CVE-2024-12315

The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.3 via the exports directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in t...

CVE-2024-13601

The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0.5 via the 'exportusereraserequest' function due to missing validation on a user controlled key. This makes i...

CVE-2024-13601

The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0.5 via the 'exportusereraserequest' function due to missing validation on a user controlled key. This makes i...

CVE-2024-13601 Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin <= 1.0.5 - Authenticated (Subscriber+) Insecure Direct Object Reference

The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0.5 via the 'exportusereraserequest' function due to missing validation on a user controlled key. This makes i...

CVE-2025-0808

The Houzez Property Feed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.21. This is due to missing or incorrect nonce validation on the "deleteexport" action. This makes it possible for unauthenticated attackers to delete property feed...

CVE-2025-0808 Houzez Property Feed <= 2.4.21 - Cross-Site Request Forgery to Property Feed Export Deletion

The Houzez Property Feed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.21. This is due to missing or incorrect nonce validation on the "deleteexport" action. This makes it possible for unauthenticated attackers to delete property feed...

CVE-2024-11629: Files or Directories Accessible to External Parties

In Progress® Telerik® Document Processing Libraries, versions prior to 2025 Q1 2025.1.205, using .NET Standard 2.0, the contents of a file at an arbitrary path can be exported to RTF...

CVE-2024-12315: Insecure Storage of Sensitive Information

The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.3 via the exports directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in t...

CVE-2024-13601: Authorization Bypass Through User-Controlled Key

The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0.5 via the 'exportusereraserequest' function due to missing validation on a user controlled key. This makes i...

PT-2025-6445

Name of the Vulnerable Software and Affected Versions Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin versions 1.0.5 and earlier Description The issue is related to Insecure Direct Object Reference. It affects the 'exportusereraserequest' function due to missing validation...

PT-2025-6432 · WordPress · Houzez Property Feed

Name of the Vulnerable Software and Affected Versions: Houzez Property Feed plugin for WordPress versions up to, and including, 2.4.21 Description: The issue is due to missing or incorrect nonce validation on the deleteexport action, making it possible for unauthenticated attackers to delete...

Progress Telerik Document Processing Libraries Security Vulnerabilities

Progress Telerik Document Processing Libraries is a document processing library from Progress USA. A security vulnerability exists in Progress Telerik Document Processing Libraries prior to version 2025 Q1, which originates from the ability to export the contents of a file in an arbitrary path to...

WordPress plugin Majestic Support has a security vulnerability

WordPress and WordPress plugin are products of the WordPress Foundation, a blogging platform developed in the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability exists in WordPress plugin...

WordPress plugin Houzez Property Feed has a cross-site request forgeing vulnerability.

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

OpenSearch Dashboards Reports Security Vulnerabilities

OpenSearch Dashboards Reports is an OpenSearch open source application. It is used to export and automate PNG, PDF and CSV reports in OpenSearch Dashboard. A security vulnerability exists in OpenSearch Dashboards Reports version 2.19, which stems from the Dashboards Reports module containing a...

WordPress Houzez Property Feed plugin <= 2.4.21 - Cross-Site Request Forgery to Property Feed Export Deletion vulnerability

Cross-Site Request Forgery to Property Feed Export Deletion vulnerability discovered by Dhabaleshwar Das in WordPress Plugin Houzez Property Feed versions = 2.4.21...

thunderbird: Unsanitized address book fields

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: The Thunderbird Address Book URI fields contained unsanitized links. This could be used by an attacker to create and export an address book containing a malicious payload in a field. For...

CVE-2025-1168

A vulnerability was found in SourceCodester Contact Manager with Export to VCF 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /endpoint/delete-contact.php. The manipulation of the argument contact leads to sql injection. The attack can be initiated...

CVE-2025-1168: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in SourceCodester Contact Manager with Export to VCF 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /endpoint/delete-contact.php. The manipulation of the argument contact leads to sql injection. The attack can be initiated...

PT-2025-6453

Name of the Vulnerable Software and Affected Versions Export All Posts, Products, Orders, Refunds & Users plugin for WordPress versions up to, and including, 2.9.3 Description The issue allows unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/smack u...