CVE-2024-12036

CVE-2024-12036 affects the WordPress CS Framework plugin (CS Framework) with Arbitrary File Read via get_widget_settings_json() in versions up to 6.9 (and tracked in later advisories as <= 7.1). The vulnerability requires at least subscriber-level authentication and allows reading arbitrary se...

CVE-2024-12036 CS Framework <= 7.1 - Authenticated (Subscriber+) Arbitrary File Read

The CS Framework plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 6.9 via the getwidgetsettingsjson function. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the...

CVE-2024-12036 CS Framework <= 7.1 - Authenticated (Subscriber+) Arbitrary File Read

The CS Framework plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 6.9 via the getwidgetsettingsjson function. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the...

CVE-2024-12035 CS Framework <= 7.0 - Authenticated (Subscriber+) Arbitrary File Deletion

The CS Framework plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the cswidgetfiledelete function in all versions up to, and including, 6.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to dele...

CVE-2024-12035 CS Framework <= 7.0 - Authenticated (Subscriber+) Arbitrary File Deletion

The CS Framework plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the cswidgetfiledelete function in all versions up to, and including, 6.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to dele...

CVE-2024-12035: Improper Limitation of a Pathname to a Restricted Directory

The CS Framework plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the cswidgetfiledelete function in all versions up to, and including, 6.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to dele...

WordPress plugin CS Framework 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

CVE-2024-12036: External Control of File Name or Path

The CS Framework plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 6.9 via the getwidgetsettingsjson function. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the...

WordPress plugin CS Framework 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...

WordPress CS Framework plugin <= 7.1 - Authenticated (Subscriber+) Arbitrary File Read vulnerability

Authenticated Subscriber+ Arbitrary File Read vulnerability discovered by Tonn in WordPress Plugin CS Framework versions = 7.1...

WordPress CS Framework plugin <= 7.0 - Authenticated (Subscriber+) Arbitrary File Deletion vulnerability

Authenticated Subscriber+ Arbitrary File Deletion vulnerability discovered by Tonn in WordPress Plugin CS Framework versions = 7.0...

PT-2025-25841

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved, related to the rseq feature. The issue occurs when the rseq cs field is non-zero during registration, which can cause a segfault on...

The vulnerability of the microprogramming software used in programmable logic controllers of the SYSMAC series, CS, CJ, and CP, allows attackers to circumvent existing security restrictions and gain unauthorized access to protected information.

The vulnerability of the microprogramming software used in SYSMAC programmable logic controllers of the CS, CJ, and CP series is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to bypass existing security restrictions and gain unauthorized access t...

CVE-2024-13663: Improper Neutralization of Input During Web Page Generation

The Coaching Staffs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mstw-cs-table' shortcode in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11347: Integer Overflow or Wraparound

Integer Overflow or Wraparound vulnerability in Lexmark International CX, XC, CS, et. Al. Postscript interpreter modules allows Forced Integer Overflow.The vulnerability can be leveraged by an attacker to execute arbitrary code as an unprivileged user...

CVE-2024-11346: Access of Resource Using Incompatible Type

: Access of Resource Using Incompatible Type 'Type Confusion' vulnerability in Lexmark International CX, XC, CS, et. Al. Postscript interpreter modules allows Resource Injection.This issue affects CX, XC, CS, et. Al.: from 001.001:0 through 081.231, from ..P001 through ..P233, from ..P001 through...

CVE-2022-45794

An attacker with network access to the affected PLC CJ-series and CS-series PLCs, all versions may use a network protocol to read and write files on the PLC internal memory and memory card...

CVE-2022-2757

Due to the lack of adequately implemented access-control rules, all versions Kingspan TMS300 CS are vulnerable to an attacker viewing and modifying the application settings without authenticating by accessing a specific uniform resource locator URL on the webserver...

Malicious code in cs-count (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6961148d61a9a3b12afb0f91d6d4647b2c986b36b0521d40567c9c5aa5860ead Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cs-templates (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b2190818daf8cbe7ca369cf5eb1bcb74bdd542a4295ee61af7c6ef4617bf0ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...