CVE-2024-5857

CVE-2024-5857 affects Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free (WordPress). A missing capability check on the af2_handel_file_remove AJAX action in all versions up to 3.7.3.2 allows unauthenticated attackers to delete arbitrary media files. C...

WordPress Theme Editor plugin <= 2.8 - Authenticated (Admin+) PHAR Deserialization vulnerability

Authenticated Admin+ PHAR Deserialization vulnerability discovered by Rasoul Jahanshahi in WordPress Plugin Theme Editor versions = 2.8...

PT-2024-30825

Name of the Vulnerable Software and Affected Versions WaspThemes YellowPencil Visual CSS Style Editor versions through 7.6.1 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Reflected XSS. This...

WordPress Theme Editor Plugin <= 2.8 is vulnerable to PHP Object Injection

Software Theme Editor Type Plugin Vulnerable versions = 2.8 Fixed in 2.9 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2022-2440 Patch priority Low CVSS severity Low 5.5 Developer Claim ownership PSID b13ac324d817 Credits Rasoul Jahanshahi Required privilege Administrator...

CVE-2022-2440: Deserialization of Untrusted Data

The Theme Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the 'imagesarray' parameter in versions up to, and including 2.8. This makes it possible for authenticated attackers with administrative privileges to call files using a PHAR wrapper that will deserializ...

WordPress Plugin Theme Editor Code Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Theme Edit...

CVE-2024-43963: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in WaspThemes YellowPencil Visual CSS Style Editor allows Reflected XSS.This issue affects YellowPencil Visual CSS Style Editor: from n/a through 7.6.1...

Vim buffer overflow vulnerability (CNVD-2024-40459)

Vim is Vim open source a cross-platform text editor . A buffer overflow vulnerability exists in versions prior to Vim 9.1.0697, which stems from not checking if there is enough space in the buffer for the next character, and can be exploited by a remote attacker to execute arbitrary code on the...

ROS-20240827-10

A vulnerability in the File Name Handler component of the vim text editor exists due to a bug in the use of pointers after memory release in the dialogchanged function. pointers after memory release in dialogchanged function. Exploitation of the vulnerability could allow an an attacker to cause a...

PT-2024-11529 · WordPress · Theme Editor

Name of the Vulnerable Software and Affected Versions: Theme Editor plugin for WordPress versions up to, and including 2.8 Description: The Theme Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the images array parameter. This makes it possible for authenticate...

PT-2024-6612 · Unknown · Pdf-Xchange Editor

Name of the Vulnerable Software and Affected Versions: PDF-XChange Editor affected versions not specified Description: The issue is related to an out-of-bounds read in the handling of AcroForms, which can result from the lack of proper validation of user-supplied data. This can allow an attacker ...

CVE-2024-43802 heap-buffer-overflow in ins_typebuf() in Vim < 9.1.0697

Vim is an improved version of the unix vi text editor. When flushing the typeahead buffer, Vim moves the current position in the typeahead buffer but does not check whether there is enough space left in the buffer to handle the next characters. So this may lead to the tboff position within the...

WordPress Visual CSS Style Editor plugin <= 7.6.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Le Ngoc Anh Patchstack Alliance in WordPress Plugin YellowPencil Visual CSS Style Editor versions = 7.6.1...

WordPress Animated Number Counters plugin <= 2.1 - Editor+ Limited Local File Inclusion vulnerability

Editor+ Limited Local File Inclusion vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin Animated Number Counters versions = 2.1...

WordPress Gutenverse – Gutenberg Blocks – Page Builder for Site Editor plugin <= 1.9.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin Gutenverse versions = 1.9.4...

WordPress Simple Job Board plugin <= 2.12.3 - Authenticated (Editor+) PHP Object Injection vulnerability

Authenticated Editor+ PHP Object Injection vulnerability discovered by Francesco Carlucci in WordPress Plugin Simple Job Board versions = 2.12.3...

WordPress Custom Permalinks plugin <= 2.6.0 - Authenticated(Editor+) Stored Cross-Site Scripting vulnerability

AuthenticatedEditor+ Stored Cross-Site Scripting vulnerability discovered by Ram in WordPress Plugin Custom Permalinks versions = 2.6.0...

School Log Management System 1.0 SQL Injection / Code Execution

============================================================================================================================================= | Title : School Log Management System 1.0 WYSIWYG Settings Management Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser :...

Simple College Website 1.0 SQL Injection / Code Execution

============================================================================================================================================= | Title : Simple College Website 1.0 WYSIWYG Settings Management Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla...

WordPress Simple Job Board Plugin <= 2.12.3 is vulnerable to PHP Object Injection

Software Simple Job Board Type Plugin Vulnerable versions = 2.12.3 Fixed in 2.12.4 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-7351 Patch priority Medium CVSS severity Medium 8 Developer Claim ownership PSID a1947bfcfa95 Credits Francesco Carlucci Required privileg...