WordPress Custom WooCommerce Checkout Fields Editor Plugin <= 1.3.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Custom WooCommerce Checkout Fields Editor Type Plugin Vulnerable versions = 1.3.0 Fixed in 1.3.1 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-30518 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 1753adeaf82a...

WordPress Geo Controller Plugin <= 8.6.4 is vulnerable to Cross Site Scripting (XSS)

Software Geo Controller Type Plugin Vulnerable versions = 8.6.4 Fixed in 8.6.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-30451 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e663f7c5a611 Credits LVT-tholv2k Required privilege...

WordPress Church Admin Plugin <= 4.1.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software Church Admin Type Plugin Vulnerable versions = 4.1.7 Fixed in 4.1.8 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-30493 Patch priority Low CVSS severity Low 4.3 Developer Andy Moyle PSID 730279774aaf Credits Peng Zhou Required privileg...

CVE-2024-29886

CVE-2024-29886 affects Serverpod; root cause is an outdated password hash algorithm vulnerable to rainbow attacks if the database is compromised. The issue is mitigated by upgrading to Serverpod 1.2.6, which switches to the Argon2id password hash algorithm for the email authentication module. Not...

CVE-2024-28852

Ampache is a web based audio/video streaming application and file manager. Ampache has multiple reflective XSS vulnerabilities,this means that all forms in the Ampache that use rule as a variable are not secure. For example, when querying a song, when querying a podcast, we need to use $rule...

PT-2024-23288 · Metagauss · Metagauss Profilegrid

Name of the Vulnerable Software and Affected Versions: Metagauss ProfileGrid versions through 5.7.1 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for potential exploitation by injecting...

CVE-2023-41972 Revert password check incorrect type validation

In some rare cases, there is a password type validation missing in Revert Password check and for some features it could be disabled. Fixed Version: Win ZApp 4.3.0.121 and later...

WordPress Cornerstone Plugin <= 0.8.0 is vulnerable to Cross Site Scripting (XSS)

Software Cornerstone Type Plugin Vulnerable versions = 0.8.0 Fixed in 0.8.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-28002 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID e17127f05be4 Credits Rafie Muhammad Patchstack Required...

WordPress Calendarista Plugin <= 15.5.7 is vulnerable to SQL Injection

Software Calendarista Type Plugin Vulnerable versions = 15.5.7 Fixed in 15.5.9 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-30240 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID c87b524aa9f2 Credits Ivan Spiridonov Required privilege Subscriber...

WordPress Max Mega Menu Plugin <= 3.3 is vulnerable to Broken Access Control

Software Max Mega Menu Type Plugin Vulnerable versions = 3.3 Fixed in 3.3.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-28003 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 3ddcba15780a Credits Rafie Muhammad Patchstack Require...

WordPress MPG Plugin <= 3.4.0 is vulnerable to Broken Access Control

Software MPG Type Plugin Vulnerable versions = 3.4.0 Fixed in 3.4.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-30235 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 6cea17ebc47f Credits Majed Refaea Required privilege Subscribe...

WordPress Check & Log Email Plugin <= 1.0.9 is vulnerable to Broken Access Control

Software Check & Log Email Type Plugin Vulnerable versions = 1.0.9 Fixed in 1.0.10 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-0866 Patch priority Low CVSS severity Low 8.1 Developer Claim ownership PSID 0ac766d27e85 Credits Sean Murphy Required...

WordPress WholesaleX Plugin <= 1.3.1 is vulnerable to Sensitive Data Exposure

Software WholesaleX Type Plugin Vulnerable versions = 1.3.1 Fixed in 1.3.2 OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2024-30233 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID fd8f60a8b6dc Credits Emili Castells Required...

WordPress Easy Textillate Plugin <= 2.01 is vulnerable to Cross Site Scripting (XSS)

Software Easy Textillate Type Plugin Vulnerable versions = 2.01 Fixed in 2.02 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2303 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e2fef30ce1b2 Credits Tien Luong Required...

WordPress Link Whisper Free Plugin <= 0.7.1 is vulnerable to PHP Object Injection

Software Link Whisper Free Type Plugin Vulnerable versions = 0.7.1 Fixed in 0.7.2 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-2693 Patch priority Medium CVSS severity Medium 8.8 Developer Claim ownership PSID 1e82ed02e277 Credits Francesco Carlucci Required privile...

PT-2024-20567 · Woocommerce · Woocommerce Box Office

Name of the Vulnerable Software and Affected Versions: WooCommerce Box Office versions 1.2.2 and earlier Description: The issue is related to a Missing Authorization vulnerability in WooCommerce Box Office. Recommendations: For versions 1.2.2 and earlier, update to a version that contains a fix f...

WordPress Church Admin Plugin <= 4.0.27 is vulnerable to SQL Injection

Software Church Admin Type Plugin Vulnerable versions = 4.0.27 Fixed in 4.0.28 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-30244 Patch priority Medium CVSS severity Medium 8.5 Developer Andy Moyle PSID f10836385922 Credits LVT-tholv2k Required privilege Contributor...

UBUNTU-CVE-2024-29025

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The HttpPostRequestDecoder can be tricked to accumulate data. While the decoder can store items on the disk if configured so, there are no limits ...

CVE-2024-29025 Netty HttpPostRequestDecoder can OOM

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The HttpPostRequestDecoder can be tricked to accumulate data. While the decoder can store items on the disk if configured so, there are no limits ...

WordPress WP-Lister Lite for Amazon Plugin <= 2.6.8 is vulnerable to Cross Site Scripting (XSS)

Software WP-Lister Lite for Amazon Type Plugin Vulnerable versions = 2.6.8 Fixed in 2.6.9 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-30199 Patch priority Medium CVSS severity Medium 7.1 Developer WP Lab PSID fc71b299dc25 Credits Yudistira Arya Required privile...