PT-2025-1392 · Mercedes Benz · Ntg 6

Name of the Vulnerable Software and Affected Versions: Mercedes Benz NTG 6 affected versions not specified Description: An issue exists in the user data import/export function of NTG 6 head units, where a possible integer overflow can occur. To exploit this, an attacker needs local access to the...

PT-2025-1199 · Mercedes Benz · Ntg 6

Name of the Vulnerable Software and Affected Versions: Mercedes Benz NTG New Telematics Generation 6 Description: A possible type confusion exists in the user data import/export function of NTG 6 head units. To perform this attack, local access to the USB interface of the car is needed. With...

PT-2025-1198 · Mercedes Benz · Ntg 6 +1

Name of the Vulnerable Software and Affected Versions: Mercedes Benz NTG New Telematics Generation 6 Description: A possible heap buffer overflow exists in the user data import/export function of NTG 6 head units. To perform this attack, local access to the USB interface of the car is needed. Wit...

CVE-2024-55924 Cross-Site Request Forgery in Scheduler Module in TYPO3

TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery CSRF. Additionally, state-changing actions in downstrea...

TYPO3 安全漏洞

TYPO3 is a free and open source content management system framework CMS/CMF from the Swiss TYPO3 Association. A security vulnerability exists in TYPO3 versions 11.0.0 to 11.5.41, which stems from the vulnerability of the back-end user interface deep-linking functionality to a cross-site request...

CVE-2024-55089

Rhymix 2.1.19 is vulnerable to Server-Side Request Forgery (SSRF) in the background import data function. The issue’s affected component is Rhymix (CMS/framework), with the root cause being insecure handling of server-side requests during the import process. Reported impact includes potential una...

CVE-2021-4448

The Kaswara Modern VC Addons plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.0.1 due to insufficient capability checking on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of unauthorized actions...

PT-2024-11045

Name of the Vulnerable Software and Affected Versions Kaswara Modern VC Addons plugin for WordPress versions up to, and including, 3.0.1 Description The issue is related to insufficient capability checking on various AJAX actions, allowing unauthenticated attackers to perform unauthorized actions...

CVE-2024-1804

The Tutor LMS – Migration Tool plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tutorimportfromxml function in all versions up to, and including, 2.2.0. This makes it possible for authenticated attackers, with subscriber-level access...

CVE-2024-1804 Tutor LMS – Migration Tool <= 2.2.0 - Missing Authorization in tutor_import_from_xml

The Tutor LMS – Migration Tool plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tutorimportfromxml function in all versions up to, and including, 2.2.0. This makes it possible for authenticated attackers, with subscriber-level access...

CVE-2024-6033

The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized data importation due to a missing capability check on the 'importfile' function in all versions up to, and including, 4.0.4. This makes it possible for authenticated attackers,...

WordPress Eventin plugin <= 4.0.4 - Missing Authorization to Authenticated (Contributor+) Event Data Import vulnerability

Missing Authorization to Authenticated Contributor+ Event Data Import vulnerability discovered by Peter Thaleikis in WordPress Plugin Eventin versions = 4.0.4...

PT-2024-37332 · WordPress · Eventin

Name of the Vulnerable Software and Affected Versions: Eventin plugin for WordPress versions up to, and including, 4.0.4 Description: The issue is related to unauthorized data importation due to a missing capability check on the import file function. This allows authenticated attackers with...

CVE-2024-6120

The Sparkle Demo Importer plugin for WordPress is vulnerable to unauthorized database reset and demo data import due to a missing capability check on the multiple functions in all versions up to and including 1.4.7. This makes it possible for authenticated attackers, with Subscriber-level access...

WordPress plugin Sparkle Demo Importer security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability...

CVE-2024-6120 Sparkle Demo Importer <= 1.4.7 - Missing Authorization to Authorized(Subscriber+) Post/Pages/Attachements Deletion and Demo Data Import

The Sparkle Demo Importer plugin for WordPress is vulnerable to unauthorized database reset and demo data import due to a missing capability check on the multiple functions in all versions up to and including 1.4.7. This makes it possible for authenticated attackers, with Subscriber-level access...

CVE-2024-6120

CVE-2024-6120 affects the WordPress plugin Sparkle Demo Importer. Public details in connected docs confirm: all versions up to 1.4.7 are vulnerable due to a missing capability check in multiple functions, enabling authenticated attackers with Subscriber-level access (and above) to perform a destr...

WordPress Sparkle Demo Importer plugin <= 1.4.7 - Authenticated Post/Pages/Attachements Deletion and Demo Data Import vulnerability

Authenticated Post/Pages/Attachements Deletion and Demo Data Import vulnerability discovered by Lucio Sá in WordPress Plugin Sparkle Demo Importer versions = 1.4.7...

The vulnerability of the data import function in the 1C8 CMS system’s Netcat module stems from deficiencies in the authentication process. This allows attackers to bypass the HTTP Basic authentication process and gain unauthorized access to the data import function of 1C.

The vulnerability of the automatic data import function in the 1C8 CMS system’s Netcat component is related to deficiencies in the authentication process. Exploiting this vulnerability allows an attacker to bypass the HTTP Basic authentication process and gain unauthorized access to the data impo...

The vulnerability of the CMS system Netcat, related to the manipulation of inter-site requests, allows a hacker to set arbitrary values for authentication data and execute arbitrary code.

The vulnerability of the CMS system Netcat is related to the manipulation of inter-site requests. Exploiting this vulnerability allows a malicious actor to set arbitrary values for authentication data to access the 1C data import module and execute arbitrary code...