WordPress plugin Quotes and Tips by BestWebSoft Security Vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A security vulnerability previously existed in the...

WordPress Featured Image Generator plugin <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Images Upload vulnerability

Missing Authorization to Authenticated Subscriber+ Images Upload vulnerability discovered by Lucio Sá in WordPress Plugin Featured Image Generator versions = 1.3.1...

CVE-2024-5677

The Featured Image Generator plugin for WordPress is vulnerable to unauthorized image upload due to a missing capability check on the figsaveaftergenerateimage function in all versions up to, and including, 1.3.1. This makes it possible for authenticated attackers, with Subscriber-level access an...

CVE-2024-5677 Featured Image Generator <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Images Upload

The Featured Image Generator plugin for WordPress is vulnerable to unauthorized image upload due to a missing capability check on the figsaveaftergenerateimage function in all versions up to, and including, 1.3.1. This makes it possible for authenticated attackers, with Subscriber-level access an...

CVE-2024-5677

CVE-2024-5677 affects the Featured Image Generator plugin for WordPress. Root cause: missing capability check in fig_save_after_generate_image on all versions up to and including 1.3.1. Impact: allows authenticated attackers with Subscriber-level access and above to upload arbitrary images to a p...

OpenStack: malicious qcow2/vmdk images

An input validation flaw was discovered in how multiple OpenStack services validate images with backing file references. An authenticated attacker could provide a malicious image via upload, or by creating and modifying an image from an existing volume. Validation of images can be triggered durin...

CVE-2024-6314

CVE-2024-6314 affects the IQ Testimonials WordPress plugin. The Red Hat and Wordfence entries describe a vulnerability in process_image_upload that allows unauthenticated arbitrary file uploads in versions up to and including 2.2.7 due to insufficient file type validation. The impact is high: if ...

WordPress plugin IQ Testimonials security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exis...

PT-2024-37535 · WordPress · Testimonials

Name of the Vulnerable Software and Affected Versions: IQ Testimonials plugin for WordPress versions up to, and including, 2.2.7 Description: The issue is related to insufficient file type validation in the process image upload function, allowing unauthenticated attackers to upload arbitrary file...

CVE-2024-6439

A vulnerability was found in SourceCodester Home Owners Collection Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /classes/Users.php?f=save. The manipulation of the argument img leads to unrestricted upload. The attack may be initiated...

OpenStack Security Vulnerabilities

OpenStack is a cloud platform management program of the National Aeronautics and Space Administration NASA. A security vulnerability exists in OpenStack, which stems from an input validation flaw that could allow an attacker to deliver a malicious image by uploading or creating and modifying an...

CVE-2024-6280

A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/ajax.php?action=savesettings. The manipulation of the argument img leads to unrestricted upload. It is possible to initiate the attack...

PT-2024-20095 · WordPress · Aliexpress Dropshipping With Alinext Lite

Name of the Vulnerable Software and Affected Versions: AliExpress Dropshipping with AliNext Lite plugin for WordPress versions up to, and including, 3.3.5 Description: The issue is related to arbitrary file uploads due to missing file type validation in the ajax save image function. This allows...

CVE-2024-6114

A vulnerability classified as critical has been found in itsourcecode Monbela Tourist Inn Online Reservation System up to 1.0. Affected is an unknown function of the file controller.php. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack...

CVE-2024-6110

A vulnerability was found in itsourcecode Magbanua Beach Resort Online Reservation System up to 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file controller.php. The manipulation of the argument image leads to unrestricted upload. The attack may ...

CVE-2024-6084

A vulnerability has been found in itsourcecode Pool of Bethesda Online Reservation System up to 1.0 and classified as critical. Affected by this vulnerability is the function uploadImage of the file /admin/modroom/controller.php?action=add. The manipulation of the argument image leads to...

Pool of Bethesda Online Reservation System Code Issue Vulnerability

Pool of Bethesda Online Reservation System is a pool online reservation system by janobe individual developer. A code issue vulnerability exists in Pool of Bethesda Online Reservation System version 1.0 and prior versions, which stems from the parameter image in file...

Monbela Tourist Inn Online Reservation System Code Issue Vulnerability

Monbela Tourist Inn Online Reservation System is itsourcecode open source a travel hotel online reservation system. A code issue vulnerability exists in Monbela Tourist Inn Online Reservation System version 1.0 and prior versions, which stems from the parameter image in the file controller.php th...

PT-2024-37374 · Bethesda · Bethesda Online Reservation System

Name of the Vulnerable Software and Affected Versions: Bethesda Online Reservation System version 1.0 Description: A critical issue has been found in the Bethesda Online Reservation System, affecting the uploadImage function of the file /admin/mod room/controller.php?action=add. The manipulation ...

PT-2024-37391 · Unknown · Monbela Tourist Inn Online Reservation System

Name of the Vulnerable Software and Affected Versions: Monbela Tourist Inn Online Reservation System versions up to 1.0 Description: A critical vulnerability has been found in the Monbela Tourist Inn Online Reservation System, affecting an unknown function of the file controller.php. The...