PT-2025-40555

Name of the Vulnerable Software and Affected Versions Redis versions 8.2.1 and below Redis versions prior to 8.2.2 Description Redis, an in-memory database, contains an issue where an authenticated user can utilize a crafted Lua script to trigger an integer overflow. This could potentially lead t...

WordPress Counter Box Plugin < 1.2.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Counter Box Type Plugin Vulnerable versions 1.2.4 Fixed in 1.2.4 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-3481 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 8cd9da8dd3bb Credits Bob Matyas Required...

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow via the comment functionality. An attacker can execute arbitrary code or cause a denial of service condition by providing a malicious .ogg file. Remediation There is no fixed version for stb. References - Talo...

PT-2024-25111 · Tencent · Tencent Libpag

Name of the Vulnerable Software and Affected Versions: Tencent Libpag version 4.3 Description: The issue allows a user to send a crafted image to trigger a buffer overflow, which can lead to remote code execution. Recommendations: For Tencent Libpag version 4.3, update to a version that fixes the...

PT-2025-13345 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to the fixed version Description: A use-after-free UaF issue has been identified in the Linux kernel's netns ops registration error path. When net assign generic fails, the error path in ops init attempts to clear...

WordPress Cost Calculator Builder Pro Plugin <= 3.1.67 is vulnerable to Cross Site Scripting (XSS)

Software Cost Calculator Builder Pro Type Plugin Vulnerable versions = 3.1.67 Fixed in 3.1.68 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4097 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 99ec603c6f20 Credits andrea...

WordPress MasterStudy LMS Plugin <= 3.3.8 is vulnerable to Broken Access Control

Software MasterStudy LMS Type Plugin Vulnerable versions = 3.3.8 Fixed in 3.3.9 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-3942 Patch priority Low CVSS severity Low 6.3 Developer Claim ownership PSID e8c9ed38d014 Credits Lucio Sá Required privilege...

WordPress Where Did You Hear About Us Checkout Field for WooCommerce Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)

Software Where Did You Hear About Us Checkout Field for WooCommerce Type Plugin Vulnerable versions = 1.3.1 Fixed in 1.3.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2752 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID...

WordPress Masteriyo - LMS Plugin <= 1.7.3 is vulnerable to Broken Authentication

Software Masteriyo - LMS Type Plugin Vulnerable versions = 1.7.3 Fixed in 1.7.4 OWASP Top 10 A4: Insecure Design Classification Broken Authentication CVE CVE-2024-33939 Patch priority Medium CVSS severity Medium 5.3 Developer Masteriyo PSID ce37ea579b31 Credits Steven Julian Required privilege...

WordPress Grid Gallery Plugin <= 1.4.3 is vulnerable to PHP Object Injection

Software Grid Gallery Type Plugin Vulnerable versions = 1.4.3 Fixed in 1.4.4 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-1897 Patch priority Medium CVSS severity Medium 6.4 Developer Claim ownership PSID 43f9768655e4 Credits Francesco Carlucci Required privilege...

WordPress Pearl Plugin <= 1.3.6 is vulnerable to Cross Site Scripting (XSS)

Software Pearl Type Plugin Vulnerable versions = 1.3.6 Fixed in 1.3.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4000 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 24b9141edb4a Credits Krzysztof Zając Required privilege...

WordPress Calendar Plugin <= 1.3.14 is vulnerable to SQL Injection

Software Calendar Type Plugin Vulnerable versions = 1.3.14 Fixed in 1.3.15 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-2831 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 8a403f3f03cd Credits Krzysztof Zając Required privilege Contributor Publishe...

WordPress Breakdance Plugin <= 1.7.0 is vulnerable to Cross Site Scripting (XSS)

Software Breakdance Type Plugin Vulnerable versions = 1.7.0 Fixed in 1.7.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-6854 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 0b7ea50f2b37 Credits Francesco Carlucci Required privilege...

WordPress RegistrationMagic Plugin <= 5.3.2.0 is vulnerable to Cross Site Scripting (XSS)

Software RegistrationMagic Type Plugin Vulnerable versions = 5.3.2.0 Fixed in 5.3.2.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33947 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 3253d446e4b2 Credits Dimas Maulana Required...

WordPress Admin Bar Editor Plugin <= 1.0.2.2 is vulnerable to Broken Access Control

Software Admin Bar Editor Type Plugin Vulnerable versions = 1.0.2.2 Fixed in 1.0.23 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1716 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 919c0767c3fa Credits Lucio Sá Required privileg...

WordPress Analytify Plugin <= 5.2.3 is vulnerable to Broken Access Control

Software Analytify Type Plugin Vulnerable versions = 5.2.3 Fixed in 5.2.4 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1809 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID ab2e692a810a Credits Lucio Sá Required privilege Subscrib...

WordPress AJAX Login and Registration modal popup + inline form Plugin <= 2.23 is vulnerable to Cross Site Scripting (XSS)

Software AJAX Login and Registration modal popup + inline form Type Plugin Vulnerable versions = 2.23 Fixed in 2.24 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33918 Patch priority Medium CVSS severity Medium 5.9 Developer Claim ownership PSID ea1aeec00d87...

WordPress Print My Blog Plugin <= 3.26.2 is vulnerable to Broken Access Control

Software Print My Blog Type Plugin Vulnerable versions = 3.26.2 Fixed in 3.26.3 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-33907 Patch priority Low CVSS severity Low 5.3 Developer Michael Nelson PSID 21993595be67 Credits Steven Julian Required privile...

CVE-2024-32764

A missing authentication for critical function vulnerability has been reported to affect myQNAPcloud Link. If exploited, the vulnerability could allow users with the privilege level of some functionality via a network. We have already fixed the vulnerability in the following version: myQNAPcloud...

CVE-2023-50362

A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute code via a network. We have already fixed the vulnerability in the following versions: QTS...