WordPress Wicked Folders Plugin <= 2.18.16 is vulnerable to Broken Access Control

Software Wicked Folders Type Plugin Vulnerable versions = 2.18.16 Fixed in 2.18.17 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-0712 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID a0b2e732bd9f Credits Marco Wotschka Requir...

WordPress Wicked Folders Plugin <= 2.18.16 is vulnerable to Broken Access Control

Software Wicked Folders Type Plugin Vulnerable versions = 2.18.16 Fixed in 2.18.17 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-0717 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID db3e0ac8c3e4 Credits Marco Wotschka Requir...

WordPress Auto Featured Image (Auto Post Thumbnail) Plugin <= 3.9.15 is vulnerable to Arbitrary File Download

Software Auto Featured Image Auto Post Thumbnail Type Plugin Vulnerable versions = 3.9.15 Fixed in 3.9.16 OWASP Top 10 A1: Injection Classification Arbitrary File Download CVE N/A Patch priority Low CVSS severity Low 6.8 Developer Claim ownership PSID 3292f8368b78 Credits Wordfence Required...

go.uuid has Predictable UUID Identifiers

CVE Description for go.uuid A flaw was found in github.com/satori/go.uuid in versions from commit 0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c to d91630c8510268e75203009fe7daf2b8e1d60c45. Due to insecure randomness in the g.rand.Read function the generated UUIDs are predictable for an attacker. Updat...

WordPress Quick Contact Form Plugin <= 8.0.3.1 is vulnerable to Cross Site Scripting (XSS)

Software Quick Contact Form Type Plugin Vulnerable versions = 8.0.3.1 Fixed in 8.0.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23885 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 1ea94a82999e Credits yuyudhn Required...

WordPress WordPress Comments Import & Export Plugin <= 2.3.1 is vulnerable to CSV Injection

Software WordPress Comments Import & Export Type Plugin Vulnerable versions = 2.3.1 Fixed in 2.3.2 OWASP Top 10 A1: Injection Classification CSV Injection CVE CVE-2022-45370 Patch priority Low CVSS severity Low 6.1 Developer Claim ownership PSID aa57ae50e983 Credits Mika Required privilege...

Apache Tomcat On Ubuntu Log Init Privilege Escalation Exploit

This Metasploit module targets a vulnerability in Tomcat versions 6, 7, and 8 on Debian-based distributions where these older versions provide a vulnerable tomcat init script that allows local attackers who have already gained access to the tomcat account to escalate their privileges from the...

WordPress A2 Optimized WP Plugin <= 3.0.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software A2 Optimized WP Type Plugin Vulnerable versions = 3.0.4 Fixed in 3.0.5 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-23711 Patch priority Low CVSS severity Low 4.3 Developer A2 Hosting PSID f4b673fc9279 Credits Muhammad Daffa Required...

WordPress Chained Quiz Plugin <= 1.3.2.5 is vulnerable to Cross Site Scripting (XSS)

Software Chained Quiz Type Plugin Vulnerable versions = 1.3.2.5 Fixed in 1.3.2.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-25027 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 5cabf5b49c21 Credits yuyudhn Required...

WordPress eCommerce Product Catalog Plugin <= 3.3.4 is vulnerable to Cross Site Scripting (XSS)

Software eCommerce Product Catalog Type Plugin Vulnerable versions = 3.3.4 Fixed in 3.3.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-25049 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 0a25dfcf24b7 Credits Abdi Pranata...

WordPress Podlove Podcast Publisher Plugin <= 3.8.2 is vulnerable to Cross Site Scripting (XSS)

Software Podlove Podcast Publisher Type Plugin Vulnerable versions = 3.8.2 Fixed in 3.8.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-25046 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 491cd1d794bf Credits yuyudhn...

WordPress Similar Posts Plugin <= 3.1.6 is vulnerable to Cross Site Scripting (XSS)

Software Similar Posts Type Plugin Vulnerable versions = 3.1.6 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-41612 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 93ccc5382b3f Credits din Required privilege...

WordPress Opening Hours Plugin <= 2.3.0 is vulnerable to Cross Site Scripting (XSS)

Software Opening Hours Type Plugin Vulnerable versions = 2.3.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID ba2ed69ebc49 Credits Unknown Required privilege Administrat...

WordPress Cost Calculator Plugin <= 1.8 is vulnerable to Cross Site Scripting (XSS)

Software Cost Calculator Type Plugin Vulnerable versions = 1.8 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 9f3fe5b616f3 Credits Marco Wotschka Required privileg...

WordPress WebinarIgnition Plugin <= 2.14.2 is vulnerable to Cross Site Scripting (XSS)

Software WebinarIgnition Type Plugin Vulnerable versions = 2.14.2 Fixed in 2.14.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-25023 Patch priority Low CVSS severity Low 5.9 Developer Tobias PSID 33feb79d5847 Credits yuyudhn Required privilege...

WordPress Formidable Forms Plugin <= 5.5.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software Formidable Forms Type Plugin Vulnerable versions = 5.5.6 Fixed in 5.5.7 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-24419 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID ea449e0665e1 Credits Rafshanzani Suhada...

WordPress 1003 Mortgage Application Plugin <= 1.75 is vulnerable to CSV Injection

Software 1003 Mortgage Application Type Plugin Vulnerable versions = 1.75 Fixed in 1.80 OWASP Top 10 A1: Injection Classification CSV Injection CVE CVE-2022-45357 Patch priority Low CVSS severity Low 6.1 Developer Claim ownership PSID aadde6bd0ebf Credits Rodrigo Escobar ipax Required privilege...

WordPress Album and Image Gallery plus Lightbox Plugin <= 1.6.2 is vulnerable to Broken Access Control

Software Album and Image Gallery plus Lightbox Type Plugin Vulnerable versions = 1.6.2 Fixed in 1.6.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-25060 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID dd001a553b6f Credits Cat...

WordPress Commenter Emails Plugin <= 2.6.1 is vulnerable to CSV Injection

Software Commenter Emails Type Plugin Vulnerable versions = 2.6.1 Fixed in N/A OWASP Top 10 A1: Injection Classification CSV Injection CVE CVE-2022-45360 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID 7afa84e72c95 Credits Mika Required privilege Unauthenticated Published ...

WordPress Multi Rating Plugin <= 5.0.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software Multi Rating Type Plugin Vulnerable versions = 5.0.5 Fixed in 5.0.6 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-47443 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 1dcbbd6b8544 Credits rezaduty Required...