10420 matches found
WordPress Xserver Migrator plugin <= 1.6.2 - CSRF to Arbitrary File Upload vulnerability
CSRF to Arbitrary File Upload vulnerability discovered by Dimas Maulana Patchstack Alliance in WordPress Plugin Xserver Migrator versions = 1.6.2...
RHEL 8 : OpenShift Container Platform 4.10.62 (RHSA-2023:3625)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3625 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or privat...
RHEL 8 : jenkins and jenkins-2-plugins (RHSA-2023:3610)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3610 advisory. Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a software project or jobs run by cro...
CVE-2024-33679
CVE-2024-33679 is described in connected sources as a Cross-Site Request Forgery (CSRF) vulnerability affecting FameThemes FameTheme Demo Importer for WordPress, with affected versions up to 1.1.5. The primary documents specify the CSRF issue and the affected plugin, including CVSS 3.1 base score...
WordPress ENL Newsletter plugin <= 1.0.1 - Campaign Deletion via CSRF vulnerability
Campaign Deletion via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin ENL Newsletter versions = 1.0.1...
WordPress ENL Newsletter plugin <= 1.0.1 - Stored XSS via CSRF vulnerability
Stored XSS via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin ENL Newsletter versions = 1.0.1...
WordPress Salon booking system plugin <= 9.6.5 - Settings Update via CSRF vulnerability
Settings Update via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin Salon booking system versions = 9.6.5...
CVE-2024-3058
The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...
PT-2024-23501 · WordPress · Enl Newsletter
Name of the Vulnerable Software and Affected Versions: ENL Newsletter WordPress plugin versions 1.0.1 and earlier Description: The issue concerns a lack of CSRF check in some areas and missing sanitization as well as escaping. This could allow attackers to make logged-in admins add Stored XSS...
PT-2024-25439 · WordPress · Wp Republic Hide Dashboard Notifications
Name of the Vulnerable Software and Affected Versions: WP Republic Hide Dashboard Notifications versions 1.2.3 and earlier Description: A Cross-Site Request Forgery CSRF issue affects WP Republic Hide Dashboard Notifications. This allows an attacker to perform unintended actions on a user's...
Newsletter Popup <= 1.2 - Subscriber Deletion via CSRF
Description The plugin does not have CSRF check when deleting subscriber, which could allow attackers to make logged in admins perform such action via a CSRF attack Make an admin open a link where is a valid user:...
Newsletter Popup <= 1.2 - Subscriber Deletion via CSRF
Description The plugin does not have CSRF check when deleting subscriber, which could allow attackers to make logged in admins perform such action via a CSRF attack PoC Make an admin open a link where is a valid user: http://example.com/wp-admin/admin.php?page=wpnewslettershowlocalrecord=delete=...
PT-2024-24868 · Unknown · Revmakx Wpcal.Io – Easy Meeting Scheduler
Name of the Vulnerable Software and Affected Versions: Revmakx WPCal.Io – Easy Meeting Scheduler versions 0.9.5.8 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user without their knowledge...
PT-2024-24857 · Elementor · The Pack Elementor Addons
Name of the Vulnerable Software and Affected Versions: The Pack Elementor addons versions 2.0.8.3 and earlier Description: A Cross-Site Request Forgery CSRF issue in The Pack Elementor addons allows for Cross-Site Scripting XSS. This means an attacker could potentially trick a user into performin...
WordPress Plugin Easy CountDowner 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site request forgery vulnerability...
WordPress BMI Adult & Kid Calculator plugin <= 1.2.1 - CSRF to XSS vulnerability
CSRF to XSS vulnerability discovered by Faizal Abroni Patchstack Alliance in WordPress Plugin BMI Adult & Kid Calculator versions = 1.2.1...
WordPress Advance Search plugin <= 1.1.6 - Shortcode Deletion via CSRF vulnerability
Shortcode Deletion via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin Advanced Search versions = 1.1.6...
WordPress NPS computy plugin < 2.7.6 - Results Deletion via CSRF vulnerability
Results Deletion via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin NPS computy versions 2.7.6...
WordPress Smart Forms plugin < 2.6.94 - Edit Entries via CSRF vulnerability
Edit Entries via CSRF vulnerability discovered by Amir Hossein Fallahi in WordPress Plugin Smart Forms versions 2.6.94...
