Use of deprecated Chainlink function latestAnswer

Lines of code Vulnerability details function getCurrentPriceaddress asset external view overrideProviderOracleManager, IProviderOracleManager returns uint256 address assetOracle = getAssetOracleasset; IEACAggregatorProxy aggregator = IEACAggregatorProxyassetOracle; int256 answer =...

Pimcore data-hub 跨站脚本漏洞

Pimcore data-hub is a data delivery and consumption platform from Austrian company Pimcore. There is a security vulnerability in Pimcore data-hub, no information about the vulnerability is available at this time, please keep an eye on CNNVD or vendor announcements...

CVE-2021-24958

CVE-2021-24958 affects the Meks Easy Photo Feed Widget WordPress plugin prior to version 1.2.4. Root cause: the meks_save_business_selected_account AJAX action lacks capability and CSRF checks and does not escape some settings, making it accessible to any authenticated user. Impact: any authentic...

CVE-2021-24958 Meks Easy Photo Feed Widget < 1.2.4 - Subscriber+ Settings Update to Stored XSS

The Meks Easy Photo Feed Widget WordPress plugin before 1.2.4 does not have capability and CSRF checks in the mekssavebusinessselectedaccount AJAX action, available to any authenticated user, and does not escape some of the settings. As a result, any authenticated user, such as subscriber could...

CVE-2022-26143

creationtimestamp| type| source ---|---|--- 2022-03-09 18:35:18+00:00| exploited| https://t.me/NeKaspersky/1961 2022-03-10 11:58:50+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/5572 2022-03-24 15:00:40+00:00| seen| Telegram/avpuSCeroSRuI6Q4LdhzIJlOMgwJSnzyUBpCKjrlyUT8...

WordPress Product Feed PRO for WooCommerce Plugin Cross-Site Scripting Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress Product Feed PRO for WooCommerce Plugin before 11.2.3...

CVE-2022-0426

The Product Feed PRO for WooCommerce WordPress plugin before 11.2.3 does not escape the rowCount parameter before outputting it back in an attribute via the wooseacategoriesdropdown AJAX action available to any authenticated user, leading to a Reflected Cross-Site Scripting...

CVE-2022-0426

The Product Feed PRO for WooCommerce WordPress plugin before 11.2.3 does not escape the rowCount parameter before outputting it back in an attribute via the wooseacategoriesdropdown AJAX action available to any authenticated user, leading to a Reflected Cross-Site Scripting...

CVE-2022-0426

The Product Feed PRO for WooCommerce WordPress plugin before 11.2.3 does not escape the rowCount parameter before outputting it back in an attribute via the wooseacategoriesdropdown AJAX action available to any authenticated user, leading to a Reflected Cross-Site Scripting...

Sql injection

The test parameter of the xmlfeed in the Tradetracker-Store WordPress plugin before 4.6.60 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection...

CVE-2022-0426 Product Feed PRO for WooCommerce < 11.2.3 - Reflected Cross-Site Scripting

The Product Feed PRO for WooCommerce WordPress plugin before 11.2.3 does not escape the rowCount parameter before outputting it back in an attribute via the wooseacategoriesdropdown AJAX action available to any authenticated user, leading to a Reflected Cross-Site Scripting...

CVE-2022-0426

CVE-2022-0426 affects WordPress Product Feed PRO for WooCommerce plugin versions before 11.2.3. The vulnerability arises because the rowCount parameter is not escaped before being echoed in the woosea_categories_dropdown AJAX action, which is available to any authenticated user, enabling reflecte...

CVE-2022-26485

creationtimestamp| type| source ---|---|--- 2022-03-07 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=749 2022-03-07 05:42:50+00:00| exploited| https://t.me/thehackernews/1952 2022-03-07 06:12:15+00:00| seen| https://t.me/cKure/8957 2022-11-17 10:42:44+00:00| exploited|...

WordPress plugin Tradetracker-Store SQL注入漏洞

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress Tradetracker-Store has a SQL injection vulnerability, which stems from the fact that the test parameters o...

WordPress plugin 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress Product Feed PRO for WooCommerce Plugin before 11.2.3...

WordPress Auto Robot – WP Autoblogging and RSS Feed News Aggregator plugin < 3.3.40 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Auto Robot – WP Autoblogging and RSS Feed News Aggregator plugin versions 3.3.40. Solution Update the WordPress Auto Robot – WP Autoblogging and RSS Feed News Aggregator plugin to the latest available...

WordPress Pretty Grid – Social Feed Gallery Plugin plugin < 1.0.8 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Pretty Grid – Social Feed Gallery Plugin plugin versions 1.0.8. Solution Update the WordPress Pretty Grid – Social Feed Gallery Plugin plugin to the latest available version at least 1.0.8...

WordPress Easy Tiktok Feed plugin <= 1.1.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Easy Tiktok Feed plugin versions = 1.1.0. Solution Update the WordPress Easy Tiktok Feed plugin to the latest available version at least 1.1.1...

WordPress Drip Feed Content Extended for Learndash plugin <= 1.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Drip Feed Content Extended for Learndash plugin versions = 1.1. Solution No patched version available...

WordPress WordPress Expert Agent XML Feed plugin <= 2.1.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress WordPress Expert Agent XML Feed plugin versions = 2.1.3. Solution No patched version available...