CVE-2024-13607

CVE-2024-13607 : The WordPress plugin “JS Help Desk – The Ultimate Help Desk & Support Plugin” is vulnerable to Insecure Direct Object Reference via exportusereraserequest in all versions up to and including 2.8.8. Authenticated users with Subscriber-level permissions and above can export ticket ...

CVE-2025-20906: Undefined Security Weakness

Improper Export of Android Application Components in Settings prior to SMR Feb-2025 Release 1 allows local attackers to enable ADB...

CVE-2024-13607: Authorization Bypass Through User-Controlled Key

The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.8.8 via the 'exportusereraserequest' due to missing validation on a user controlled key. This makes it possible for authenticat...

PT-2025-2230

Name of the Vulnerable Software and Affected Versions The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress versions up to, and including, 2.8.8 Description The issue is related to Insecure Direct Object Reference, which allows authenticated attackers with Subscriber-lev...

PT-2025-4187 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions prior to SMR Feb-2025 Release 1 Description: The issue concerns an improper export of Android application components in Settings, allowing local attackers to enable ADB. This could potentially be exploited by attackers with...

WordPress WP All Export Pro plugin < 1.9.2 - Authenticated (Shop Manager+) Remote Code Execution vulnerability

Authenticated Shop Manager+ Remote Code Execution vulnerability discovered by ? in WordPress Plugin WP ALL Export Pro versions 1.9.2...

WordPress WP All Export Pro plugin < 1.9.2 - Unauthenticated Remote Code Execution via Custom Export Fields

Unauthenticated Remote Code Execution via Custom Export Fields vulnerability discovered by ? in WordPress Plugin WP ALL Export Pro versions 1.9.2...

WordPress Eventer plugin <= 3.9.9 - Missing Authorization to Authenticated (Subscriber+) Bookings Export

Missing Authorization to Authenticated Subscriber+ Bookings Export vulnerability discovered by István Márton in WordPress Plugin Eventer versions = 3.9.9...

CVE-2024-11134

The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'eventerexportbookingscsv' function in all versions up to, and including, 3.9.9. This makes it possible for authenticated attackers with subscriber-level permissions or above, to...

CVE-2024-11134 Eventer <= 3.9.9 - Missing Authorization to Authenticated (Subscriber+) Bookings Export

The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'eventerexportbookingscsv' function in all versions up to, and including, 3.9.9. This makes it possible for authenticated attackers with subscriber-level permissions or above, to...

WordPress Export Order, Product, Customer & Coupon for WooCommerce to Google Sheets plugin <= 1.8.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin Export Order, Product, Customer & Coupon for WooCommerce to Google Sheets versions = 1.8.2...

CVE-2024-36437: Improper Export of Android Application Components

The com.enflick.android.TextNow aka TextNow: Call + Text Unlimited application 24.17.0.2 for Android enables any installed application with no permissions to place phone calls without user interaction by sending a crafted intent via the com.enflick.android.TextNow.activities.DialerActivity...

Node export module Drupal Code Execution

The vulnerability of the Node export module in the Drupal CMS system is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

WordPress Order Export for WooCommerce plugin <= 3.24 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory vulnerability

Unauthenticated Sensitive Information Exposure Through Unprotected Directory vulnerability discovered by Tim Coen in WordPress Plugin Order Export for WooCommerce versions = 3.24...

SUSE CVE-2023-5003

The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.10 stores sensitive LDAP logs in a buffer file when an administrator wants to export said logs. Unfortunately, this log file is never removed, and remains accessible to any users knowing the URL to do so...

CVE-2024-13623: Exposure of Sensitive Information to an Unauthorized Actor

The Order Export for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.24 via the 'uploads' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads...

PT-2025-2232 · WordPress · Order Export For Woocommerce

Name of the Vulnerable Software and Affected Versions: Order Export for WooCommerce plugin for WordPress versions up to, and including, 3.24 Description: The issue allows unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads directory, which can contain...

WordPress plugin Order Export for WooCommerce has a vulnerability related to information leakage

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An information disclosure...

Kyocera Net Viewer Data Export Disclosure

The vulnerability of the data export function of the Kyocera Net Viewer monitoring and control software relates to insufficient protection of registration data. Exploiting this vulnerability can allow a malicious actor to disclose the protected information remotely...

CVE-2024-12269

The Safe Ai Malware Protection for WP plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportdb function in all versions up to, and including, 1.0.17. This makes it possible for unauthenticated attackers to retrieve a complete dump of the...