PT-2024-27160 · Totolink · Totolink Cp300+

Name of the Vulnerable Software and Affected Versions: TOTOLINK CP300 version 2.0.4-B20201102 Description: A hardcoded password vulnerability was discovered in /etc/shadow.sample, allowing attackers to log in as root. This issue enables unauthorized access to the system. Recommendations: For...

WordPress Popup Builder Plugin <= 4.2.7 is vulnerable to Cross Site Scripting (XSS)

Software Popup Builder Type Plugin Vulnerable versions = 4.2.7 Fixed in 4.3.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2506 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 5081e1f78a97 Credits Tim Coen Required privileg...

WordPress Responsive Owl Carousel for Elementor Plugin <= 1.2.0 is vulnerable to Local File Inclusion

Software Responsive Owl Carousel for Elementor Type Plugin Vulnerable versions = 1.2.0 Fixed in 1.2.1 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-5345 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 48748da13e8e Credits stealthcopter Require...

WordPress Random Banner Plugin <= 4.2.9 is vulnerable to Cross Site Scripting (XSS)

Software Random Banner Type Plugin Vulnerable versions = 4.2.9 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35645 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 790148240990 Credits Rayhan Ramdhany Hanaputra Required privile...

Progress Flowmon 12.3.5 Local sudo Privilege Escalation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Progress Flowmon Local sudo privilege escalation', 'Description' = %q This module abuses a feature of the sudo command on Progress Flowmon. Certa...

WordPress WP Back Button Plugin <= 1.1.3 is vulnerable to Cross Site Scripting (XSS)

Software WP Back Button Type Plugin Vulnerable versions = 1.1.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35643 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 90452d019b78 Credits alfido osdie Patchstack Alliance Required...

WordPress Global Notification Bar Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)

Software Global Notification Bar Type Plugin Vulnerable versions = 1.0.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35647 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 2334f56ac49f Credits Rayhan Ramdhany Hanaputra Requir...

WordPress StopBadBots Plugin <= 10.23 is vulnerable to Broken Access Control

Software StopBadBots Type Plugin Vulnerable versions = 10.23 Fixed in 10.24 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-4355 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID c1d3c12009e3 Credits Krzysztof Zając Required privilege...

WordPress Ninja Tables Plugin <= 5.0.9 is vulnerable to Server Side Request Forgery (SSRF)

Software Ninja Tables Type Plugin Vulnerable versions = 5.0.9 Fixed in 5.0.10 OWASP Top 10 A10: Server-Side Request Forgery SSRF Classification Server Side Request Forgery SSRF CVE CVE-2024-35635 Patch priority Low CVSS severity Low 4.4 Developer Claim ownership PSID 2b5ac1cd1dee Credits Yuchen J...

WordPress PowerPack Addons for Elementor Plugin <= 2.7.19 is vulnerable to Cross Site Scripting (XSS)

Software PowerPack Addons for Elementor Type Plugin Vulnerable versions = 2.7.19 Fixed in 2.7.20 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5327 Patch priority Low CVSS severity Low 6.5 Developer IdeaBox Creations PSID 87f6e9a2860a Credits wesle...

WordPress Yumpu ePaper publishing Plugin <= 2.0.24 is vulnerable to Broken Access Control

Software Yumpu ePaper publishing Type Plugin Vulnerable versions = 2.0.24 Fixed in 3.0.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-3277 Patch priority Low CVSS severity Low 5 Developer Claim ownership PSID 08c9f70d34e3 Credits Lucio Sá Required...

WordPress The Plus Addons for Elementor Pro Plugin <= 5.5.4 is vulnerable to Cross Site Scripting (XSS)

Software The Plus Addons for Elementor Pro Type Plugin Vulnerable versions = 5.5.4 Fixed in 5.5.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5341 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 75a1fec5bca1 Credits wesley...

WordPress Testimonial Carousel For Elementor Plugin <= 10.2.2 is vulnerable to Cross Site Scripting (XSS)

Software Testimonial Carousel For Elementor Type Plugin Vulnerable versions = 10.2.2 Fixed in 10.2.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2253 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 411cbe7852c2 Credits...

WordPress Fetch JFT Plugin <= 1.8.3 is vulnerable to Cross Site Scripting (XSS)

Software Fetch JFT Type Plugin Vulnerable versions = 1.8.3 Fixed in 1.8.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4419 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 70f08e1c695e Credits Benedictus Jovan aillesiM...

WordPress Swiss Toolkit For WP Plugin <= 1.0.7 is vulnerable to Broken Authentication

Software Swiss Toolkit For WP Type Plugin Vulnerable versions = 1.0.7 Fixed in 1.0.8 OWASP Top 10 A2: Broken Authentication Classification Broken Authentication CVE CVE-2024-5204 Patch priority Medium CVSS severity Medium 8.8 Developer Claim ownership PSID 07e08699642a Credits István Márton...

WordPress Login with phone number Plugin <= 1.7.26 is vulnerable to Privilege Escalation

Software Login with phone number Type Plugin Vulnerable versions = 1.7.26 Fixed in 1.7.27 OWASP Top 10 A1: Broken Access Control Classification Privilege Escalation CVE CVE-2024-5150 Patch priority High CVSS severity High 9.8 Developer Hamid Alinia PSID a2294e0242d6 Credits István Márton Required...

Exploit for OS Command Injection in Dolibarr Dolibarr_Erp\/Crm

CVE-2023-30253 Exploit Dolibarr vuln...

WordPress Integration for Contact Form 7 and Constant Contact Plugin <= 1.1.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software Integration for Contact Form 7 and Constant Contact Type Plugin Vulnerable versions = 1.1.5 Fixed in 1.1.6 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-35632 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID...

WordPress Ditty Plugin < 3.1.36 is vulnerable to Cross Site Scripting (XSS)

Software Ditty Type Plugin Vulnerable versions 3.1.36 Fixed in 3.1.36 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3939 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID c2dbb8b75b36 Credits Krugov Aryom Required privilege...

WordPress Primary Addon for Elementor Plugin <= 1.5.5 is vulnerable to Cross Site Scripting (XSS)

Software Primary Addon for Elementor Type Plugin Vulnerable versions = 1.5.5 Fixed in 1.5.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5229 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e45d83fa375c Credits stealthcopte...