PT-2025-2134 · WordPress · Sandbox

Name of the Vulnerable Software and Affected Versions: Sandbox plugin for WordPress versions up to and including 0.4 Description: The issue is related to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts in pages through the...

WordPress Sandbox plugin <= 0.4 - Missing Authorization to Authenticated (Subscriber+) Sandbox Download vulnerability

Missing Authorization to Authenticated Subscriber+ Sandbox Download vulnerability discovered by Stiofan in WordPress Theme Sandbox versions = 0.4...

CVE-2024-12447 Get Post Content Shortcode <= 0.4 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via post_content Shortcode

The Get Post Content Shortcode plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 0.4 via the 'post-content' shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

WordPress plugin Zajax 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request...

PT-2024-34787 · WordPress · Amazon Associate Filter

Name of the Vulnerable Software and Affected Versions: Amazon Associate Filter versions 0.4 and earlier Description: A Cross-Site Request Forgery CSRF vulnerability allows Stored XSS attacks. This issue affects the Amazon Associate Filter plugin for WordPress. Remediation is crucial to safeguard...

libproxy: uncontrolled recursion via an infinite stream response leading to stack exhaustion

A flaw was found in libproxy in versions 0.4 through 0.4.15. A remote HTTP server can trigger an uncontrolled recursion via a response composed of an infinite stream that lacks a newline character leading to a stack exhaustion. The highest threat from this vulnerability is to system availability...

PT-2024-29335 · Filestash · Filestash

Name of the Vulnerable Software and Affected Versions: filestash version 0.4 Description: An issue was discovered where the usage of the ssh.InsecureIgnoreHostKey function disables host key verification. This could possibly allow attackers to obtain sensitive information via a man-in-the-middle...

WordPress plugin List categories 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. WordPress is a blogging platform developed in the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

PT-2024-30600 · WordPress · List Categories

Name of the Vulnerable Software and Affected Versions: List categories plugin for WordPress versions up to, and including, 0.4 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's 'categories' shortcode. This allows...

CVE-2024-24817 User can see invitees in events created in PMs and private categories

Discourse Calendar adds the ability to create a dynamic calendar in the first post of a topic on the open-source discussion platform Discourse. Prior to version 0.4, event invitees created in topics in private categories or PMs private messages can be retrieved by anyone, even if they're not logg...

PT-2024-20583 · Discourse · Discourse Calendar

Name of the Vulnerable Software and Affected Versions: Discourse Calendar versions prior to 0.4 Description: The issue allows event invitees created in private categories or private messages to be retrieved by anyone, even if they are not logged in. This is a problem with the Discourse Calendar...

CVE-2023-48220 Decidim's devise_invitable gem vulnerable to circumvention of invitation token expiry period

Decidim is a participatory democracy framework. Starting in version 0.4.rc3 and prior to version 2.0.9 of the deviseinvitable gem, the invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality. This issue creates vulnerable...

CVE-2018-25096

A vulnerability was found in MdAlAmin-aol Own Health Record 0.1-alpha/0.2-alpha/0.3-alpha/0.3.1-alpha. It has been rated as problematic. This issue affects some unknown processing of the file includes/logout.php. The manipulation leads to cross-site request forgery. The attack may be initiated...

libming 缓冲区错误漏洞

libming is a Flash SWF output library written in the C language. A security vulnerability exists in libming version v.0.4. The vulnerability stems from the presence of a buffer overflow vulnerability that allows remote attackers to cause a denial of service via a crafted file...

WordPress Paid Memberships Pro CCBill Gateway Plugin <= 0.3 is vulnerable to Broken Access Control

Software Paid Memberships Pro CCBill Gateway Type Plugin Vulnerable versions = 0.3 Fixed in 0.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-40608 Patch priority Low CVSS severity Low 8.2 Developer Claim ownership PSID 6824186fd879 Credits Rafie Muhamma...

ngiflib 资源管理错误漏洞

ngiflib is a library for decoding the GIF image format written in C. It can be used to decode GIF images. A security vulnerability exists in ngiflib version 0.4, which stems from a SEGV memory error when using SDLaffgif...

WordPress Plugin Kyle Maurer Don8 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2023-22679 WordPress WP Better Emails Plugin <= 0.4 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Nicolas Lemoine WP Better Emails plugin = 0.4 versions...

Jenkins Plugin PWauth Security Realm 路径遍历漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

WordPress WP Better Emails Plugin <= 0.4 is vulnerable to Cross Site Scripting (XSS)

Software WP Better Emails Type Plugin Vulnerable versions = 0.4 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-22679 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 8921f81e46cb Credits Mika Required privilege...