7753 matches found
WordPress Landing Page Builder – Free Landing Page Templates Plugin <= 3.1.9.9 is vulnerable to Local File Inclusion
Software Landing Page Builder – Free Landing Page Templates Type Plugin Vulnerable versions = 3.1.9.9 Fixed in 3.2 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2023-24379 Patch priority Low CVSS severity Low 6.8 Developer Claim ownership PSID e3d21e2cc897 Credits yuyudhn...
Auto Dealer Management System SQL注入漏洞
Auto Dealer Management System is a car dealer management system by Carlo Montero Personal Developer. A security vulnerability exists in Auto Dealer Management System v1.0. An attacker can exploit this vulnerability to perform SQL injection attacks...
WordPress Pricing Tables For WPBakery Page Builder Plugin < 3.0 is vulnerable to Cross Site Scripting (XSS)
Software Pricing Tables For WPBakery Page Builder Type Plugin Vulnerable versions 3.0 Fixed in 3.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0367 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 3359d5d482fd Credits...
WordPress WP VR Plugin < 8.2.9 is vulnerable to Cross Site Scripting (XSS)
Software WP VR Type Plugin Vulnerable versions 8.2.9 Fixed in 8.2.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-1413 Patch priority High CVSS severity High 7.1 Developer WPFunnels Team PSID f109d593f865 Credits Erwan LR WPScan Required privilege...
Privilege Escalation Vulnerability Patched Promptly in WP Data Access WordPress Plugin
On April 5, 2023 the Wordfence Threat Intelligence team initiated the responsible disclosure process for a vulnerability we discovered in WP Data Access, a WordPress plugin that is installed on over 10,000 sites. This flaw makes it possible for an authenticated attacker to grant themselves...
WordPress Gallery Plugin < 4.7.0 is vulnerable to SQL Injection
Software Gallery Type Plugin Vulnerable versions 4.7.0 Fixed in 4.7.0 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-0765 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 85ca584ad7e5 Credits dc11 Required privilege Author Published 12 April, 2023...
ChatBot < 4.4.9 - Subscriber+ OpenAI Settings Update to Stored XSS
The plugin does not have authorisation and CSRF in the AJAX action responsible to update the OpenAI settings, allowing any authenticated users, such as subscriber to update them. Furthermore, due to the lack of escaping of the settings, this could also lead to Stored XSS Run the below command in...
WordPress Video Central Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)
Software Video Central Type Plugin Vulnerable versions = 1.3.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0418 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 6114cbd9fcb5 Credits Lana Codes Required...
WordPress WP FEvents Book Plugin <= 0.46 is vulnerable to Cross Site Scripting (XSS)
Software WP FEvents Book Type Plugin Vulnerable versions = 0.46 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-1126 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID 345ebf3e10d0 Credits Ameen Alkurdy Required...
WordPress PowerPress Podcasting Plugin <= 10.0 is vulnerable to Cross Site Scripting (XSS)
Software PowerPress Podcasting Type Plugin Vulnerable versions = 10.0 Fixed in 10.0.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-1917 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 2e844f252ce9 Credits Alex Thomas...
Cybercriminals Turn to Android Loaders on Dark Web to Evade Google Play Security
Malicious loader programs capable of trojanizing Android applications are being traded on the criminal underground for up to $20,000 as a way to evade Google Play Store defenses. "The most popular application categories to hide malware and unwanted software include cryptocurrency trackers,...
KLA48843 Multiple vulnerabilities in Microsoft Developer Tools
Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information, gain privileges, spoof user interface. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability...
WordPress FluentForm Plugin < 4.3.25 is vulnerable to Cross Site Scripting (XSS)
Software FluentForm Type Plugin Vulnerable versions 4.3.25 Fixed in 4.3.25 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0546 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 479c93086620 Credits Vaibhav Rajput Required...
WordPress Simple Giveaways Plugin < 2.45.1 is vulnerable to Cross Site Scripting (XSS)
Software Simple Giveaways Type Plugin Vulnerable versions 2.45.1 Fixed in 2.45.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-1122 Patch priority Medium CVSS severity Medium 5.9 Developer Claim ownership PSID 8adf4cd8d10f Credits Varun Required...
WordPress Simple Giveaways Plugin < 2.45.1 is vulnerable to Cross Site Scripting (XSS)
Software Simple Giveaways Type Plugin Vulnerable versions 2.45.1 Fixed in 2.45.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-1120 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 3822ab339f6d Credits ipatelsumit Required...
WordPress WP Tiles Plugin <= 1.1.2 is vulnerable to Sensitive Data Exposure
Software WP Tiles Type Plugin Vulnerable versions = 1.1.2 Fixed in N/A OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2023-1426 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 0ecd1ecdc31a Credits Erwan LR WPScan Required...
WordPress JetEngine Plugin < 3.1.3.1 is vulnerable to Remote Code Execution (RCE)
Software JetEngine Type Plugin Vulnerable versions 3.1.3.1 Fixed in 3.1.3.1 OWASP Top 10 A1: Injection Classification Remote Code Execution RCE CVE CVE-2023-1406 Patch priority High CVSS severity High 9.1 Developer Crocoblock PSID a91fe4278b33 Credits R3zk0n Required privilege Author Published 11...
WordPress Stylish Cost Calculator Premium Plugin < 7.9.0 is vulnerable to Cross Site Scripting (XSS)
Software Stylish Cost Calculator Premium Type Plugin Vulnerable versions 7.9.0 Fixed in 7.9.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0983 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 344803b43355 Credits Flaviu...
Vulnerabilities fixed in Microsoft Developer Tools
Microsoft has fixed vulnerabilities in Microsoft Developer Tools. A malicious party could exploit the vulnerabilities to gain access to sensitive data, obtain elevated privileges or execute arbitrary code. To do so the malicious party must have access to a system on which the vulnerable...