WordPress Plugin Theme Demo Import Code Issue Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists in...

WordPress Plugin Export Import Menus Code Issue Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists i...

WordPress Plugin Olive One Click Demo Import Code Issue Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in...

PT-2023-22150 · Unknown · Olive One Click Demo Import

Name of the Vulnerable Software and Affected Versions: Olive One Click Demo Import versions 1.1.1 and earlier Description: The issue is related to an Unrestricted Upload of File with Dangerous Type, which affects the Olive One Click Demo Import. There is no information provided about the estimate...

PT-2023-24855 · Unknown · Export Import Menus

Name of the Vulnerable Software and Affected Versions: Akshay Menariya Export Import Menus versions 1.8.0 and earlier Description: The issue is related to an Unrestricted Upload of File with Dangerous Type, which affects the Export Import Menus. There is no information provided about the estimate...

Apache Superset 资源管理错误漏洞

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. A denial of service vulnerability exists in Apache Superset, which can be exploited by an authenticated attacker to upload a malicious ZIP for importing databases, dashboards, or datasets,...

PT-2023-29848

Name of the Vulnerable Software and Affected Versions Apache Superset versions up to and including 2.1.2 Apache Superset versions 3.0.0, 3.0.1 Description Uncontrolled resource consumption can be triggered by an authenticated attacker that uploads a malicious ZIP to import database, dashboards, o...

CVE-2023-6826

The E2Pdf plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'importaction' function in versions up to, and including, 1.20.25. This makes it possible for authenticated attackers with a role that the administrator previously granted access...

WordPress Plugin E2Pdf security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

PKP-WAL 3.4.0-3 Remote Code Execution

--------------------------------------------------------------------------------- PKP-WAL getDeployment; 103. 104. $context = $deployment-getContext; 105. 106. $locale = $node-getAttribute'locale'; 107. if empty$locale 108. $locale = $context-getPrimaryLocale; 109. 110. 111. $coverImagelocale = ;...

PT-2023-32780 · WordPress · E2Pdf

Name of the Vulnerable Software and Affected Versions: E2Pdf plugin for WordPress versions up to, and including, 1.20.25 Description: The issue arises from insufficient file type validation on the import action function, allowing authenticated attackers with granted access to the plugin to upload...

Slider Revolution < 6.6.19 - Author+ Insecure Deserialization leading to RCE

Description The plugin does not prevent users with at least the Author role from unserializing arbitrary content when importing sliders, potentially leading to Remote Code Execution. 1. Make sure to configure the plugin so Authors can access its settings 2. Create a new slider. 3. Save and export...

OPENSUSE-SU-2023:0397-1 Security update for opera

This update for opera fixes the following issues: - Update to 105.0.4970.34 DNA-112796 Import Import bookmarks and history don't work DNA-113147 Add strength setting for Lucid Mode DNA-113148 Update 'Lucid Mode' button on videos to enable / disable split preview DNA-113287 Add strength setting fo...

WordPress Import and export users and customers Plugin <= 1.24.3 is vulnerable to Cross Site Scripting (XSS)

Software Import and export users and customers Type Plugin Vulnerable versions = 1.24.3 Fixed in 1.24.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6624 Patch priority Low CVSS severity Low 6.5 Developer Codection PSID 8dfbaad9de1b Credits...

SVGator – Add Animated SVG Easily < 1.2.5 - API Token Update/Deletion & Import Projects via CSRF

Description The plugin does not have CSRF checks when updating and deleting API token as well as importing projects, which could allow attackers to make logged in admins perform such actions via CSRF attacks...

Elementor < 3.18.2 - Contributor+ Arbitrary File Upload to RCE via Template Import

Description The plugin is vulnerable to Remote Code Execution via file upload via the template import functionality, allowing authenticated attackers, with contributor-level access and above, to upload files and execute code on the server. PoC 1. Edit a post in Elementor. 2. Import a template...

SUSE: Security Advisory (SUSE-SU-2023:4672-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2023-9052 · Oracle · Oracle Agile Product Lifecycle Management For Process

Name of the Vulnerable Software and Affected Versions: Oracle Agile Product Lifecycle Management for Process version 6.2.4.2 Description: The issue is related to insufficient input validation in the Data Import component of the Oracle Agile Product Lifecycle Management for Process application. Th...

SUSE-SU-2023:4672-1 Security update for suse-build-key

This update for suse-build-key fixes the following issues: This update runs a import-suse-build-key script. The previous libzypp-post-script based installation is replaced with a systemd timer and service bsc1217215 bsc1216410 jscPED-2777. - suse-build-key-import.service -...

PHPJabbers Appointment Scheduler 3.0 CSV Injection

Exploit Title: PHPJabbers Appointment Scheduler v3.0 - CSV Injection Date: 19/11/2023 Exploit Author: BugsBD Limited Discover by: Rahad Chowdhury Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/appointment-scheduler/ Version: v3.0 Tested on: Windows 10,...