WordPress Youzify plugin <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin Youzify versions = 1.3.0...

WordPress WP Builder plugin <= 3.0.7 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Francesco Carlucci in WordPress Plugin WP Builder versions = 3.0.7...

Vulnerabilities fixed in Microsoft SQL Server Power BI Report Server

Microsoft fixed vulnerabilities in SQL Server Power BI Report Server A malicious party could exploit the vulnerabilities to impersonate another user and execute arbitrary code under their context, possibly with administrator privileges. Successful exploitation requires the malicious party to have...

WordPress Auto iFrame plugin <= 1.7 - Authenticated (Author+) Stored Cross-Site Scripting via tag Parameter vulnerability

Authenticated Author+ Stored Cross-Site Scripting via tag Parameter vulnerability discovered by tjoffe in WordPress Plugin Auto iFrame versions = 1.7...

PT-2024-27167 · Unknown +1 · Adguardhome +1

Name of the Vulnerable Software and Affected Versions: Adguard Home versions prior to 0.107.52 Description: An arbitrary file read issue allows authenticated attackers to access arbitrary files as root on the underlying Operating System by placing a crafted file into a readable directory. This...

CVE-2024-47559

Authenticated RCE via Path Traversal...

CVE-2024-47558

Authenticated RCE via Path Traversal...

WordPress Bit File Manager plugin <= 6.5.7 - Authenticated (Subscriber+) Limited JavaScript File Upload vulnerability

Authenticated Subscriber+ Limited JavaScript File Upload vulnerability discovered by TANG Cheuk Hei siunam in WordPress Plugin Bit File Manager versions = 6.5.7...

PT-2024-7172 · Sap · Sap Businessobjects Business Intelligence Platform

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects Business Intelligence Platform affected versions not specified Description: The issue is related to a file download vulnerability in the SAP BusinessObjects Business Intelligence Platform, specifically in the Web...

PT-2024-32657 · Xerox · Freeflow Core

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: An authenticated remote code execution issue occurs through path traversal, allowing for remote code execution. Recommendations: At the moment, there is no information about a newer versio...

Exploit for Code Injection in Getgrav Grav

EN GenGravSSTIExploit is a PoC Python script that exploits...

WordPress Easy Demo Importer plugin <= 1.1.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by Francesco Carlucci in WordPress Plugin Easy Demo Importer versions = 1.1.2...

CVE-2024-9242

The Memberful – Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'memberfulbuysubscriptionlink' and 'memberfulpodcastslink' shortcodes in all versions up to, and including, 1.73.7 due to insufficient input sanitization and output escaping on use...

WordPress WP Blocks Hub plugin <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by Francesco Carlucci in WordPress Plugin WP Blocks Hub versions = 1.0.2...

PT-2024-32714 · Unknown · Shilpi Client Dashboard

Name of the Vulnerable Software and Affected Versions: Shilpi Client Dashboard affected versions not specified Description: The issue exists due to improper validation of files being uploaded other than the specified extension. An authenticated remote attacker could exploit this by uploading a...

CVE-2024-42417

Delta Electronics DIAEnergie is vulnerable to an SQL injection in the script HandlerCFG.ashx. An authenticated attacker may be able to exploit this issue to cause delay in the targeted product...

CVE-2024-41584

DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to reflected XSS by authenticated users, caused by missing validation of the sFormAuthStr parameter...

PT-2024-39070 · WordPress · The Ultimate Member

Name of the Vulnerable Software and Affected Versions: The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress versions up to, and including, 2.8.6 Description: The issue is related to Stored Cross-Site Scripting via...

CVE-2024-8505

The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘buttonlabel’ parameter in all versions up to, and including, 7.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2024-8254

The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.7.34. This is due to the software allowing users to execute an action that do...