PT-2024-17733 · Itsourcecode · Itsourcecode Vehicle Management System

Name of the Vulnerable Software and Affected Versions: itsourcecode Vehicle Management System version 1.0 Description: A problem has been found in the itsourcecode Vehicle Management System, classified as problematic. This issue affects some unknown processing of the file /billaction.php. The...

CVE-2024-53802

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in FuturioWP Futurio Extra futurio-extra allows Stored XSS.This issue affects Futurio Extra: from n/a through = 2.0.14...

CVE-2024-53802

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in FuturioWP Futurio Extra allows Stored XSS.This issue affects Futurio Extra: from n/a through 2.0.14...

CVE-2024-53802 WordPress Futurio Extra plugin <= 2.0.14 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in FuturioWP Futurio Extra allows Stored XSS.This issue affects Futurio Extra: from n/a through 2.0.14...

CVE-2024-53802

CVE-2024-53802 is a stored Cross-Site Scripting vulnerability in the Futurio Extra WordPress plugin. Public details indicate improper input handling during web page generation, exploitable via the header_size tag, affecting Futurio Extra versions from unspecified earlier releases up to and includ...

CVE-2024-53802 WordPress Futurio Extra plugin <= 2.0.14 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in FuturioWP Futurio Extra futurio-extra allows Stored XSS.This issue affects Futurio Extra: from n/a through = 2.0.14...

WordPress plugin Futurio Extra 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2024-35916 · Unknown · Futurio Extra

Name of the Vulnerable Software and Affected Versions: Futurio Extra versions prior to 2.0.14 Description: The issue is related to improper neutralization of input during web page generation, which allows for stored Cross-site Scripting XSS. This enables attackers to inject malicious scripts into...

VulnCheck KEV: CVE-2023-22809

In Sudo before 1.9.12p2, the sudoedit aka -e feature mishandles extra arguments passed in the user-provided environment variables SUDOEDITOR, VISUAL, and EDITOR, allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation...

WordPress plugin BP Profile Shortcodes Extra SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A SQL injection vulnerability exists in...

PT-2024-17220 · WordPress · Bp Profile Shortcodes Extra

Name of the Vulnerable Software and Affected Versions: BP Profile Shortcodes Extra plugin for WordPress versions up to, and including, 2.6.0 Description: The issue is related to time-based SQL Injection via the tab parameter due to insufficient escaping on the user-supplied parameter and lack of...

WordPress BP Profile Shortcodes Extra plugin <= 2.6.0 - Authenticated (Contributor+) SQL Injection via tab Parameter vulnerability

Authenticated Contributor+ SQL Injection via tab Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin BP Profile Shortcodes Extra versions = 2.6.0...

WordPress Futurio Extra plugin <= 2.0.14 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin Futurio Extra versions = 2.0.14...

WordPress Attesa Extra plugin <= 1.4.2 - Authenticated (Contributor+) Post Disclosure vulnerability

Authenticated Contributor+ Post Disclosure vulnerability discovered by Francesco Carlucci in WordPress Plugin Attesa Extra versions = 1.4.2...

WordPress Attesa Extra Plugin <= 1.4.2 is vulnerable to Broken Access Control

Software Attesa Extra Type Plugin Vulnerable versions = 1.4.2 Fixed in 1.4.3 OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Access Control CVE CVE-2024-10688 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 5de7d31066fa Credits Francesco...

Astra Linux – Vulnerability in krb5

In MIT Kerberos 5 also known as krb5, before version 1.21.3, an attacker could modify the plaintext Extra Count field of a confidential GSS krb5 wrap token. This modification caused the unwrapped token to appear truncated, affecting the application...

CVE-2024-10532

The Bard Extra plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the bardxtraimportxml function in all versions up to, and including, 1.2.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to...

CVE-2024-10532 Bard Extra <= 1.2.7 - Missing Authorization to Authenticated (Subscriber+) Demo Import

The Bard Extra plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the bardxtraimportxml function in all versions up to, and including, 1.2.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to...

CVE-2024-10532 Bard Extra <= 1.2.7 - Missing Authorization to Authenticated (Subscriber+) Demo Import

The Bard Extra plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the bardxtraimportxml function in all versions up to, and including, 1.2.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to...

CVE-2024-10532

CVE-2024-10532 affects Bard Extra for WordPress. The vulnerability is due to a missing authorization check in the bardxtra_import_xml() function, allowing authenticated users with subscriber-level access and above to import demo data, enabling unauthorized modification of data. Affected versions ...