CVE-2021-4357

The uListing plugin for WordPress is vulnerable to authorization bypass due to missing capability checks, and a missing security nonce, on the UlistingUserRole::saveroleapi function in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to arbitrarily delete...

CVE-2021-4359

The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary Post Deletion in versions up to, and including, 18.2. This is due to lacking authentication protections and lacking a security nonce on the wpfmdeletefile AJAX action. This makes it possible for...

CVE-2020-36700

The Page Builder: KingComposer plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 2.9.3. This is due to a security nonce being leaked in the '/wp-admin/index.php' page. This makes it possible for authenticated attackers to change arbitrary WordPress...

CVE-2020-36697

The WP GDPR plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in versions up to, and including, 2.1.1. This makes it possible for unauthenticated attackers to delete any comment and modify the plugin’s settings...

CVE-2016-15033

The Delete All Comments plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the via the delete-all-comments.php file in versions up to, and including, 2.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affecte...

CVE-2016-15033

The Delete All Comments plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the via the delete-all-comments.php file in versions up to, and including, 2.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affecte...

PT-2023-10352 · WordPress · Delete All Comments

Name of the Vulnerable Software and Affected Versions: Delete All Comments plugin for WordPress versions up to, and including, 2.0 Description: The issue arises from missing file type validation in the delete-all-comments.php file, allowing unauthenticated attackers to upload arbitrary files on t...

WordPress Plugin Quick Page/Post Redirect 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

PT-2023-12468 · WordPress · Frontend File Manager

Name of the Vulnerable Software and Affected Versions: Frontend File Manager plugin for WordPress versions up to, and including, 18.2 Description: The issue arises from lacking authentication protections and a security nonce on the wpfm delete file AJAX action, allowing unauthenticated attackers ...

PT-2023-22172 · Ptc · Vuforia

Name of the Vulnerable Software and Affected Versions: Vuforia affected versions not specified Description: The issue allows an attacker to delete any file with the permissions of the Vuforia server account by changing the filename parameter in the request. Recommendations: At the moment, there i...

PT-2023-12440 · Woocommerce +1 · Improved Product Options For Woocommerce +15

Name of the Vulnerable Software and Affected Versions: Product Filter for WooCommerce versions prior to 8.2.0 Improved Product Options for WooCommerce versions prior to 5.3.0 Improved Sale Badges for WooCommerce versions prior to 4.4.0 Share, Print and PDF Products for WooCommerce versions prior ...

WordPress Plugin Delete All Comments 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

WordPress Plugin Kali Forms 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

WordPress Plugin Frontend File Manager 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

Cisco Identity Services Engine 3.1.x < 3.1P6, 3.2.x < 3.2P2 Arbitrary File Delete and File Read (cisco-sa-ise-file-delete-read-PK5ghDDd)

According to its self-reported version, Cisco Identity Services is affected by a vulnerability in the web-based management interface. These allow an authenticated, remote attacker to delete or read arbitrary files on the underlying operating system. To exploit these vulnerabilities, an attacker...

Security Bulletin: IBM Sterling Partner Engagement Manager vulnerable to multiple issues due to IBM Java SE

Summary IBM Java is used by IBM Sterling Partner Engagement Manager. IBM Partner Engagement Manager has addressed the applicable CVE's. Vulnerability Details CVEID:CVE-2022-21628 DESCRIPTION: Java SE is vulnerable to a denial of service, caused by a flaw in the Lightweight HTTP Server. By sending...

CVE-2023-3100

A vulnerability, which was classified as critical, has been found in IBOS 4.5.5. Affected by this issue is the function actionDel of the file ?r=dashboard/approval/del. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used...

KiviCare Management System < 3.2.1 - Multiple CSRF

The plugin does not have CSRF checks either flawed or missing completely in various AJAX actions, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. This includes, but is not limited to: Delete arbitrary appointments/medical records/etc, create/update...

PT-2023-23100 · Kylinsoft · Youker-Assistant

Name of the Vulnerable Software and Affected Versions: KylinSoft youker-assistant versions prior to 3.0.2-0kylin6k70-23 Description: A critical issue was found in the delete file function of the dbus.SystemBus library in the Arbitrary File Handler component, leading to improper access controls...

PT-2023-23105 · Ibos · Ibos

Name of the Vulnerable Software and Affected Versions: IBOS version 4.5.5 Description: A critical issue has been found, affecting the function actionDel of the file "?r=dashboard/approval/del". The manipulation of the id argument leads to SQL injection. The exploit has been disclosed to the publi...