PT-2024-38379 · WordPress · Forms For Mailchimp By Optin Cat

Name of the Vulnerable Software and Affected Versions: The Forms for Mailchimp by Optin Cat – Grow Your MailChimp List plugin for WordPress versions up to, and including, 2.5.6 Description: The issue is related to Stored Cross-Site Scripting via the form color parameters due to insufficient input...

PT-2024-39767 · WordPress · Rescue Shortcodes

Name of the Vulnerable Software and Affected Versions: Rescue Shortcodes plugin for WordPress versions up to, and including, 2.8 Description: The issue is related to Stored Cross-Site Scripting via the plugin's rescue tab shortcode due to insufficient input sanitization and output escaping on...

Security update for apache-commons-io

This update for apache-commons-io fixes the following issues: Upgrade to 2.17.0: CVE-2024-47554: Fixed untrusted input to XmlStreamReader can lead to uncontrolled resource consumption bsc1231298 Other changes: - https://commons.apache.org/proper/commons-io/changes-report.htmla2.17.0 Patch...

CVE-2024-9520

The UserPlus plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 2.0. This makes it possible for authenticated attackers with subscriber-level permissions or above, ...

CVE-2024-9522

The WP Users Masquerade plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.0. This is due to incorrect authentication and capability checking in the 'ajaxmasqlogin' function. This makes it possible for authenticated attackers, with subscriber-level...

Classroombookings 安全漏洞

Classroombookings is a Php, Mysql based school room booking system by Craig A Rodway Individual Developer. A security vulnerability exists in Classroombookings version 2.8.7, which stems from the parameter Name of the file/sessions of the component Session Page can lead to a cross-site scripting...

DEBIAN-CVE-2024-28168

Improper Restriction of XML External Entity Reference 'XXE' vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: 2.9. Users are recommended to upgrade to version 2.10, which fixes the issue...

UBUNTU-CVE-2024-28168

Improper Restriction of XML External Entity Reference 'XXE' vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: 2.9. Users are recommended to upgrade to version 2.10, which fixes the issue...

WordPress Telecash Ricaricaweb plugin <= 2.2 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin Telecash Ricaricaweb versions = 2.2...

PT-2024-39605 · WordPress · [Product]

Name of the Vulnerable Software and Affected Versions: Products, Order & Customers Export for WooCommerce plugin for WordPress versions up to, and including, 2.0.15 Description: The issue is related to Reflected Cross-Site Scripting, which occurs due to the use of add query arg and remove query a...

eWeLink 安全漏洞

eWeLink is a smart home assistant from eWeLink, Inc. A security vulnerability exists in eWeLink version 2.0.0 and prior versions that stems from SSL Pinning bypassing certain hardware products, allowing a local attacker to decrypt TLS communications and extract secrets in order to clone the devic...

CVE-2024-47356

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Catch Themes Create allows Stored XSS.This issue affects Create: from n/a through 2.9.1...

PT-2024-32546 · Unknown · Sky Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Sky Addons for Elementor versions through 2.5.11 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Stored XSS. This means that an attacker ca...

WordPress plugin WP Cleanup and Basic Functions 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

WordPress plugin Payflex Payment Gateway 输入验证错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An input validation error...

TP-LINK TL-WDR5620 安全漏洞

TP-LINK TL-WDR5620 is a wireless router from China P&L TP-LINK. A security vulnerability exists in TP-LINK TL-WDR5620 version 2.3, which originates from a remote code execution vulnerability contained in the httpProcDataSrv function...

WordPress Paid Membership Subscriptions plugin <= 2.12.8 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Colin Xu in WordPress Plugin Paid Member Subscriptions versions = 2.12.8...

PT-2024-31877 · Cloudlog · Cloudlog

Name of the Vulnerable Software and Affected Versions: Cloudlog version 2.6.15 Description: A SQL Injection issue was discovered, specifically within the get station info function located in the file /application/models/Oqrs model.php. The issue is exploitable via the station id parameter. This...

WordPress plugin QS Dark Mode 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress Ultimate Store Kit Elementor Addons plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin Ultimate Store Kit Elementor Addons versions = 2.0.5...