1848 matches found
CVE-2024-5630: Unrestricted Upload of File with Dangerous Type
The Insert or Embed Articulate Content into WordPress plugin before 4.3000000024 does not prevent authors from uploading arbitrary files to the site, which may allow them to upload PHP shells on affected sites...
PT-2024-28616 · Hibernate · Hibernate
Name of the Vulnerable Software and Affected Versions: NHibernate versions prior to 5.4.9 NHibernate versions prior to 5.5.2 Description: A SQL injection vulnerability exists in some types implementing ILiteralType.ObjectToSQLString. This vulnerability affects callers of these methods, including...
SQL Injection
Overview NHibernate is a mature, open source object-relational mapper for the .NET framework. It is actively developed, fully featured and used in thousands of successful projects. Affected versions of this package are vulnerable to SQL Injection when passing unescaped user input to...
CVE-2024-6012: Missing Authorization
The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'embed-create-page' and 'embed-insert-pages' functions in all versions up to, and including, 3.2.12. This makes it possible for authenticated attackers, wit...
WordPress plugin Cost Calculator Builder security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
WordPress Gallery 2.3.6 Cross Site Scripting Vulnerability
Exploit Title: Wordpress Gallery Version 2.3.6 Stored XSS Exploit Author: tmrswrr Category : Webapps Vendor Homepage: https://total-soft.com/wp-video-gallery/ Version 2.3.6 Steps to Execute the Payload: 1. Access the Admin Panel: - Navigate to the admin panel of your WordPress site. - Go to TS...
Malicious code in batch-insert (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-6756 Malicious code in batch-insert (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
CVE-2024-3105
The Woody code snippets – Insert Header Footer Code, AdSense Ads plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.5.0 via the 'insertphp' shortcode. This is due to the plugin not restricting the usage of the functionality to high level authorized...
PT-2024-23740 · Unknown +1 · Adsense Ads +1
Name of the Vulnerable Software and Affected Versions: Woody code snippets – Insert Header Footer Code, AdSense Ads plugin for WordPress versions up to, and including, 2.5.0 Description: The issue allows for Remote Code Execution via the insert php shortcode due to the lack of restrictions on its...
CVE-2024-3105: Improper Control of Generation of Code
The Woody code snippets – Insert Header Footer Code, AdSense Ads plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.5.0 via the 'insertphp' shortcode. This is due to the plugin not restricting the usage of the functionality to high level authorized...
CVE-2024-36599
A cross-site scripting XSS vulnerability in Aegon Life v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter at insertClient.php...
Woody code snippets – Insert Header Footer Code, AdSense Ads < 2.5.1 -Authenticated (Contributor+) Remote Code Execution
Description The Woody code snippets – Insert Header Footer Code, AdSense Ads plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.5.0 via the 'insertphp' shortcode. This is due to the plugin not restricting the usage of the functionality to high leve...
PT-2024-27810 · Nextcloud · Nextcloud Desktop Client
Name of the Vulnerable Software and Affected Versions: Nextcloud Desktop Client versions prior to 3.12.0 Description: A code injection issue in the Nextcloud Desktop Client for macOS allows arbitrary code to be loaded when the client is started with the DYLD INSERT LIBRARIES environment variable...
CVE-2024-35665
Missing Authorization vulnerability in namithjawahar Insert Post Ads.This issue affects Insert Post Ads: from n/a through 1.3.2...
CVE-2024-35665 WordPress Insert Post Ads plugin <= 1.3.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in namithjawahar Insert Post Ads.This issue affects Insert Post Ads: from n/a through 1.3.2...
CVE-2024-35665 WordPress Insert Post Ads plugin <= 1.3.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in namithjawahar Insert Post Ads.This issue affects Insert Post Ads: from n/a through 1.3.2...
CVE-2024-35665
CVE-2024-35665: Missing Authorization in Insert Post Ads (WordPress plugin) affects version range up to 1.3.2. Public technical details are limited; the vulnerability is described as Missing Authorization with CVSS 5.3 (Network, Low complexity, None privileges, No user interaction, Integrity impa...
WordPress plugin Insert Post Ads security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability...