Smart Forms < 2.6.96 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup 1. Add a new form or edit an existing...

PT-2024-3762

Name of the Vulnerable Software and Affected Versions OpenSSL versions prior to 3.3.0 Description The issue is related to unbounded memory growth when processing TLSv1.3 sessions due to the use of the non-default SSL OP NO TICKET option. This can lead to a Denial of Service. The problem occurs wh...

PT-2024-23904 · Edwiser · Edwiser Bridge

Name of the Vulnerable Software and Affected Versions: Edwiser Bridge versions 3.0.2 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for potential exploitation by injecting...

PT-2024-23874 · Unknown · Sizam Rehub

Name of the Vulnerable Software and Affected Versions: Sizam Rehub versions through 19.6.1 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for potential exploitation by injecting malicious S...

PT-2024-18038 · WordPress · Element Pack Elementor Addons

Name of the Vulnerable Software and Affected Versions: The Element Pack Elementor Addons plugin for WordPress versions up to, and including, 5.5.3 Description: The issue is related to Stored Cross-Site Scripting via the element pack wrapper link attribute of the Trailer Box widget due to...

WP Chat App < 3.6.4 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admins to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed 1. Navigate to http://vulnerable-site.tld/wp-admin/admin.php?page=ntawhatsappfloatingwidge...

PT-2024-23887

Name of the Vulnerable Software and Affected Versions ConvertKit versions through 2.4.5 Description The issue is related to the insertion of sensitive information into log files. Recommendations For versions through 2.4.5, update to a version that contains a fix for this issue. At the moment, the...

PT-2024-24580 · WordPress · Embedpress

Name of the Vulnerable Software and Affected Versions: EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress versions up to, and including, 3.9.14 Description: The issue is related to Stored...

PT-2024-5024

Name of the Vulnerable Software and Affected Versions: tiagorlampert CHAOS version 5.0.1 tiagorlampert CHAOS versions before 1b451cf62582295b7225caf5a7b506f0bad56f6b and 24c9e109b5be34df7b2bce8368eae669c481ed5e Description: The issue allows a remote attacker to execute arbitrary code via the...

PT-2024-21010 · Elecom · Wmc-X1800Gst-B +2

Name of the Vulnerable Software and Affected Versions: ELECOM wireless LAN routers versions prior to v1.25 WRC-G01-W versions prior to v1.24 WMC-X1800GST-B versions prior to v1.41 Description: The issue allows a network-adjacent unauthenticated attacker to execute arbitrary OS commands by sending...

PT-2024-22178 · Very Good Plugins · Wp Fusion Lite

Name of the Vulnerable Software and Affected Versions: WP Fusion Lite versions 3.41.24 and earlier Description: The issue is related to an Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability. This vulnerability allows Command Injection in Very Good...

PT-2024-24203 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS versions 9 below 9.2.8 and versions below 8.5.16 Description: The issue concerns Cross-site Scripting XSS in the Advanced File Search Filter. A rogue administrator could add malicious code in the file manager due to insufficient...

PT-2024-22489 · Axigen · Axigen Mail Server

Name of the Vulnerable Software and Affected Versions: Axigen Mail Server for Windows versions 10.5.18 and before Description: An issue was discovered in Axigen Mail Server for Windows, allowing local low-privileged attackers to execute arbitrary code and escalate privileges via insecure DLL...

VMware Fusion SEoL (3.0.x)

According to its version, VMware Fusion is 3.0.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVEL 80900 C...

PT-2024-22563 · Mbed Tls +1 · Mbed Tls +1

Name of the Vulnerable Software and Affected Versions: Mbed TLS versions 3.5.x through 3.5.x before 3.6.0 Mbed TLS versions prior to 3.6.0 Description: An issue was discovered in Mbed TLS when an SSL context was reset with the mbedtls ssl session reset API, the maximum TLS version to be negotiate...

PT-2024-3273 · Google +4 · Google Chrome +4

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 123.0.6312.105 Description: The issue is related to a use after free in the Bookmarks element, which can be exploited by a remote attacker using a crafted HTML page, potentially leading to heap corruption. The...

PT-2024-23752

Name of the Vulnerable Software and Affected Versions Pulsar Web Design Weekly Class Schedule versions through 3.19 Description The issue is related to improper neutralization of input during web page generation, which leads to a Cross-site Scripting XSS vulnerability. This allows for Reflected X...

PT-2024-23786 · 10Web · 10Web Map Builder For Google Maps

Name of the Vulnerable Software and Affected Versions: 10Web Map Builder for Google Maps versions 1.0.74 and earlier Description: The issue is related to an SQL Injection vulnerability due to the improper neutralization of special elements used in an SQL command. Recommendations: For versions...

PT-2024-17573 · WordPress · Elementskit Elementor Addons

Name of the Vulnerable Software and Affected Versions: ElementsKit Elementor addons plugin for WordPress versions up to, and including, 3.0.6 Description: The issue is related to Stored Cross-Site Scripting via the button ID parameter due to insufficient input sanitization and output escaping. Th...

PT-2024-23442 · Unknown · Paid Memberships Pro – Payfast Gateway Add On

Name of the Vulnerable Software and Affected Versions: Paid Memberships Pro – Payfast Gateway Add On versions n/a through 1.4.1 Description: The issue is related to the insertion of sensitive information into log files. This could potentially expose sensitive data. Recommendations: For Paid...