PT-2024-38964 · WordPress · Uncanny Groups For Learndash

Name of the Vulnerable Software and Affected Versions: The Uncanny Groups for LearnDash plugin for WordPress versions up to, and including, 6.1.0.1 Description: The issue arises from the plugin's failure to properly restrict what users a group leader can edit. This allows authenticated attackers...

PT-2024-38314 · WordPress · Wordpress Simple Html Sitemap

Name of the Vulnerable Software and Affected Versions: WordPress Simple HTML Sitemap plugin versions up to 3.1 Description: The issue allows authenticated attackers with Administrator-level access and above to append additional SQL queries into existing queries, potentially extracting sensitive...

PT-2024-40048 · Unknown · Camaleon Cms

Name of the Vulnerable Software and Affected Versions: Camaleon CMS affected versions not specified Description: The issue concerns a path traversal vulnerability in the MediaController class. An attacker who has taken over an administrator account could delete arbitrary files or folders on the...

PT-2024-10233 · Cellopoint · Cellopoint Secure Email Gateway

Name of the Vulnerable Software and Affected Versions: Cellopoint Secure Email Gateway versions prior to 4.5.0 Description: The issue is related to a Buffer Overflow Vulnerability in the authentication process of the Secure Email Gateway from Cellopoint. Remote unauthenticated attackers can send...

The vulnerability of the OLE DB driver for SQL Server Windows operating systems arises from reading data beyond the buffer in memory, allowing an attacker to exploit their privileges.

The vulnerability of the OLE DB driver for SQL Server on Windows operating systems relates to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to increase their privileges remotely...

CVE-2024-8093

The Posts reminder WordPress plugin through 0.20 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

PT-2024-38800 · WordPress · Posts Reminder Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: The Posts reminder WordPress plugin versions 0.20 and earlier Description: The issue concerns a lack of CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. This could...

CVE-2023-3410

The Bricks theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘customTag' attribute in versions up to, and including, 1.10.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with access to the Bricks Builder...

PT-2024-39284 · Autocms · Autocms

Name of the Vulnerable Software and Affected Versions: AutoCMS version 5.4 Description: A vulnerability was found in AutoCMS, affecting an unknown part of the file /admin/robot.php. The manipulation of the sidebar argument leads to cross-site scripting. It is possible to initiate the attack...

WordPress AI Engine plugin < 2.4.8 - Admin+ SQLi vulnerability

Admin+ SQLi vulnerability discovered by Karolis Narvilas in WordPress Plugin AI Engine versions 2.4.8...

CVE-2024-7863

The CVE-2024-7863 entry concerns the Favicon Generator (CLOSED) WordPress plugin prior to version 2.1. The vulnerability arises from lack of validation for uploaded files and missing CSRF protection, enabling a logged-in admin to upload arbitrary files (potentially PHP) to the server. Public sour...

CVE-2024-7861 Misiek Paypal <= 1.1.20090324 - Stored XSS via CSRF

The Misiek Paypal WordPress plugin through 1.1.20090324 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

PT-2024-38641 · WordPress · The Favicon Generator

Name of the Vulnerable Software and Affected Versions: The Favicon Generator CLOSED WordPress plugin versions prior to 2.1 Description: The issue concerns a lack of CSRF and path validation in the output sub admin page 0 function. This allows attackers to make logged-in admins delete arbitrary...

PT-2024-38640 · WordPress · The Favicon Generator

Name of the Vulnerable Software and Affected Versions: The Favicon Generator CLOSED WordPress plugin versions prior to 2.1 Description: The issue concerns a lack of file validation for uploads and missing CSRF checks. This could allow attackers to make logged-in admins upload arbitrary files, suc...

PT-2024-37823 · WordPress · Ai Engine

Name of the Vulnerable Software and Affected Versions: The AI Engine WordPress plugin versions prior to 2.4.8 Description: The issue is related to a SQL injection that occurs due to improper sanitization and escaping of a parameter in a SQL statement. This can be exploited by admin users when...

PT-2024-10743 · WordPress · Video Carousel Slider With Lightbox Plugin

Name of the Vulnerable Software and Affected Versions: video carousel slider with lightbox plugin for WordPress versions 1.0.0 through 1.0.6 Description: The issue is related to SQL Injection via the id parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient...

PT-2024-38531 · WordPress · Logo Slider

Name of the Vulnerable Software and Affected Versions: The Logo Slider WordPress plugin versions prior to 3.6.9 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example i...

PT-2024-38606 · WordPress · Ilc Thickbox

Name of the Vulnerable Software and Affected Versions: ILC Thickbox WordPress plugin version 1.0 Description: The issue is related to the lack of a CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. Recommendations: For ILC...

CVE-2024-7618

The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘content’ parameter in all versions up to, and including, 6.4.5.0 due to insufficient input sanitization and output escaping. This makes it...

PT-2024-38455 · Peepso · The Community By Peepso

Name of the Vulnerable Software and Affected Versions: The Community by PeepSo plugin for WordPress versions up to, and including, 6.4.5.0 Description: The issue is related to Stored Cross-Site Scripting via the content parameter due to insufficient input sanitization and output escaping. This...