PT-2024-17426 · WordPress · Smsa Shipping

Name of the Vulnerable Software and Affected Versions: SMSA Shipping plugin for WordPress versions up to, and including, 2.2 Description: The SMSA Shipping plugin for WordPress has a flaw in the smsa delete label function due to insufficient file path validation. This issue allows authenticated...

PT-2024-17515 · WordPress · Ultimate Endpoints With Rest Api

Name of the Vulnerable Software and Affected Versions: Ultimate Endpoints With Rest Api plugin for WordPress versions up to, and including, 2.2.2 Description: The issue is related to Reflected Cross-Site Scripting via the page parameter due to insufficient input sanitization and output escaping...

WordPress Events Addon for Elementor plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Events Addon for Elementor versions = 2.2.2...

WordPress plugin Simple Side Tab 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin Themesflat Addons For Elementor 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress Lewe Bootstrap Visuals plugin <= 2.2.2 - Stored Cross Site Scripting (XSS) vulnerability

Stored Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Lewe Bootstrap Visuals versions = 2.2.2...

WordPress Download Plugin plugin <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) User Metadata and Comment Download vulnerability

Missing Authorization to Authenticated Subscriber+ User Metadata and Comment Download vulnerability discovered by WordFence in WordPress Plugin Download versions = 2.2.0...

CVE-2024-49335

Cross-Site Request Forgery CSRF vulnerability in Edush Maxim GoogleDrive folder list allows Stored XSS.This issue affects GoogleDrive folder list: from n/a through 2.2.2...

PT-2024-40507 · Diesel · Diesel

Name of the Vulnerable Software and Affected Versions: Diesel versions prior to 2.2.3 Description: The issue concerns a SQL injection vulnerability that can be exploited by encoding a value larger than 4GiB, causing the length prefix in the protocol to overflow. This can lead to the server...

WordPress WPCafe plugin <= 2.2.28 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin WPCafe versions = 2.2.28...

Beego 安全漏洞

Beego is an open source web framework based on the Go language from Beego Open Source. A security vulnerability exists in Beego before version v.2.2.0. A remote attacker could elevate privileges through the getCacheFileName function in the file.go file...

DEBIAN-CVE-2024-36600

Buffer Overflow Vulnerability in libcdio 2.2.0 fixed in 2.3.0 allows an attacker to execute arbitrary code via a crafted ISO 9660 image file...

PT-2024-15512 · WordPress · The Ai Engine: Chatbots

Name of the Vulnerable Software and Affected Versions: The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress versions up to, and including, 2.2.0 Description: The issue is related to Stored Cross-Site Scripting via the AI chat data when discussion tracking is...

SQLAlchemyDA SQL Injection Vulnerability

SQLAlchemyDA is a general purpose database adapter from the Zope Foundation. A SQL injection vulnerability exists in versions prior to SQLAlchemyDA 2.2, which stems from a vulnerability that allows unauthenticated execution of arbitrary SQL statements on a database to which a SQLAlchemyDA instanc...

CVE-2024-24866

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Biteship Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo allows Reflected XSS.This issue affects Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo: from n/a through 2.2.24...

CVE-2023-50589

Grupo Embras GEOSIAP ERP v2.2.167.02 was discovered to contain a SQL injection vulnerability via the codLogin parameter on the login page...

PT-2023-32655

Name of the Vulnerable Software and Affected Versions BigProf Online Clinic Management System version 2.2 Description A vulnerability has been discovered in the system, which does not sufficiently encode user-controlled input, resulting in persistent XSS through the "/clinic/medical records...

PT-2023-31283 · Jenkins · Jenkins Neuvector Vulnerability Scanner Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins NeuVector Vulnerability Scanner Plugin versions 1.22 and earlier Description: A cross-site request forgery CSRF vulnerability exists due to the lack of permission checks in a connection test HTTP endpoint, allowing attackers with...

CVE-2023-47522

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Photo Feed plugin = 2.2.1 versions...

PYSEC-2023-215

Cross-site Scripting XSS - DOM in GitHub repository modoboa/modoboa prior to 2.2.2...