AZL-54419 CVE-2024-45338 affecting package gh for versions less than 2.62.0-5

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...

WordPress Broken Link Checker | Finder plugin <= 2.5.0 - Authenticated (Author+) Blind Server-Side Request Forgery vulnerability

Authenticated Author+ Blind Server-Side Request Forgery vulnerability discovered by Francesco Carlucci in WordPress Plugin Broken Link Checker | Finder versions = 2.5.0...

PT-2024-16993 · WordPress · Scancircle

Name of the Vulnerable Software and Affected Versions: ScanCircle plugin for WordPress versions up to, and including, 2.9.2 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's scancircle shortcode. This allows...

Exploit for CVE-2024-54160

CVE-2024-54160-Opensearch-HTML-Injection + Stored XSS It w...

WordPress Animated Counters plugin <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin Animated Counters versions = 2.0...

PT-2024-36321 · Unknown · Mohamed Riyaz Admin Customization

Name of the Vulnerable Software and Affected Versions: Mohamed Riyaz Admin Customization versions prior to 2.2 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on...

GeoServer information leakage vulnerability

GeoServer is GeoServer open source an open source software server written in Java. It allows users to share and edit geospatial data. An information disclosure vulnerability exists in GeoServer versions prior to 2.25.1, which stems from allowing users to share and edit geospatial data...

LightFTP security vulnerability

LightFTP is a lightweight FTP service by hfiref0x individual developers. A security vulnerability exists in LightFTP version 2.3, which stems from a lack of thread security on the server and can be caused to crash by anomalous data sent by an anonymous user from a remote network...

WordPress Saksh Escrow System plugin <= 2.4 - SQL Injection vulnerability

SQL Injection vulnerability discovered by ghsinfosec Patchstack Alliance in WordPress Plugin Saksh Escrow System versions = 2.4...

WordPress Wr Age Verification plugin <= 2.0.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin Wr Age Verification versions = 2.0.0...

PT-2024-17014 · Filestack · Filestack Official Plugin For Wordpress

Name of the Vulnerable Software and Affected Versions: Filestack Official plugin for WordPress versions up to, and including, 2.0.0 Description: The issue is related to Reflected Cross-Site Scripting via the fstab and filestack options parameters due to insufficient input sanitization and output...

WordPress plugin “Posts and Products Views for WooCommerce” has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2023-36506

Missing Authorization vulnerability in YITHEMES YITH WooCommerce Waiting List yith-woocommerce-waiting-list allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Waiting List: from n/a through = 2.13.0...

CVE-2023-32798

Missing Authorization vulnerability in 10up Simple Page Ordering simple-page-ordering allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Page Ordering: from n/a through = 2.5.0...

CVE-2022-46840

Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1...

CVE-2022-46838

Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1...

CVE-2022-45826

Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 2.9.13...

PT-2024-17243 · WordPress · Newsmanapp

Name of the Vulnerable Software and Affected Versions: NewsmanApp plugin for WordPress versions up to, and including, 2.7.6 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'newsman subscribe widget' shortcode due to insufficient input sanitization and output...

PT-2024-36111 · Italystrap · Advanced Control Manager For Wordpress

Name of the Vulnerable Software and Affected Versions: Advanced Control Manager for WordPress by ItalyStrap versions through 2.16.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS...

WordPress Plugin Shortcodes Blocks Creator Ultimate Cross-Site Script Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...