11445 matches found
CVE-2025-4800 MasterStudy LMS Pro <= 4.7.0 - Authenticated (Subscriber+) Arbitrary File Upload
The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to a missing file type validation in the stmlmsaddassignmentattachment function in all versions up to, and including, 4.7.0. This makes it possible for authenticated attackers, with Subscriber-level access an...
CVE-2025-4800
CVE-2025-4800 — MasterStudy LMS Pro (WordPress) Vulnerability: Arbitrary file upload due to missing file-type validation in stm_lms_add_assignment_attachment. Affected: MasterStudy LMS Pro plugin for WordPress versions up to and including 4.7.0. Impact: Authenticated attackers with Subscriber-lev...
CVE-2025-4682
CVE-2025-4682 covers the WordPress plugin Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates (vulnerability in the Slider and Post Carousel widgets). The root cause is insufficient input sanitization and output escaping, enabling stored XSS via HTML attributes. Affected: all v...
CVE-2025-4683
CVE-2025-4683 affects the WordPress plugin “MStore API – Create Native Android & iOS Apps On The Cloud” up to and including version 4.17.5. The root cause is a missing capability check in the create_blog function, enabling authenticated attackers with Subscriber-level access and above to create n...
CVE-2025-4783
CVE-2025-4783 concerns the WordPress plugin Exclusive Addons for Elementor. It describes a Stored Cross-Site Scripting vulnerability in the Countdown Timer Widget present in all versions up to 2.7.9.1, caused by insufficient input sanitization and output escaping. The issue allows authenticated a...
CVE-2025-40667
Missing authorization vulnerability in TCMAN's GIM v11. This allows an authenticated attacker to access any functionality of the application even when they are not available through the user interface. To exploit the vulnerability the attacker must modify the HTTP code of the response from ‘302...
Exploit for Execution with Unnecessary Privileges in Wftpserver Wing_Ftp_Server
Wing FTP Server 7.4.4 - Remote Code Execution Authenticated...
CVE-2024-29233
Improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability in Emap.Delete webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to read database containing non-sensitive information and conduct...
CVE-2024-1452
The GenerateBlocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.2 via Query Loop. This makes it possible for authenticated attackers, with contributor access and above, to see contents of posts and pages in draft or private status ...
CVE-2024-1506
The Prime Slider – Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'titletags' attribute of the Fiestar widget in all versions up to, and including, 3.13.1 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2024-12850
The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.32 via the databasebackupajaxdownload function. This makes it possible for authenticated attackers, with administrator-level access...
CVE-2024-3714
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'giveform' shortcode when used with a legacy form in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping on use...
CVE-2024-5215
The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
CVE-2024-29953
A vulnerability in the web interface in Brocade Fabric OS before v9.2.1, v9.2.0b, and v9.1.1d prints encoded session passwords on session storage for Virtual Fabric platforms. This could allow an authenticated user to view other users' session encoded passwords...
CVE-2024-3985
The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Call to Action widget in all versions up to, and including, 2.6.9.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...
CVE-2024-5330
The Breakdance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the breakdancecssfilepathscache parameter in all versions up to, and including, 1.7.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2024-33253
Cross-site scripting XSS vulnerability in GUnet OpenEclass E-learning Platform version 3.15 and before allows a authenticated privileged attacker to execute arbitrary code via the title and description fields of the badge template editing function...
CVE-2024-5331
The Breakdance plugin for WordPress is vulnerable to unauthorized access of data in all versions up to, and including, 1.7.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to export form submissions...
CVE-2024-56333
Onyxia is a web app that aims at being the glue between multiple open source backend technologies to provide a state of art working environment for data scientists. This critical vulnerability allows authenticated users to remotely execute code within the Onyxia-API, leading to potential...