CVE-2024-55504: Improper Control of Generation of Code

An issue in RAR Extractor - Unarchiver Free and Pro v.6.4.0 allows local attackers to inject arbitrary code potentially leading to remote control and unauthorized access to sensitive user data via the exploitcombined.dylib component on MacOS...

CVE-2021-25120: Improper Neutralization of Input During Web Page Generation

The Easy Social Feed Free and Pro WordPress plugins before 6.2.7 do not sanitise some of their parameters used via AJAX actions before outputting them back in the response, leading to Reflected Cross-Site Scripting issues...

CVE-2022-0901: Improper Neutralization of Input During Web Page Generation

The Ad Inserter Free and Pro WordPress plugins before 2.7.12 do not sanitise and escape the REQUESTURI before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters...

CVE-2021-24962: Improper Limitation of a Pathname to a Restricted Directory

The WordPress File Upload Free and Pro WordPress plugins before 4.16.3 allow users with a role as low as Contributor to perform path traversal via a shortcode argument, which can then be used to upload a PHP code disguised as an image inside the auto-loaded directory of the plugin, resulting in...

CVE-2021-24382: Improper Neutralization of Input During Web Page Generation

The Smart Slider 3 Free and pro WordPress plugins before 3.5.0.9 did not sanitise the Project Name before outputting it back in the page, leading to a Stored Cross-Site Scripting issue. By default, only administrator users could access the affected functionality, limiting the exploitability of th...

AV Arcade Search Field XSS/HTML Injection Vulnerability

Exploit for php platform in category web applications ======================================================= AV Arcade Search Field XSS/HTML Injection Vulnerability ======================================================= Exploit Title: AV Arcade Search Field /includes/misc/search.php XSS/HTML...

CVE-2008-6534: Improper Input Validation

Incomplete blacklist vulnerability in NULL FTP Server Free and Pro 1.1.0.7 allows remote authenticated users to execute arbitrary commands via a custom SITE command containing shell metacharacters such as "&" ampersand in the middle of an argument...