11424 matches found
PT-2024-4453 · Adobe · Experience Manager
Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.20 and earlier Description: The issue is related to insufficient protection of the web page structure in Adobe Experience Manager, which can be exploited by a remote attacker to execute arbitrary code. A...
PT-2024-23595 · WordPress · Acf Front End Editor
Name of the Vulnerable Software and Affected Versions: ACF Front End Editor plugin for WordPress versions prior to 2.0.3 Description: The issue allows authenticated attackers with subscriber-level access and above to update arbitrary post title, content, and ACF data due to a missing capability...
PT-2024-23586 · WordPress · Acf On-The-Go
Name of the Vulnerable Software and Affected Versions: ACF On-The-Go plugin for WordPress versions up to, and including, 1.0.1 Description: The issue is related to a missing capability check on the acfg update fields function, allowing authenticated attackers with subscriber-level access and abov...
PT-2024-25185 · Unknown · Fme Modules Customfields
Name of the Vulnerable Software and Affected Versions: FME Modules customfields versions 2.2.7 and before Description: A Directory Traversal issue allows a remote attacker to obtain sensitive information via the "Custom Checkout Fields, Add Custom Fields to Checkout" parameter of the "ajax.php"...
All in One SEO < 4.6.1.1 - Contributor+ Stored XSS
Description The plugin does not validate and escape some of its Post fields before outputting them back, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks PoC As a contributor, create a post and put the following payload in the "Meta...
CVE-2024-3962
The Product Addons & Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ppomuploadfile function in all versions up to, and including, 32.0.18. This makes it possible for unauthenticated attackers to upload arbitrary files...
CVE-2024-3962 Product Addons & Fields for WooCommerce <= 32.0.18 - Unauthenticated Arbitrary File Upload via ppom_upload_file
The Product Addons & Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ppomuploadfile function in all versions up to, and including, 32.0.18. This makes it possible for unauthenticated attackers to upload arbitrary files...
Tenda AX1803 安全漏洞
Tenda AX1803 is a dual-band Gigabit WIFI6 router from Tenda China. The Tenda AX1803 version 1.0.0.1 suffers from a buffer overflow vulnerability that originates from the parameter serverName/ddnsUser/ddnsPwd/ddnsDomain failing to correctly validate the length and size of the input data, which can...
CVE-2024-3261 Strong Testimonials < 3.1.12 - Contributor+ Stored XSS
The Strong Testimonials WordPress plugin before 3.1.12 does not validate and escape some of its Testimonial fields before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. The attack requires a specific...
WordPress Delete Custom Fields plugin <= 0.3.1 - Cross-Site Request Forgery to Post Meta Deletion vulnerability
Cross-Site Request Forgery to Post Meta Deletion vulnerability discovered by Francesco Carlucci in WordPress Plugin Delete Custom Fields versions = 0.3.1...
WordPress Delete Custom Fields Plugin <= 0.3.1 is vulnerable to Cross Site Request Forgery (CSRF)
Software Delete Custom Fields Type Plugin Vulnerable versions = 0.3.1 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-0613 Patch priority Low CVSS severity Low 6.1 Developer Claim ownership PSID 68d8efef2ebd Credits Francesco Carlucc...
PT-2024-24727 · WordPress · Strong Testimonials
Name of the Vulnerable Software and Affected Versions: Strong Testimonials WordPress plugin versions prior to 3.1.12 Description: The issue allows users with the contributor role and above to perform Stored Cross-Site Scripting attacks due to the lack of validation and escaping of some Testimonia...
CVE-2024-3793 Cross-site Scripting vulnerability in WBSAirback
Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting XSS through /admin/CloudAccounts, account name / user password / server fields, all parameters. Exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and stea...
CVE-2024-31431
Cross-Site Request Forgery CSRF vulnerability in Tyche Softwares Product Input Fields for WooCommerce.This issue affects Product Input Fields for WooCommerce: from n/a through 1.7.0...
CVE-2024-31431
CVE-2024-31431: CSRF in Tyche Softwares Product Input Fields for WooCommerce affects Product Input Fields for WooCommerce versions up to 1.7.0 (no details on root cause beyond CSRF and no patch/version provided in the available documents). Affects the plugin for WooCommerce; reported by Red Hat/W...
CVE-2024-31431 WordPress Product Input Fields for WooCommerce plugin <= 1.7.0 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in Tyche Softwares Product Input Fields for WooCommerce.This issue affects Product Input Fields for WooCommerce: from n/a through 1.7.0...
CVE-2024-31431 WordPress Product Input Fields for WooCommerce plugin <= 1.7.0 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in Tyche Softwares Product Input Fields for WooCommerce.This issue affects Product Input Fields for WooCommerce: from n/a through 1.7.0...
Cross-Site Scripting (XSS)
mautic/core is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to insufficient sanitization of user inputs in the description fields. This can potentially lead an attacker getting elevated access to the system...