CVE-2026-1307: Exposure of Sensitive Information to an Unauthorized Actor

The Ninja Forms - The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.14.1 via a callback function for the adminenqueuescripts action handler in blocks/bootstrap.php. This makes it possible for...

EUVD-2024-48339

Malicious code in bioql PyPI...

EUVD-2024-48341

Malicious code in bioql PyPI...

CVE-2024-7413

The Obfuscate Email plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.8.1. This is due to the plugin allowing direct access to the bootstrap.php file which has displayerrors on. This makes it possible for unauthenticated attackers to retrieve the...

CVE-2024-7415 Remember Me Controls <= 2.0.1 - Unauthenticated Full Path Disclosure

The Remember Me Controls plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0.1. This is due to the plugin allowing direct access to the bootstrap.php file which has displayerrors on. This makes it possible for unauthenticated attackers to retrieve...

CVE-2024-7415: Exposure of Sensitive Information to an Unauthorized Actor

The Remember Me Controls plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0.1. This is due to the plugin allowing direct access to the bootstrap.php file which has displayerrors on. This makes it possible for unauthenticated attackers to retrieve...

PT-2024-38331

Name of the Vulnerable Software and Affected Versions Remember Me Controls plugin for WordPress versions up to, and including, 2.0.1 Description The issue is related to Full Path Disclosure, which occurs because the plugin allows direct access to the bootstrap.php file with display errors enabled...

CVE-2024-7413

The Obfuscate Email plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.8.1. This is due to the plugin allowing direct access to the bootstrap.php file which has displayerrors on. This makes it possible for unauthenticated attackers to retrieve the...

CVE-2024-7413: Exposure of Sensitive Information to an Unauthorized Actor

The Obfuscate Email plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.8.1. This is due to the plugin allowing direct access to the bootstrap.php file which has displayerrors on. This makes it possible for unauthenticated attackers to retrieve the...

CVE-2024-7416: Exposure of Sensitive Information to an Unauthorized Actor

The Reveal Template plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.7. This is due to the plugin allowing direct access to the bootstrap.php file which has displayerrors on. This makes it possible for unauthenticated attackers to retrieve the ful...

CVE-2024-7412: Exposure of Sensitive Information to an Unauthorized Actor

The No Update Nag plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.4.12. This is due to the plugin allowing direct access to the bootstrap.php file which has displayerrors on. This makes it possible for unauthenticated attackers to retrieve the fu...

CVE-2024-7416

Technical details (affected versions, root cause, exploit information, and patch/FIX specifics) are not provided in the supplied documents. Monitor for updates and official advisories for precise guidance.

CVE-2024-7412 No Update Nag <= 1.4.12 - Unauthenticated Full Path Disclosure

The No Update Nag plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.4.12. This is due to the plugin allowing direct access to the bootstrap.php file which has displayerrors on. This makes it possible for unauthenticated attackers to retrieve the fu...

CVE-2024-7416 Reveal Template <= 3.7 - Unauthenticated Full Path Disclosure

The Reveal Template plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.7. This is due to the plugin allowing direct access to the bootstrap.php file which has displayerrors on. This makes it possible for unauthenticated attackers to retrieve the ful...

CVE-2024-7416 Reveal Template <= 3.7 - Unauthenticated Full Path Disclosure

The Reveal Template plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.7. This is due to the plugin allowing direct access to the bootstrap.php file which has displayerrors on. This makes it possible for unauthenticated attackers to retrieve the ful...

PT-2024-38329

Name of the Vulnerable Software and Affected Versions Obfuscate Email plugin for WordPress versions up to, and including, 3.8.1 Description The issue allows unauthenticated attackers to retrieve the full path of the web application, which can aid other attacks. This is due to the plugin allowing...

PT-2024-38332

Name of the Vulnerable Software and Affected Versions Reveal Template plugin for WordPress versions up to and including 3.7 Description The issue allows unauthenticated attackers to retrieve the full path of the web application, which can aid other attacks. This is due to the plugin allowing dire...

Cross-site Scripting (XSS)

cockpit-hq/cockpit is vulnerable to Cross-site Scripting XSS. The vulnerability exists in upload function at bootstrap.php because due to improper sanitization of inputs which allows an attacker to inject and execute arbitrary javascript...

Cross-site Scripting (XSS)

cockpit-hq/cockpit is vulnerable to Cross-site Scripting XSS. The vulnerability exists due to bootstrap.php accepting html files as an upload, which allows an attacker to inject and execute malicious Javascript into the browser...

Cross-site Scripting (XSS)

shopware/shopware is vulnerable to stored cross-site scripting. The vulnerability exists in the onRouteShutdown function in Bootstrap.php because the input parameters are not properly filtered which allows an attacker to inject and execute arbitrary scripts...