MAL-2024-9337 Malicious code in ava-ilable-down-load-mp3-today-50529-lets-change-the-world-with-music-cx2zi-xhskuv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware df195ac8737511909f9fe9908cbb3c0cc9287f38837903e901667ca3ac686141 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9380 Malicious code in mp3-do-wnload-file-to-day-47472-adjagas-e6r7u-jlkfci (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7c467aec4617e45121229623cb63b6621f1fe65809376476bb631270a90567da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9383 Malicious code in mp3-file-zip-d-ownload-7517-goodbye-yellow-brick-road-h63vl-tpdnhx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8ce58c2ac7b1825c26b2656020f588d8a223c04953287197e776979cc4f4f6ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9328 Malicious code in alb-um-availa-ble-zip-mp3-file-30506-i-feel-alright-898re-atdkuh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 301aedb3c629f2045611e487e9d753ff50c0a6fc1da4ee93c01ab32ee0cff0a7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9400 Malicious code in zip-mp3-a-lbum-do-wnload-new-gift-of-screws-q2h3s-xswcix (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c826accfd7196480d4adb24ef7362a9ac257c5a2b760e84f936624e6147e724 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9327 Malicious code in alb-um-availa-ble-zip-mp3-file-20395-ive-been-expecting-you-m3mwh-apmisl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 22fc68d2042156469205e75f4a654f8557c933212d8ff61b7068167cfd7b344f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9329 Malicious code in alb-um-availa-ble-zip-mp3-file-38068-its-all-about-to-change-rnonb-pzjjbh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4008f42b5bc2b6647cc2d9e297edb68f60da9ce6c5a20e62b44cb70616a8a6d8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9331 Malicious code in alb-um-availa-ble-zip-mp3-file-85058-bright-phoebus-dboqy-oraqvx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7896431589d1851d65f8365d770dff71aa63f823917838fd5734b3ee77fe7f32 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Exploit for Missing Authorization in Sonaar Mp3_Audio_Player_For_Music\,_Radio_\&_Podcast

CVE-2024-7856 ★ CVE-2024-7856 Arbitrary File deletion PoC ★...

Critical Arbitrary File Deletion Vulnerability in MP3 Audio Player WordPress Plugin Affects Over 20,000 Sites

📢 Did you know Wordfence runs aBug Bounty Program for all WordPress plugin and themes at no cost to vendors? Through October 7th, 2024, XSS vulnerabilities in all plugins and themes with =1,000 Active Installs are in scope for all researchers. In addition, through October 14th, 2024 , r esearcher...

CVE-2024-7856

The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the removeTempFiles function and insufficient path validation on the 'file' parameter in all versions up to, and...

CVE-2024-7856 MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.7.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion

The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the removeTempFiles function and insufficient path validation on the 'file' parameter in all versions up to, and...

WordPress MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin <= 5.7.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary File Deletion vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin MP3 Audio Player for Music, Radio & Podcast by Sonaar versions = 5.7.0.1...

WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar Plugin <= 5.7.0.1 is vulnerable to Arbitrary File Deletion

Software MP3 Audio Player for Music, Radio & Podcast by Sonaar Type Plugin Vulnerable versions = 5.7.0.1 Fixed in 5.7.1 OWASP Top 10 A5: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2024-7856 Patch priority High CVSS severity High 8.6 Developer Claim ownership PSID...

CVE-2024-5664

The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute within the plugin's sonaaraudioplayer shortcode in all versions up to, and including, 5.5 due to insufficient input sanitization and outpu...

CVE-2024-5664

The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute within the plugin's sonaaraudioplayer shortcode in all versions up to, and including, 5.5 due to insufficient input sanitization and outpu...

CVE-2024-5664 MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer Shortcode

The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute within the plugin's sonaaraudioplayer shortcode in all versions up to, and including, 5.5 due to insufficient input sanitization and outpu...

CVE-2024-5664

CVE-2024-5664 affects the MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar WordPress plugin. It allows Stored XSS via the id attribute in the sonaar_audioplayer shortcode in all versions up to 5.5 due to insufficient input sanitization/output escaping. Exploitation requires authe...

CVE-2024-5664 MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer Shortcode

The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute within the plugin's sonaaraudioplayer shortcode in all versions up to, and including, 5.5 due to insufficient input sanitization and outpu...

WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar Plugin <= 5.5 is vulnerable to Cross Site Scripting (XSS)

Software MP3 Audio Player for Music, Radio & Podcast by Sonaar Type Plugin Vulnerable versions = 5.5 Fixed in 5.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5664 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 61d58242086...