PT-2024-12010 · Unknown · Igor Benic Simple Giveaways

Name of the Vulnerable Software and Affected Versions: Igor Benic Simple Giveaways versions 2.48.0 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For versions...

PT-2024-13511 · Contact Form 7 · Conditional Fields For Contact Form 7

Name of the Vulnerable Software and Affected Versions: Conditional Fields for Contact Form 7 versions through 2.4.1 Description: The issue affects the Conditional Fields for Contact Form 7 plugin due to a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access...

PT-2024-16921 · WordPress · Smart Popup Blaster

Name of the Vulnerable Software and Affected Versions: Smart PopUp Blaster plugin for WordPress versions up to, and including, 1.4.3 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'spb-button' shortcode due to insufficient input sanitization and output escaping ...

PT-2024-35909 · Unknown · Andy Moyle Church Admin

Name of the Vulnerable Software and Affected Versions: Andy Moyle Church Admin versions 5.0.8 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: For versions 5.0.8 and...

GHSA-VXCF-C7MX-PG53 Build corruption when using `PYO3_CONFIG_FILE` environment variable

In PyO3 0.23.0 the PYO3CONFIGFILE environment variable used to configure builds regressed such that changing the environment variable would no longer trigger PyO3 to reconfigure and recompile. In combination with workflows using tools such as maturin to build for multiple versions in a single...

PT-2024-17330 · WordPress · Mightyforms

Name of the Vulnerable Software and Affected Versions: Contact Form, Survey & Form Builder – MightyForms plugin for WordPress versions up to, and including, 1.3.9 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'mightyforms' shortcode due to insufficient input...

PT-2024-35304 · Unknown · Anmari Amr Shortcodes

Name of the Vulnerable Software and Affected Versions: anmari amr shortcodes versions 1.7 and earlier Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows Reflected XSS. This enables attackers to injec...

PT-2024-35456 · Unknown · Simplesamlphp Saml2 Library

Name of the Vulnerable Software and Affected Versions: SimpleSAMLphp SAML2 library versions prior to 4.6.14 SimpleSAMLphp SAML2 library versions prior to 5.0.0-alpha.18 Description: The SimpleSAMLphp SAML2 library is vulnerable to an XML External Entity XXE attack when loading untrusted XML...

PT-2024-36891

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.74 Description A vulnerability in the Linux kernel has been resolved, related to the io uring/tctx component. The issue arises when the xa store function fails to allocate memory, causing the -head to be...

PT-2024-17191 · WordPress · Kudos Donations – Easy Donations/Payment With Mollie

Name of the Vulnerable Software and Affected Versions: Kudos Donations – Easy donations and payment with Mollie plugin for WordPress versions up to and including 3.2.9 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg without proper escaping on th...

PT-2024-35337 · Elementor · Absolute Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Absolute Addons For Elementor versions 1.0.14 and earlier Description: The issue is related to improper control of filenames for include/require statements in PHP programs, also known as PHP Remote File Inclusion. This allows for Local Code...

PT-2024-16483

Name of the Vulnerable Software and Affected Versions YaDisk Files WordPress plugin versions 1.2.5 and earlier Description The YaDisk Files WordPress plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripti...

PT-2024-11584 · Ipp · Ipp

Name of the Vulnerable Software and Affected Versions: IPP software versions prior to 1.71 Description: The issue is related to a default credential vulnerability. This could lead attackers to identify and access vulnerable systems. Recommendations: For versions prior to 1.71, update to version...

PT-2024-16935 · WordPress · Pdf Invoices & Packing Slips Generator For Woocommerce

Name of the Vulnerable Software and Affected Versions: PDF Invoices & Packing Slips Generator for WooCommerce plugin for WordPress versions up to, and including, 2.2.1 Description: The issue arises from the use of add query arg without proper escaping on the URL, leading to Reflected Cross-Site...

PT-2024-16620 · WordPress · The Tribute Testimonials

Name of the Vulnerable Software and Affected Versions: The Tribute Testimonials – WordPress Testimonial Grid/Slider plugin versions up to, and including, 1.0.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's tribute testimonials slider shortcode due to insufficie...

PT-2024-35313 · Unknown · Html5 Lyrics Karaoke Player

Name of the Vulnerable Software and Affected Versions: HTML5 Lyrics Karaoke Player versions n/a through 2.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS attacks...

PT-2024-34963 · Teconce · Teconce Wezido

Name of the Vulnerable Software and Affected Versions: Teconce Wezido versions 1.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing DOM-Based XSS. This means that an attacker can inject...

PT-2024-16721 · WordPress · Wpb Popup For Contact Form 7

Name of the Vulnerable Software and Affected Versions: WPB Popup for Contact Form 7 versions 1.7.5 and earlier Description: The issue is related to arbitrary shortcode execution via the wpb pcf fire contact form AJAX action. This is due to the software allowing users to execute an action that doe...

PT-2024-35055 · Unknown · Websand Subscription Form

Name of the Vulnerable Software and Affected Versions: Websand Subscription Form versions 1.0.3 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can inject...

PT-2024-32978 · Unknown · Weaver E-Cology

Name of the Vulnerable Software and Affected Versions: Weaver E-cology versions 9. Description: A vulnerability in Weaver E-cology allows attackers to use race conditions to bypass security mechanisms, potentially leading to the upload of malicious files and control of server privileges...