PT-2024-38983 · WordPress · Cost Calculator Builder

Name of the Vulnerable Software and Affected Versions: Cost Calculator Builder WordPress plugin versions prior to 3.2.29 Description: The issue is related to a SQL injection vulnerability. It occurs because the plugin does not properly sanitise and escape a parameter before using it in a SQL...

PT-2024-38864 · WordPress · Wp Multitasking

Name of the Vulnerable Software and Affected Versions: WP MultiTasking – WP Utilities plugin for WordPress versions up to, and including, 0.1.17 Description: The issue is related to Stored Cross-Site Scripting via the wpmt menu name parameter due to insufficient input sanitization and output...

WordPress Prisna GWT - Google Website Translator plugin <= 1.4.11 - Authenticated (Admin+) PHP Object Injection vulnerability

WordPress Prisna GWT - Google Website Translator plugin = 1.4.11 - Authenticated Admin+ PHP Object Injection vulnerability discovered by Lesor101 in WordPress Plugin Prisna GWT – Google Website Translator versions = 1.4.11...

CVE-2024-8514

The Prisna GWT – Google Website Translator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.11 via deserialization of untrusted input from the 'prisnaimport' parameter. This makes it possible for authenticated attackers, with Administrator-level...

CVE-2024-8350

The Uncanny Groups for LearnDash plugin for WordPress is vulnerable to user group add due to a missing capability check on the /wp-json/ulgmmanagement/v1/adduser/ REST API endpoint in all versions up to, and including, 6.1.0.1. This makes it possible for authenticated attackers, with group...

CVE-2024-8350

The Uncanny Groups for LearnDash plugin for WordPress is vulnerable to user group add due to a missing capability check on the /wp-json/ulgmmanagement/v1/adduser/ REST API endpoint in all versions up to, and including, 6.1.0.1. This makes it possible for authenticated attackers, with group...

CVE-2024-8350 Uncanny Groups for LearnDash <= 6.1.0.1 - Missing Authorization to Authenticated (Group Leader+) User Group Add

The Uncanny Groups for LearnDash plugin for WordPress is vulnerable to user group add due to a missing capability check on the /wp-json/ulgmmanagement/v1/adduser/ REST API endpoint in all versions up to, and including, 6.1.0.1. This makes it possible for authenticated attackers, with group...

CVE-2024-8350 Uncanny Groups for LearnDash <= 6.1.0.1 - Missing Authorization to Authenticated (Group Leader+) User Group Add

The Uncanny Groups for LearnDash plugin for WordPress is vulnerable to user group add due to a missing capability check on the /wp-json/ulgmmanagement/v1/adduser/ REST API endpoint in all versions up to, and including, 6.1.0.1. This makes it possible for authenticated attackers, with group...

CVE-2024-8350

The CVE entries CVE-2024-8350 and CVE-2024-8349 relate to the Uncanny Groups for LearnDash plugin for WordPress. All versions up to 6.1.0.1 are affected by a missing capability check on the /wp-json/ulgm_management/v1/add_user/ REST API endpoint, allowing authenticated attackers with group leader...

PT-2024-38964 · WordPress · Uncanny Groups For Learndash

Name of the Vulnerable Software and Affected Versions: The Uncanny Groups for LearnDash plugin for WordPress versions up to, and including, 6.1.0.1 Description: The issue arises from the plugin's failure to properly restrict what users a group leader can edit. This allows authenticated attackers...

PT-2024-38314 · WordPress · Wordpress Simple Html Sitemap

Name of the Vulnerable Software and Affected Versions: WordPress Simple HTML Sitemap plugin versions up to 3.1 Description: The issue allows authenticated attackers with Administrator-level access and above to append additional SQL queries into existing queries, potentially extracting sensitive...

PT-2024-40048 · Unknown · Camaleon Cms

Name of the Vulnerable Software and Affected Versions: Camaleon CMS affected versions not specified Description: The issue concerns a path traversal vulnerability in the MediaController class. An attacker who has taken over an administrator account could delete arbitrary files or folders on the...

PT-2024-10233 · Cellopoint · Cellopoint Secure Email Gateway

Name of the Vulnerable Software and Affected Versions: Cellopoint Secure Email Gateway versions prior to 4.5.0 Description: The issue is related to a Buffer Overflow Vulnerability in the authentication process of the Secure Email Gateway from Cellopoint. Remote unauthenticated attackers can send...

The vulnerability of the OLE DB driver for SQL Server Windows operating systems arises from reading data beyond the buffer in memory, allowing an attacker to exploit their privileges.

The vulnerability of the OLE DB driver for SQL Server on Windows operating systems relates to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to increase their privileges remotely...

CVE-2024-8093

The Posts reminder WordPress plugin through 0.20 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

PT-2024-38800 · WordPress · Posts Reminder Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: The Posts reminder WordPress plugin versions 0.20 and earlier Description: The issue concerns a lack of CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. This could...

CVE-2023-3410

The Bricks theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘customTag' attribute in versions up to, and including, 1.10.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with access to the Bricks Builder...

PT-2024-39284 · Autocms · Autocms

Name of the Vulnerable Software and Affected Versions: AutoCMS version 5.4 Description: A vulnerability was found in AutoCMS, affecting an unknown part of the file /admin/robot.php. The manipulation of the sidebar argument leads to cross-site scripting. It is possible to initiate the attack...

WordPress AI Engine plugin < 2.4.8 - Admin+ SQLi vulnerability

Admin+ SQLi vulnerability discovered by Karolis Narvilas in WordPress Plugin AI Engine versions 2.4.8...

CVE-2024-7863

The CVE-2024-7863 entry concerns the Favicon Generator (CLOSED) WordPress plugin prior to version 2.1. The vulnerability arises from lack of validation for uploaded files and missing CSRF protection, enabling a logged-in admin to upload arbitrary files (potentially PHP) to the server. Public sour...