8688 matches found
WordPress plugin YayExtra 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...
CVE-2024-7302
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 3gp2 file uploads in all versions up to, and including, 7.5.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...
CVE-2024-7302
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 3gp2 file uploads in all versions up to, and including, 7.5.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...
CVE-2024-6687
The CTT Expresso para WooCommerce plugin for WordPress is vulnerable to sensitive information exposure in all versions up to and including 3.2.12 via the /wp-content/uploads/cepw directory. The generated .pdf and log files are publicly accessible and contain sensitive information such as sender a...
CVE-2024-6687
CVE-2024-6687 affects the WordPress plugin CTT Expresso para WooCommerce (versions ≤ 3.2.12). The flaw exposes sensitive data via /wp-content/uploads/cepw, where generated .pdf and log files containing sender/receiver names, phone numbers, physical addresses, and email addresses are publicly acce...
PT-2024-37799 · WordPress · Ctt Expresso Para Woocommerce
Name of the Vulnerable Software and Affected Versions: CTT Expresso para WooCommerce plugin for WordPress versions up to and including 3.2.12 Description: The issue concerns the exposure of sensitive information in the CTT Expresso para WooCommerce plugin for WordPress. This exposure occurs via t...
Baidu UEditor 代码问题漏洞
Baidu UEditor is a WYSIWYG rich text web editor from the Chinese company Baidu. A code issue vulnerability exists in Baidu UEditor version 1.4.3.3, which stems from the operation of the parameter upfile that can lead to unrestricted uploads...
Cross-Site Scripting (XSS)
quivr is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper sanitization of URL uploads, allowing users to insert malicious JavaScript payloads. Attackers can use this to execute JavaScript whenever any user clicks on a link containing the payload...
The vulnerability in the OpenResty web platform’s control panel for the Linux server 1Panel involves a lack of security measures regarding the SQL query structure. This allows attackers to execute arbitrary code and upload any files they desire.
The vulnerability of the OpenResty web platform’s control panel for the Linux server 1Panel relates to the lack of security measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code and upload arbitrary files...
YouDianCMS 代码问题漏洞
YouDianCMS YouDian CMS is a website builder from China YouDian Company. A code issue vulnerability exists in YouDianCMS version 7, which originates from the parameter files in the file /Public/ckeditor/plugins/multiimage/dialogs/imageupload.php that can lead to unrestricted uploads...
CVE-2024-38529
Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.10, there is a Remote Code Execution Vulnerability in the Message module of the Admidio Application, where it is possible to upload a PHP file in the attachment. The...
Online Food Ordering System 代码问题漏洞
Online Food Ordering System is itsourcecode open source online food ordering system. A code issue vulnerability exists in Online Food Ordering System version 1.0, which stems from an incorrect manipulation of the parameter photo that can lead to unrestricted uploads...
Society Management System 代码问题漏洞
Society Management System is an itsourcecode open source social management system. A code issue vulnerability exists in the Society Management System version 1.0, which stems from an incorrect manipulation of the parameter image that can lead to unrestricted uploads...
CVE-2024-42054
Cervantes through 0.5-alpha accepts insecure file uploads...
CVE-2024-42054
Cervantes through 0.5-alpha accepts insecure file uploads...
CVE-2024-42054
CVE-2024-42054 affects Cervantes up to version 0.5-alpha, where the product accepts insecure file uploads. The connected documents confirm the core issue is insecure file upload handling, but do not provide concrete technical details (e.g., affected components, exact vectors, or patch versions). ...
Cervantes 安全漏洞
Cervantes is an open source collaboration platform designed for Pentester and Red Teams by Cervantes Open Source. A security vulnerability exists in Cervantes 0.5-alpha and earlier versions that stems from accepting insecure file uploads...
PT-2024-29714 · Cervantes · Cervantes
Name of the Vulnerable Software and Affected Versions: Cervantes versions through 0.5-alpha Description: The issue allows for insecure file uploads. Recommendations: For versions through 0.5-alpha, consider restricting file upload functionality until a secure version is available. As a temporary...
