PT-2024-32431 · F5 · Big-Iq

Name of the Vulnerable Software and Affected Versions: BIG-IQ versions prior to 8.2.0.1 BIG-IQ versions prior to 8.3.0 Description: A stored cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IQ Configuration utility. This issue allows an attacker with the Administrat...

WordPress Appointment Booking Calendar plugin <= 1.6.7.53 - Authenticated (Admin+) Stored Cross-Site Scripting vulnerability

Authenticated Admin+ Stored Cross-Site Scripting vulnerability discovered by Jeewan Kumar Bhatta in WordPress Plugin Simply Schedule Appointments versions = 1.6.7.53...

ViciDial 2.0.5 Cross Site Request Forgery

============================================================================================================================================= | Title : ViciDial Call Center - astguiclient - thirtieth public release 2.0.5 CSRF Add ADmin Vulnerability | | Author : indoushka | | Tested on : windows ...

WordPress Slider by 10Web plugin < 1.2.59 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Slider by 10Web versions 1.2.59...

WordPress WP ULike plugin < 4.7.4 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin WP ULike versions 4.7.4...

Online Flight Booking System 1.0 Cross Site Request Forgery

============================================================================================================================================================================= | Title : Online Flight Booking System 1.0 CSRF Add Admin vulnerability | | Author : indoushka | | Tested on : windows 10...

FrogCms 安全漏洞

FrogCms is an HTTP server by philippe personal developer. A security vulnerability exists in FrogCMS version 0.9.5, which stems from a cross-site request forgery vulnerability in /admin/? A cross-site request forgery vulnerability exists in /user/add...

WordPress NinjaTeam Header Footer Custom Code plugin < 1.2 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Takshal Patel in WordPress Plugin NinjaTeam Header Footer Custom Code versions 1.2...

WordPress GS Logo Slider Lite plugin < 3.6.9 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin GS Logo Slider versions 3.6.9...

WordPress EventON plugin < 2.2.17 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Wesley "dk4trin" Santos in WordPress Plugin EventON versions 2.2.17...

PT-2024-37950 · WordPress · Eventon

Name of the Vulnerable Software and Affected Versions: EventON WordPress plugin versions prior to 2.2.17 Description: The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks by injecting malicious scripts, even when unfiltered html is disallowed. This is due...

PT-2024-37905 · WordPress · Wp Multitasking

Name of the Vulnerable Software and Affected Versions: WP MultiTasking WordPress plugin versions 0.1.12 and earlier Description: The issue is related to the lack of a CSRF check when updating settings in the WP MultiTasking WordPress plugin. This could allow attackers to make a logged-in admin...

WordPress LifterLMS plugin <= 7.7.5 - Authenticated (Admin+) SQL Injection vulnerability

Authenticated Admin+ SQL Injection vulnerability discovered by FKSEC in WordPress Plugin LifterLMS versions = 7.7.5...

WordPress Secure Copy Content Protection and Content Locking plugin < 4.1.7 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by [email protected] in WordPress Plugin Secure Copy Content Protection and Content Locking versions 4.1.7...

WordPress Viral Signup plugin <= 2.1 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin Viral Signup versions = 2.1...

CVE-2024-8071

CVE-2024-8071 affects Mattermost Server versions 9.9.x ≤ 9.9.1, 9.5.x ≤ 9.5.7, 9.10.x ≤ 9.10.0, and 9.8.x ≤ 9.8.2. The issue is a failure to restrict which roles can promote a user to system admin, allowing a System Role with edit access to the permissions section of the system console to update ...

CVE-2024-42617

CVE-2024-42617 affects Pligg CMS v2.0.2 with a Cross-Site Request Forgery (CSRF) vulnerability in the admin API: /admin/admin_config.php?action=save&var_id=32. Multiple sources (including Red Hat and CNVD) corroborate the CSRF issue; an accompanying entry lists a potential PoC/exploitation path. ...

WordPress AI Engine plugin < 2.5.1 - Admin+ RCE vulnerability

Admin+ RCE vulnerability discovered by Karolis Narvilas in WordPress Plugin AI Engine versions 2.5.1...

WordPress Wordpress Simple Share Plugin plugin <= 0.5.3 - Admin+ XSS vulnerability

Admin+ XSS vulnerability discovered by Amandeep Singh Banga in WordPress Plugin Simple Share versions = 0.5.3...

CVE-2024-6158

The Category Posts Widget WordPress plugin before 4.9.17, term-and-category-based-posts-widget WordPress plugin before 4.9.13 does not validate and escape some of its "Category Posts" widget settings before outputting them back in a page/post where the Widget is embed, which could allow high...