Matomo Analytics versions = 5.1.1...

CVE-2024-6353

The Wallet for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'searchvalue' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...

WordPress Wallet for WooCommerce plugin <= 1.5.4 - Authenticated (Subscriber+) SQL Injection via 'search[value]' vulnerability

Authenticated Subscriber+ SQL Injection via 'searchvalue' vulnerability discovered by 1337Wannabe in WordPress Plugin TeraWallet – For WooCommerce versions = 1.5.4...

WordPress plugin Woocommerce OpenPos path traversal vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...

CVE-2024-6679 witmy my-springsecurity-plus role sql injection

A vulnerability classified as critical has been found in witmy my-springsecurity-plus up to 2024-07-04. Affected is an unknown function of the file /api/role. The manipulation of the argument params.dataScope leads to sql injection. It is possible to launch the attack remotely. The exploit has be...

WordPress Plum: Spin Wheel & Email Pop-up plugin <= 2.0 - Broken Access Control to Unauth Stored XSS vulnerability

Broken Access Control to Unauth Stored XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Plum: Spin Wheel & Email Pop-up versions = 2.0...

WordPress Plum: Spin Wheel & Email Pop-up plugin <= 2.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Plum: Spin Wheel & Email Pop-up versions = 2.0...

WordPress ElementInvader Addons for Elementor plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Michael Patchstack Alliance in WordPress Plugin ElementInvader Addons for Elementor versions = 1.2.4...

WordPress Academy LMS plugin <= 2.0.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by filime Patchstack Alliance in WordPress Plugin Academy LMS versions = 2.0.4...

WordPress Zoho CRM Lead Magnet plugin <= 1.7.8.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Dimas Maulana Patchstack Alliance in WordPress Plugin Zoho CRM Lead Magnet versions = 1.7.8.8...

WordPress Plum: Spin Wheel & Email Pop-up Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)

Software Plum: Spin Wheel & Email Pop-up Type Plugin Vulnerable versions = 2.0 Fixed in N/A OWASP Top 10 A1: Injection Classification Cross Site Scripting XSS CVE CVE-2024-38744 Patch priority High CVSS severity High 8.3 Developer Claim ownership PSID 688ef82694b8 Credits Ananda Dhakal Patchstack...

WordPress spiffy-calendar plugin <= 4.9.11 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Nguyễn Trung Kiên Patchstack Alliance in WordPress Plugin Spiffy Calendar versions = 4.9.11...

CVE-2024-6644 zmops ArgusDBM AviatorScript CalculateAlarm.java getDefaultClassLoader deserialization

A vulnerability was found in zmops ArgusDBM up to 0.1.0. It has been classified as critical. Affected is the function getDefaultClassLoader of the file CalculateAlarm.java of the component AviatorScript Handler. The manipulation leads to deserialization. It is possible to launch the attack...

WordPress FancyPost plugin <= 5.3.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by 4rCanJ0x! Patchstack Alliance in WordPress Plugin FancyPost versions = 5.3.1...

WordPress SlingBlocks plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by SouzaZinn Patchstack Alliance in WordPress Plugin SlingBlocks versions = 1.4.1...