CVE-2024-8960

CVE-2024-8960: Cowidgets – Elementor Addons for WordPress suffers Stored Cross-Site Scripting via SVG uploads in all versions

CVE-2024-9270

CVE-2024-9270 is active in Lenxel Core LMS (Lenxel Core) WordPress plugin prior to 1.2.3, vulnerable to Stored XSS via SVG file uploads due to insufficient input sanitization and output escaping. Affected versions up to 1.1 allow an authenticated attacker (Author+ level) to inject scripts in page...

PT-2024-16560

Name of the Vulnerable Software and Affected Versions WordPress User Extra Fields plugin versions up to and including 16.5 Description The WordPress User Extra Fields plugin is vulnerable to arbitrary file uploads due to missing file type validation in the ajax manage file chunk upload function...

WordPress plugin WordPress User Extra Fields 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists i...

BIT-MEMCACHED-2022-48571

memcached 1.6.7 allows a Denial of Service via multi-packet uploads in UDP...

RLSA-2024:8842 Moderate: python3.12-urllib3 security update

urllib3 is a powerful, user-friendly HTTP client for Python. urllib3 brings many critical features that are missing from the Python standard libraries: • Thread safety. • Connection pooling. • Client-side SSL/TLS verification. • File uploads with multipart encoding. • Helpers for retrying request...

CVE-2024-10325

The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 1.6.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-10325

CVE-2024-10325 affects Elementor Header & Footer Builder (Ultimate Addons for Elementor) for WordPress. Desktop/REST SVG File Uploads allow Stored XSS due to insufficient input sanitization and output escaping in SVG handling. Affected versions: up to 1.6.45. Exploitation requires authentication ...

CVE-2024-10269

The Easy SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access a...

CodeAstro Real Estate Management System 代码问题漏洞

CodeAstro Real Estate Management System is a real estate management system from CodeAstro. A code issue vulnerability exists in CodeAstro Real Estate Management System version 1.0, which stems from the parameter aimage in the file /aboutadd.php that can lead to unrestricted uploads...

Codezips Online Institute Management System 安全漏洞

Codezips Online Institute Management System is an open source online institute management system from Codezips. A security vulnerability exists in Codezips Online Institute Management System version 1.0, which stems from the parameter image in the file /edituser.php that can lead to unrestricted...

Codezips Online Institute Management System 代码问题漏洞

Codezips Online Institute Management System is a Codezips open source online institute management system. A code issue vulnerability exists in Codezips Online Institute Management System version 1.0, which stems from the parameter websiteimage in the file /managewebsite.php that can lead to...

PT-2024-39528 · WordPress · Lenxel Core For Lenxel(Lnx) Lms

Name of the Vulnerable Software and Affected Versions: Lenxel Core for LenxelLNX LMS plugin for WordPress versions up to, and including, 1.1 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allow...

CodeAstro Real Estate Management System 代码问题漏洞

CodeAstro Real Estate Management System is a real estate management system from CodeAstro. A code issue vulnerability exists in CodeAstro Real Estate Management System version 1.0, which stems from the parameter aimage in the file /aboutedit.php that can lead to unrestricted uploads...

PT-2024-16421

Name of the Vulnerable Software and Affected Versions WooCommerce Support Ticket System plugin for WordPress versions up to, and including, 17.7 Description The issue is related to arbitrary file uploads due to missing file type validation in the ajax manage file chunk upload function. This allow...

Vulnerability of the handle_imageUpload() function in the plugin for creating customizable content based on artificial intelligence (AI): The Complete AI Pack from the WordPress content management system allows attackers to execute arbitrary code.

Vulnerability of the handleimageUpload function in the plugin for creating customizable content based on artificial intelligence AI: The Complete AI Pack of the WordPress content management system is associated with unlimited uploading of dangerous types of files. Exploiting this vulnerability...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the Create User function. An attacker can inject malicious scripts by uploading specially crafted SVG files. This is only exploitable if the application does not properly sanitize user input specifically...

CVE-2024-20476

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to bypass the authorization mechanisms for specific file management functions. This vulnerability is due to lack of server-side validation of Administrator permissions. An attacker cou...

CVE-2024-8614

The JobSearch WP Job Board plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jobsearchwphandleupload function in all versions up to, and including, 2.6.7. This makes it possible for authenticated attackers, with subscriber-level access and...

CVE-2024-8615

The JobSearch WP Job Board plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jobsearchlocationloadexcelfilecallback function in all versions up to, and including, 2.6.7. This makes it possible for unauthenticated attackers to upload arbitrary...