CVE-2024-2165

The SEOPress – On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image alt parameter in all versions up to, and including, 7.5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author access...

CVE-2024-1463

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Course, Lesson, and Quiz title and content in all versions up to, and including, 4.2.6.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2023-6999

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Remote Code Exxecution via shortcode in all versions up to, and including, 3.0.10 with the exception of 2.7.31.2, 2.8.23.2, 2.9.19.2. This makes it possible for authenticated attackers, with contributor level access ...

CVE-2023-49912

A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point EAP225 V3 v5.1.0 Build 20220926. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can make an...

WordPress Core <= 6.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Via Avatar Block vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting Via Avatar Block vulnerability discovered by John Blackbourn in WordPress core versions = 6.5.0...

CVE-2024-25646

Due to improper validation, SAP BusinessObject Business Intelligence Launch Pad allows an authenticated attacker to access operating system information using crafted document. On successful exploitation there could be a considerable impact on confidentiality of the application...

PT-2024-18478 · WordPress · Registrationmagic

Name of the Vulnerable Software and Affected Versions: RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress versions up to, and including, 5.3.1.0 Description: The issue is related to blind SQL Injection via the id parameter of the RM Form...

PT-2024-18410 · WordPress · Masterstudy Lms

Name of the Vulnerable Software and Affected Versions: MasterStudy LMS plugin for WordPress versions up to, and including, 3.2.13 Description: The issue allows unauthorized access to data due to a missing capability check on the search posts function. This makes it possible for authenticated...

PT-2024-17776 · WordPress · Learnpress

Name of the Vulnerable Software and Affected Versions: LearnPress – WordPress LMS Plugin versions up to, and including, 4.2.6.3 Description: The issue allows authenticated attackers to obtain information on orders placed by other users and guests due to missing validation on a user controlled key...

PT-2024-19068 · Wpzoom · Beaver Builder Addons

Name of the Vulnerable Software and Affected Versions: Beaver Builder Addons by WPZOOM plugin for WordPress versions up to, and including, 1.3.4 Description: The issue is related to Stored Cross-Site Scripting via the Button widget due to insufficient input sanitization and output escaping. This...

PT-2024-19867 · WordPress · Avada

Name of the Vulnerable Software and Affected Versions: Avada | Website Builder For WordPress & WooCommerce theme for WordPress versions up to, and including, 7.11.6 Description: The issue allows authenticated attackers with contributor-level access and above to make web requests to arbitrary...

PT-2024-3046

Name of the Vulnerable Software and Affected Versions: SINEC NMS versions prior to V2.0 SP2 Description: A vulnerability has been identified that allows authenticated users to export monitoring data. The corresponding API endpoint is susceptible to path traversal, which could allow an authenticat...

WordPress FooGallery plugin <= 2.4.14 - Authenticated (Author+) Stored Cross-Site Scripting via Image Attachment Fields vulnerability

Authenticated Author+ Stored Cross-Site Scripting via Image Attachment Fields vulnerability discovered by Tim Coen in WordPress Plugin FooGallery versions = 2.4.14...

PT-2024-14007 · Gog · Gog Galaxy

Name of the Vulnerable Software and Affected Versions: GOG Galaxy Beta versions 2.0.67.2 through 2.0.71.2 Description: An issue exists in GalaxyClientService.exe that could allow authenticated users to overwrite and corrupt critical system files via a combination of an NTFS Junction and an RPC...

WordPress WP Directory Kit plugin <= 1.3.0 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Lucio Sá in WordPress Plugin WP Directory Kit versions = 1.3.0...

WordPress Passster plugin <= 4.2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via content_protector Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via contentprotector Shortcode vulnerability discovered by Krzysztof Zając in WordPress Plugin Passster versions = 4.2.6.4...

CVE-2024-25705

There is a cross‑site scripting XSS vulnerability in Esri Portal for ArcGIS Experience Builder versions 11.1 and below on Windows and Linux that allows a remote, authenticated attacker with low‑privileged access to create a crafted link which, when clicked, could potentially execute arbitrary...

CVE-2024-25705

There is a cross‑site scripting XSS vulnerability in Esri Portal for ArcGIS Experience Builder versions 11.1 and below on Windows and Linux that allows a remote, authenticated attacker with low‑privileged access to create a crafted link which, when clicked, could potentially execute arbitrary...

WordPress BookingPress plugin <= 1.0.87 - Authenticated (Admin+) Arbitrary File Upload vulnerability

Authenticated Admin+ Arbitrary File Upload vulnerability discovered by Dian Sun in WordPress Plugin BookingPress versions = 1.0.87...

CVE-2024-2868

CVE-2024-2868 affects the ShopLentor (WooCommerce Builder) WordPress plugin. The vulnerability is stored XSS via the slitems parameter in the WL Special Day Offer Widget, present in all versions up to 2.8.3 due to insufficient input sanitization and output escaping. Exploitation requires authenti...