WordPress Kata Plus plugin <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by Francesco Carlucci in WordPress Plugin Kata Plus versions = 1.4.7...

PT-2024-16218 · WordPress · Move Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Move Addons for Elementor plugin for WordPress versions up to, and including, 1.3.5 Description: The issue allows authenticated attackers with Contributor-level access and above to extract sensitive private, pending, and draft template data v...

PT-2024-19180 · Zte · Zte Zxr10 Zsr V2

Name of the Vulnerable Software and Affected Versions: ZTE ZXR10 ZSR V2 intelligent multi service router affected versions not specified Description: The issue is a privilege escalation vulnerability that allows an authenticated attacker to obtain sensitive information about the device...

Prison Management System 1.0 Authenticated RCE via Unrestricted File Upload

This module exploits an unrestricted file upload vulnerability in Prison Management System 1.0. An authenticated user can upload a PHP file with arbitrary content by abusing the avatar upload functionality in the add-admin.php endpoint. The application fails to properly validate the uploaded file...

CVE-2022-30359

OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserList. Authentication is required. The information disclosed is associated with the all registered users, including user ID, status, email address, roles, user type, license type,...

CVE-2024-10148 Awesome buttons <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via btn2 Shortcode

The Awesome buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's btn2 shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker...

PT-2024-39436 · WordPress · Woocommerce Ups Shipping – Live Rates/Access Points

Name of the Vulnerable Software and Affected Versions: WooCommerce UPS Shipping – Live Rates and Access Points plugin for WordPress versions up to, and including, 2.3.11 Description: The issue allows authenticated attackers with Subscriber-level access and above to delete the plugin's API key due...

PT-2024-11557 · Ovaledge · Ovaledge

Name of the Vulnerable Software and Affected Versions: OvalEdge versions 5.2.8.0 and earlier Description: The issue is a Sensitive Data Exposure vulnerability that can be exploited via a GET request to "/user/getUserList". Authentication is required to exploit this issue. The disclosed informatio...

MangoOS 安全漏洞

MangoOS is an open source JavaScript object-oriented programming library from Automattic. A security vulnerability exists in MangoOS versions prior to 5.2.0, which stems from authenticated Remote Code Execution RCE via the Active Process Command feature...

PT-2024-16202 · WordPress · League Of Legends Shortcodes

Name of the Vulnerable Software and Affected Versions: League of Legends Shortcodes plugin for WordPress versions up to, and including, 1.0.1 Description: The issue is related to Stored Cross-Site Scripting via shortcodes due to insufficient input sanitization and output escaping on user-supplied...

WordPress Shoutcast Icecast HTML5 Radio Player plugin <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Krzysztof Zając in WordPress Plugin Shoutcast Icecast HTML5 Radio Player versions = 2.1.6...

WordPress League of Legends Shortcodes plugin <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by István Márton in WordPress Plugin League of Legends Shortcodes versions = 1.0.1...

WordPress Bamazoo – Button Generator plugin <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Francesco Carlucci in WordPress Plugin Bamazoo Button Generator versions = 1.0...

WordPress Contact Form 7 - Repeatable Fields plugin <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via field_group Shortcode vulnerability

WordPress Contact Form 7 - Repeatable Fields plugin = 2.0.1 - Authenticated Contributor+ Stored Cross-Site Scripting via fieldgroup Shortcode vulnerability discovered by Peter Thaleikis in WordPress Plugin Contact Form 7 - Repeatable Fields versions = 2.0.1...

WordPress WP Recipe Maker plugin <= 9.6.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'tooltip' vulnerability

Authenticated Contributor+ DOM-Based Stored Cross-Site Scripting via 'tooltip' vulnerability discovered by Webbernaut in WordPress Plugin WP Recipe Maker versions = 9.6.1...

PT-2024-15998 · Elementor · Elementor Header & Footer Builder

Name of the Vulnerable Software and Affected Versions: Elementor Header & Footer Builder plugin for WordPress versions up to, and including, 1.6.43 Description: The issue allows authenticated attackers with Contributor-level access and above to view the contents of Draft, Private, and...

PT-2024-33482 · Zimaos · Zimaos

Name of the Vulnerable Software and Affected Versions: ZimaOS versions 1.2.4 and earlier Description: The issue allows authenticated users to perform a directory traversal attack via the API endpoint http:///v2 1/file, enabling access to sensitive system directories such as /etc. This could expos...

PT-2024-39165 · WordPress · The Hurrytimer

Name of the Vulnerable Software and Affected Versions: The HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce plugin versions up to, and including, 2.10.0 Description: The issue allows authenticated attackers with contributor-level access and above to publish arbitra...

WordPress Elementor Header & Footer Builder plugin <= 1.6.43 - Authenticated (Contributor+) Information Disclosure vulnerability

Authenticated Contributor+ Information Disclosure vulnerability discovered by Francesco Carlucci in WordPress Plugin Ultimate Addons for Elementor - Lite versions = 1.6.43...

CVE-2024-20424

A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center FMC Software, formerly Firepower Management Center Software, could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system as root. This vulnerability ...