WordPress News & Blog Designer Pack – WordPress Blog Plugin Plugin <= 3.4.1 is vulnerable to Remote Code Execution (RCE)

Software News & Blog Designer Pack – WordPress Blog Plugin Type Plugin Vulnerable versions = 3.4.1 Fixed in 3.4.2 OWASP Top 10 A1: Injection Classification Remote Code Execution RCE CVE CVE-2023-5815 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 968958ed229c Credits...

WordPress BSK PDF Manager Plugin <= 3.4.1 is vulnerable to Cross Site Scripting (XSS)

Software BSK PDF Manager Type Plugin Vulnerable versions = 3.4.1 Fixed in 3.4.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5110 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 7c2ee2111335 Credits Lana Codes Required...

WordPress WP EXtra Plugin <= 6.2 is vulnerable to Broken Access Control

Software WP EXtra Type Plugin Vulnerable versions = 6.2 Fixed in 6.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-5314 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 55747fccb396 Credits TP Cyber Security Required privilege...

WordPress Neon text Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)

Software Neon text Type Plugin Vulnerable versions = 1.1 Fixed in 1.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5817 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 3b1607d0a011 Credits Dmitrii Ignatyev Required privileg...

WordPress Form Builder Plugin <= 1.0.72 is vulnerable to Cross Site Scripting (XSS)

Software Form Builder Type Plugin Vulnerable versions = 1.0.72 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5048 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID de60a9a1bf56 Credits Lana Codes Required privileg...

@0xtfm/widget-ibc (>=0.0.8-alpha.0, <=0.0.8-alpha.5), @1kdanny/n8n-nodes-firecrawl (>=1.0.0, <=1.0.2) +1508 more potentially affected by CVE-2023-46233 via crypto-js (>=4.0.0, <=4.1.1)

crypto-js NPM version =4.0.0, =0.0.8-alpha.0, =1.0.0, =3.0.0, =4.22.0, =1.0.0-alpha.0, =1.0.0-alpha.1, =1.1.56, =0.1.1, =0.0.0-dev-20240828032938, =0.0.0-dev-20240828032938, =0.0.0-dev-20240828032938, =0.0.0-dev-20240828032938, =0.0.0-dev-20240828032938, =0.0.0-dev-20240828032938,...

CVE-2022-38484

An arbitrary file upload and directory traversal vulnerability exist in the file upload functionality of the System Setup menu in AgeVolt Portal prior to version 0.1. A remote authenticated attacker could leverage this vulnerability to upload files to any location on the target operating system...

WordPress Parcel Pro Plugin <= 1.6.11 is vulnerable to Open Redirection

Software Parcel Pro Type Plugin Vulnerable versions = 1.6.11 Fixed in 1.6.12 OWASP Top 10 A6: Security Misconfiguration Classification Open Redirection CVE CVE-2023-46624 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID 4e771fcd1ecb Credits Nguyen Xuan Chien Required...

WordPress Ni WooCommerce Sales Report Plugin <= 3.7.3 is vulnerable to Broken Access Control

Software Ni WooCommerce Sales Report Type Plugin Vulnerable versions = 3.7.3 Fixed in 3.7.4 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-32299 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID 1d4eec1ef0ed Credits Jonas Höbenreic...

PT-2023-21083 · Idweb · Idweb

Name of the Vulnerable Software and Affected Versions: IDWeb application versions 3.1.052 and earlier Description: The issue concerns missing authentication in the StudentPopupDetails StudentDetails method, allowing unauthenticated attackers to extract sensitive student data. Recommendations: For...

WordPress Simple User Listing Plugin <= 1.9.2 is vulnerable to Cross Site Scripting (XSS)

Software Simple User Listing Type Plugin Vulnerable versions = 1.9.2 Fixed in 1.9.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-32298 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 4082207ac5d1 Credits Emili Castell...

WordPress Medialist Plugin <= 1.3.9 is vulnerable to Cross Site Scripting (XSS)

Software Medialist Type Plugin Vulnerable versions = 1.3.9 Fixed in 1.4.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-46640 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 22ee4e11fa05 Credits Tien from VNPT-VCI Required privilege...

WordPress WP Word Count Plugin <= 3.2.4 is vulnerable to Broken Access Control

Software WP Word Count Type Plugin Vulnerable versions = 3.2.4 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-46628 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID becf99c528fe Credits Abdi Pranata Required privilege...

WordPress Groundhogg Plugin <= 2.7.11.10 is vulnerable to Cross Site Scripting (XSS)

Software Groundhogg Type Plugin Vulnerable versions = 2.7.11.10 Fixed in 2.7.11.11 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-40681 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID a90eb2557e30 Credits Hamoud Al Helmani Required privileg...

PT-2023-30022 · Totolink · Totolink X6000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X6000R version 9.4.0cu.652 B20230116 Description: A remote command execution issue was discovered, allowing for potential exploitation via the sub 417094 function. This issue affects the specified version of the TOTOLINK X6000R route...

WordPress Generate Dummy Posts Plugin <= 1.0.0 is vulnerable to Broken Access Control

Software Generate Dummy Posts Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-46637 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 8dc28ae9f233 Credits Abdi Pranata Required...

Apple macOS Buffer Error Vulnerability

Apple macOS is a proprietary operating system developed by Apple Inc. for Mac computers. A security vulnerability exists in Apple macOS Sonoma version 14.1, which stems from the handling of files that could lead to unexpected application termination or arbitrary code execution...

WordPress Custom Header Images Plugin <= 1.2.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Custom Header Images Type Plugin Vulnerable versions = 1.2.1 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-46636 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID d852d829fc53 Credits Nguyen Xuan Chie...

WordPress WordPress CTA Plugin <= 1.5.8 is vulnerable to Broken Access Control

Software WordPress CTA Type Plugin Vulnerable versions = 1.5.8 Fixed in 1.5.9 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-46644 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 45791c76e335 Credits Abdi Pranata Required...

WordPress Mediabay Plugin <= 1.6 is vulnerable to Broken Access Control

Software Mediabay Type Plugin Vulnerable versions = 1.6 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-46612 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 01f288807115 Credits emad Required privilege Subscriber...