3560 matches found
CVE-2024-9405
An incorrect limitation of a path to a restricted directory path traversal has been detected in Pluck CMS, affecting version 4.7.18. An unauthenticated attacker could extract sensitive information from the server via the absolute path of a file located in the same directory or subdirectory as the...
CVE-2024-8965
The Absolute Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Name' field of a custom post criteria in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2024-8965
The Absolute Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Name' field of a custom post criteria in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2024-8965
CVE-2024-8965 details (WordPress Absolute Reviews plugin): All versions up to 1.1.3 are vulnerable to a Stored DOM-based Cross-Site Scripting (XSS) via the Name field of a custom post criterion. Exploitation requires at least Contributor–level authentication and above, enabling injection of scrip...
WordPress Absolute Reviews plugin <= 1.1.3 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Criteria Name vulnerability
Authenticated Contributor+ Stored DOM-Based Cross-Site Scripting via Criteria Name vulnerability discovered by Muhammad Adel ItsFadinG in WordPress Plugin Absolute Reviews versions = 1.1.3...
WordPress Absolute Reviews Plugin <= 1.1.3 is vulnerable to Cross Site Scripting (XSS)
Software Absolute Reviews Type Plugin Vulnerable versions = 1.1.3 Fixed in 1.1.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8965 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID a21e8c7a2d18 Credits Muhammad Adel ItsFadinG...
WordPress plugin Absolute Reviews 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
PT-2024-39342 · WordPress · Absolute Reviews
Name of the Vulnerable Software and Affected Versions: Absolute Reviews plugin for WordPress versions up to, and including, 1.1.3 Description: The issue is related to Stored Cross-Site Scripting via the Name field of a custom post criteria due to insufficient input sanitization and output escapin...
WordPress HT Mega – Absolute Addons For Elementor plugin <= 2.6.5 - Authenticated (Contributor+) Sensitive Information Exposure via template_id vulnerability
Authenticated Contributor+ Sensitive Information Exposure via templateid vulnerability discovered by Ankit Patel in WordPress Plugin HT Mega versions = 2.6.5...
CVE-2024-8910
CVE-2024-8910 concerns HT Mega – Absolute Addons For Elementor for WordPress. The vulnerability affects versions up to and including 2.6.5 and enables Sensitive Information Exposure via the render function in includes/widgets/htmega_accordion.php. Exploitation requires at least Contributor-level ...
CVE-2024-8497 Franklin Fueling Systems TS-550 EVO Absolute Path Traversal
Franklin Fueling Systems TS-550 EVO versions prior to 2.26.4.8967 possess a file that can be read arbitrarily that could allow an attacker obtain administrator credentials...
CVE-2024-8497 Franklin Fueling Systems TS-550 EVO Absolute Path Traversal
Franklin Fueling Systems TS-550 EVO versions prior to 2.26.4.8967 possess a file that can be read arbitrarily that could allow an attacker obtain administrator credentials...
VulnCheck KEV: CVE-2002-1149
The installation procedure for Invision Board suggests that users install the phpinfo.php program under the web root, which leaks sensitive information such as absolute pathnames, OS information, and PHP settings...
Mattermost Desktop App Uncontrolled Search Path Vulnerability
Mattermost Desktop App versions =5.8.0 fail to specify an absolute path when searching the cmd.exe file, which allows a local attacker who is able to put an cmd.exe file in the Downloads folder of a user's machine to cause remote code execution on that machine...
CVE-2024-39613 RCE in desktop app in Windows by local attacker
Mattermost Desktop App versions =5.8.0 fail to specify an absolute path when searching the cmd.exe file, which allows a local attacker who is able to put an cmd.exe file in the Downloads folder of a user's machine to cause remote code execution on that machine...
The vulnerability of the binary archiver cpio lies in the improper limitation of the path name for the limited directory, allowing a hacker to trigger a service failure.
The vulnerability of the binary archiver cpio is related to a regression issue when the --no-absolute-filenames parameter is used. Exploiting this vulnerability can allow an attacker to cause service interruptions remotely...
CVE-2024-42680
An issue in Super easy enterprise management system v.1.0.0 and before allows a local attacker to obtain the server absolute path by entering a single quotation mark...
CVE-2024-42680
An issue in Super easy enterprise management system v.1.0.0 and before allows a local attacker to obtain the server absolute path by entering a single quotation mark...
CVE-2024-42680
CVE-2024-42680 affects Super easy enterprise management system (v.1.0.0 and earlier). The vulnerability allows a local attacker to obtain the server’s absolute path by inputting a single quotation mark, indicating an information disclosure risk rooted in improper input handling. Publicly cited so...