CVE-2024-42625

FrogCMS v0.9.5 is affected by a Cross-Site Request Forgery (CSRF) vulnerability exploitable via the /admin/?/layout/add endpoint. The issue is documented under CVE-2024-42625 with a CVSSv3.1 base score of 8.8 ( HIGH ) per NVD. The Red Hat and PTSecurity entries corroborate the vulnerability at th...

CVE-2024-22121

A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application...

WordPress My Sticky Bar plugin < 2.7.2 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin My Sticky Bar versions 2.7.2...

WordPress WP QuickLaTeX plugin < 3.8.8 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin WP QuickLaTeX versions 3.8.8...

CVE-2024-6271

The Community Events WordPress plugin before 1.5 does not have CSRF check in place when deleting events, which could allow attackers to make a logged in admin delete arbitrary events via a CSRF attack...

WordPress Bug Library plugin < 2.1.2 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin Bug Library versions 2.1.2...

WordPress if-so plugin < 1.8.0.4 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin If-So Dynamic Content Personalization versions 1.8.0.4...

WordPress Secure Copy Content Protection plugin < 4.0.9 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Aryom in WordPress Plugin Secure Copy Content Protection and Content Locking versions 4.0.9...

CVE-2024-39158

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/userSysdeal.php?mudi=infoSet...

WordPress Video Widget plugin <= 1.2.3 - Admin+ Stored XSS via Widget vulnerability

Admin+ Stored XSS via Widget vulnerability discovered by Bob Matyas in WordPress Plugin Video Widget versions = 1.2.3...

WordPress CSSable Countdown plugin <= 1.5 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin CSSable Countdown versions = 1.5...

WordPress Search & Replace plugin < 3.2.2 - Admin+ SQL injection vulnerability

Admin+ SQL injection vulnerability discovered by Krugov Artyom in WordPress Plugin Search & Replace versions 3.2.2...

WordPress Sassy social share plugin < 3.3.63 - Admin+ Stored Cross-Site scripting vulnerability

Admin+ Stored Cross-Site scripting vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Sassy Social Share versions 3.3.63...

WordPress ArForms Premium plugin < 6.6 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin ARForms versions 6.6...

WordPress Google CSE plugin <= 1.0.7 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin Google CSE versions = 1.0.7...

CVE-2024-36549

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via /admin/vpsCompanydeal.php?mudi=rev&nohrefStr=close...

WordPress KKProgressbar2 Free plugin <= 1.1.4.2 - Admin+ SQL Injection vulnerability

Admin+ SQL Injection vulnerability discovered by Bob Matyas in WordPress Plugin KKProgressbar2 Free versions = 1.1.4.2...

WordPress Flattr plugin <= 1.2.2 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin Flattr versions = 1.2.2...

WordPress Sailthru Triggermail plugin <= 1.1 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin Sailthru Triggermail versions = 1.1...

WordPress WP Backpack plugin <= 2.1 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin WP Backpack versions = 2.1...