CVE-2024-6849

The CVE-2024-6849 entry concerns the WordPress plugin Preloader Plus – WordPress Loading Screen Plugin, affected in all versions up to and including 2.2.1. The vulnerability is a Stored Cross-Site Scripting (XSS) flaw caused by insufficient input sanitization and output escaping during SVG file u...

CVE-2024-6849 Preloader Plus – WordPress Loading Screen Plugin <= 2.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The Preloader Plus – WordPress Loading Screen Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2024-8538 Big File Uploads <= 2.1.2 - Authenticated (Author+) Full Path Disclosure

The Big File Uploads – Increase Maximum File Upload Size plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.1.2. This is due the plugin not sanitizing a file path in an error message. This makes it possible for authenticated attackers, with...

Apache Airflow 安全漏洞

Apache Airflow is an open source platform for creating, managing and monitoring workflows from the Apache USA Foundation. The platform is characterized by scalability and dynamic monitoring. A security vulnerability exists in Apache Airflow versions prior to 2.10.1 that stems from the ability of ...

PT-2024-39079 · WordPress · The Big File Uploads – Increase Maximum File Upload Size

Name of the Vulnerable Software and Affected Versions: The Big File Uploads – Increase Maximum File Upload Size plugin for WordPress versions up to, and including, 2.1.2 Description: The plugin is vulnerable to Full Path Disclosure due to not sanitizing a file path in an error message. This allow...

Wordpress Arbitrary File Deletion

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Wordpress Arbitrary File Deletion', 'Description' = %q An arbitrary file deletion vulnerability in the WordPress core allows any user with...

CVE-2024-8046

CVE-2024-8046 affects the WordPress plugin Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid . The vulnerability is a Stored Cross-Site Scripting (XSS) via SVG file uploads in all versions up to 1.4.1, caused by insufficient input sanitization and output escaping. It can be exploite...

CVE-2024-6804

The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

CVE-2024-6804

The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

CVE-2024-7304

The CVE-2024-7304 entry concerns the Ninja Tables – Easiest Data Table Builder WordPress plugin. A Stored Cross-Site Scripting (XSS) vulnerability exists via SVG file uploads in all versions up to and including 5.0.12, caused by insufficient input sanitization and output escaping. Exploitation re...

CVE-2024-7304 Ninja Tables – Easiest Data Table Builder <= 5.0.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The Ninja Tables – Easiest Data Table Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 5.0.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-7304 Ninja Tables – Easiest Data Table Builder <= 5.0.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The Ninja Tables – Easiest Data Table Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 5.0.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-6804

CVE-2024-6804 affects the Jeg Elementor Kit plugin for WordPress (≤ 2.6.7). It is a Stored Cross-Site Scripting (XSS) flaw via SVG file uploads caused by insufficient input sanitization and output escaping. Exploitation requires attacker with Author-level access or higher; they can inject arbitra...

CVE-2024-6804 Jeg Elementor Kit <= 2.6.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File

The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

WordPress Ninja Tables Plugin <= 5.0.12 is vulnerable to Cross Site Scripting (XSS)

Software Ninja Tables Type Plugin Vulnerable versions = 5.0.12 Fixed in 5.0.13 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-7304 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID a12833da3c4c Credits wesley wcraft Required...

Exploit for Path Traversal in Apache Http_Server

Apache-HTTP-Server-2.4.50-RCE This tool is designed to test A...

Helpdeskz 2.0.2 Cross Site Scripting

Exploit Title: Stored XSS Vulnerability via File Name Google Dork: N/A Date: 08 Aug 2024 Exploit Author: Md. Sadikul Islam Vendor Homepage: https://www.helpdeskz.com/ Software Link: https://github.com/helpdesk-z/helpdeskz-dev/archive/2.0.2.zip Version: v2.0.2 Tested on: Kali Linux / Firefox...

CVE-2024-7656 Image Hotspot by DevVN <= 1.2.5 - Authenticated (Author+) PHP Object Injection

The Image Hotspot by DevVN plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.5 via deserialization of untrusted input in the 'devvnihotspotshortcodefunc' function. This makes it possible for authenticated attackers, with Author-level access and...

PT-2024-38484 · Devvn · The Image Hotspot

Name of the Vulnerable Software and Affected Versions: The Image Hotspot by DevVN plugin for WordPress versions 1.2.5 and earlier Description: The issue concerns PHP Object Injection via deserialization of untrusted input in the devvn ihotspot shortcode func function. This allows authenticated...

CVE-2024-6870

The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file uploads in all versions up to, and including, 2.4.7 due to insufficient input sanitization and output escaping affecting the rluploadimage AJAX endpoint. This makes it possible for...