187 matches found
CVE-2024-54283 WordPress SeedProd Pro plugin <= 6.18.10 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in SeedProd LLC SeedProd Pro allows SQL Injection.This issue affects SeedProd Pro: from n/a through 6.18.10...
CVE-2024-11359 Library Bookshelves <= 5.8 - Reflected Cross-Site Scripting
The Library Bookshelves plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 5.8. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...
PT-2024-35245 · Unknown · Wibergs Web Csv To Html
Name of the Vulnerable Software and Affected Versions: Wibergs Web CSV to html versions n/a through 3.04 Description: The issue allows for the unrestricted upload of files with dangerous types, enabling the upload of a web shell to a web server. This can lead to harmful files being uploaded...
AZL-52520 CVE-2024-50124 affecting package kernel for versions less than 6.6.64.2-1
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix UAF on isosocktimeout conn-sk maybe have been unlinked/freed while waiting for isoconnlock so this checks if the conn-sk is still valid by checking if it part of isosklist...
WordPress Featured Posts Scroll plugin <= 1.25 - CSRF to Stored Cross Site Scripting (XSS) vulnerability
CSRF to Stored Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Featured Posts Scroll versions = 1.25...
WordPress BP Member Type Manager plugin <= 1.01 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin BP Member Type Manager versions = 1.01...
WordPress SendPulse Free Web Push plugin <= 1.3.6 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Francesco Carlucci in WordPress Plugin SendPulse Free Web Push versions = 1.3.6...
WordPress ShopLentor plugin <= 2.9.8 - Authenticated (Contributor+) Sensitive Information Exposure via WL: FAQ Widget Elementor Template vulnerability
Authenticated Contributor+ Sensitive Information Exposure via WL: FAQ Widget Elementor Template vulnerability discovered by Ankit Patel in WordPress Plugin ShopLentor versions = 2.9.8...
WordPress Stripe Payments For WooCommerce plugin <= 1.9.1 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin Stripe Payments For WooCommerce by Checkout versions = 1.9.1...
PT-2024-37989 · Prain · Prain
Name of the Vulnerable Software and Affected Versions: Prain versions up to 1.3.0 Description: A critical issue has been found in the HTTP POST Request Handler component, specifically affecting some unknown functionality of the file /?import. The manipulation of the file argument leads to code...
PT-2024-24150 · WordPress · Jeg Elementor Kit
Name of the Vulnerable Software and Affected Versions: Jeg Elementor Kit plugin for WordPress versions up to, and including, 2.6.4 Description: The issue is related to Stored Cross-Site Scripting via the countdown widget's attributes due to insufficient input sanitization and output escaping. Thi...
CVE-2020-36829
The Mojolicious module before 8.65 for Perl is vulnerable to securecompare timing attacks that allow an attacker to guess the length of a secret string. Only versions after 1.74 are affected...
WordPress Comments Import & Export plugin <= 2.3.5 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin WordPress Comments Import & Export versions = 2.3.5...
AZL-32206 CVE-2023-50471 affecting package apparmor for versions less than 3.0.4-3
cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSONInsertItemInArray at cJSON.c...
CVE-2023-34178
A vulnerability in Adrian Tobey Groundhogg groundhogg.This issue affects Groundhogg: from n/a through = 2.7.11...
CVE-2023-45606
Cross-Site Request Forgery CSRF vulnerability in Lasso Simple URLs plugin = 120 versions...
CVE-2023-44240
Cross-Site Request Forgery CSRF vulnerability in Peter Butler Timthumb Vulnerability Scanner plugin = 1.54 versions...
PT-2023-22643 · Softwarex · Softwarex
Name of the Vulnerable Software and Affected Versions: SoftwareX versions =2.0.44 Description: Reflected XSS affects the mode parameter in the "/admin" functionality of the web application. Recommendations: For versions =2.0.44, update to a version greater than 2.0.44 to resolve the issue. As a...
CVE-2023-2887 User Authentication Bypass in CBOT's Chatbot
Authentication Bypass by Spoofing vulnerability in CBOT Chatbot allows Authentication Bypass. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7...