WordPress WP Easy Gallery Plugin <= 4.8.5 is vulnerable to SQL Injection

Software WP Easy Gallery Type Plugin Vulnerable versions = 4.8.5 Fixed in N/A OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-8436 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID eb8025528f3a Credits Lucio Sá Required privilege Subscriber Published 2...

WordPress Charitable Plugin <= 1.8.1.14 is vulnerable to Privilege Escalation

Software Charitable Type Plugin Vulnerable versions = 1.8.1.14 Fixed in 1.8.1.15 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-8791 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 04c66e8c147c Credits wesley...

WordPress Premium Packages Plugin <= 5.9.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Premium Packages Type Plugin Vulnerable versions = 5.9.1 Fixed in 5.9.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-7386 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 2a28cf37d3f9 Credits Jonas Benjamin...

WordPress WP Datepicker Plugin <= 2.1.1 is vulnerable to Cross Site Scripting (XSS)

Software WP Datepicker Type Plugin Vulnerable versions = 2.1.1 Fixed in 2.1.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-44042 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 8f728cecac20 Credits Mika Required privilege Administrator...

Stirling-PDF 跨站脚本漏洞

Stirling-PDF is a powerful, locally hosted, web-based PDF manipulation tool using Docker, open-sourced by Stirling Tools. A cross-site scripting vulnerability exists in Stirling-PDF version 0.28.3 and earlier, which stems from unknown code in the Markdown-to-PDF component and results in a...

@baseline-ui/app (0.22.1), @baseline-ui/core (0.22.1) +109 more potentially affected by CVE-2024-47061 via @udecode/plate-core (>=22.0.0, <=36.3.9)

@udecode/plate-core NPM version =22.0.0, =3.11.0, =0.1.0, =5.1.1, =0.0.1, =0.0.1, =0.0.2, =12.0.0-beta.405, =0.34.0, =0.9.7, =0.0.23, =0.2.8, =0.3.45 and more Source cves: CVE-2024-47061 Source advisory: OSV:GHSA-73RG-F94J-XVHX...

WordPress WP Custom Fields Search Plugin <= 1.2.35 is vulnerable to Cross Site Scripting (XSS)

Software WP Custom Fields Search Type Plugin Vulnerable versions = 1.2.35 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8364 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 701b94a643a3 Credits Krzysztof Zając...

@directus/api (>=20.0.0-rc.0, <=22.1.1) potentially affected by CVE-2024-46990 via directus (>=11.0.0, <=11.0.2)

directus NPM version =11.0.0, =20.0.0-rc.0, =22.1.1 Source cves: CVE-2024-46990 Source advisory: OSV:GHSA-68G8-C275-XF2M...

CVE-2024-31168

Out-of-bounds Read vulnerability in Open Networking Foundation ONF libfluid libfluidmsg module. This vulnerability is associated with program routine fluidmsg::EchoCommon::unpack. This issue affects libfluid: 0.1.0...

UBUNTU-CVE-2024-8946

A vulnerability was found in MicroPython 1.23.0. It has been classified as critical. Affected is the function mpvfsumount of the file extmod/vfs.c of the component VFS Unmount Handler. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit...

WordPress Blogvi Theme <= 1.0.5 is vulnerable to Cross Site Scripting (XSS)

Software Blogvi Type Theme Vulnerable versions = 1.0.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35715 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 148848988fb4 Credits stealthcopter Required privilege Contributor...

WordPress WPCargo Track & Trace Plugin <= 7.0.6 is vulnerable to SQL Injection

Software WPCargo Track & Trace Type Plugin Vulnerable versions = 7.0.6 Fixed in N/A OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-44004 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 8e07b930efd1 Credits LVT-tholv2k Required privilege...

WordPress plugin Fluida 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...

WordPress WP Test Email Plugin <= 1.1.7 is vulnerable to Cross Site Scripting (XSS)

Software WP Test Email Type Plugin Vulnerable versions = 1.1.7 Fixed in 1.1.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8664 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ea820c9f43d1 Credits vgo0 Required...

WordPress WP Editor Plugin <= 1.2.9 is vulnerable to PHP Object Injection

Software WP Editor Type Plugin Vulnerable versions = 1.2.9 Fixed in 1.2.9.1 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2022-2446 Patch priority Low CVSS severity Low 7.2 Developer Claim ownership PSID 2c7bc2d905b6 Credits Rasoul Jahanshahi Required privilege...

WordPress Simply Schedule Appointments Plugin < 1.6.7.43 is vulnerable to Remote Code Execution (RCE)

Software Simply Schedule Appointments Type Plugin Vulnerable versions 1.6.7.43 Fixed in 1.6.7.43 OWASP Top 10 A1: Injection Classification Remote Code Execution RCE CVE CVE-2024-7129 Patch priority Low CVSS severity Low 9.1 Developer Claim ownership PSID 85c7bead9303 Credits Jeewan Kumar Bhatta...

WordPress Carousel Slider Plugin < 2.2.14 is vulnerable to Cross Site Scripting (XSS)

Software Carousel Slider Type Plugin Vulnerable versions 2.2.14 Fixed in 2.2.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6850 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 7f793427535a Credits Krugov Artyom Required...

WordPress WP Simple Booking Calendar Plugin <= 2.0.10 is vulnerable to Cross Site Scripting (XSS)

Software WP Simple Booking Calendar Type Plugin Vulnerable versions = 2.0.10 Fixed in 2.0.11 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8663 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 00e7be38a235 Credits vgo0...

WordPress MStore API Plugin <= 4.15.3 is vulnerable to Arbitrary File Upload

Software MStore API Type Plugin Vulnerable versions = 4.15.3 Fixed in 4.15.4 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-8242 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 5f5d39cca07a Credits stealthcopter Required privilege...

WordPress Delicate Theme <= 3.5.5 is vulnerable to Cross Site Scripting (XSS)

Software Delicate Type Theme Vulnerable versions = 3.5.5 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5867 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 177cd373a3c2 Credits Francesco Carlucci Required...