CVE-2024-34701 CreateWiki vulnerable to impersonation of wiki requester

CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. It is possible for users to be considered as the requester of a specific wiki request if their local user ID on any wiki in a wiki farm matches the local ID of the requester at the wiki where the wiki request was made...

mw-v.nl Improper Access Control vulnerability OBB-3923175

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WordPress MW WP Form Plugin <= 5.0.6 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:web-soudan:mwwpform"; if description...

PT-2024-20620 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel affected versions not specified Description: The issue arises in the malidp mw connector reset function where new memory is allocated using kzalloc, but no check is performed to prevent null pointer dereferencing. To prevent this...

CVE-2024-24804

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in websoudan MW WP Form allows Stored XSS.This issue affects MW WP Form: from n/a through 5.0.6...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in websoudan MW WP Form allows Stored XSS.This issue affects MW WP Form: from n/a through 5.0.6...

CVE-2024-24804 WordPress MW WP Form Plugin <= 5.0.6 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in websoudan MW WP Form allows Stored XSS.This issue affects MW WP Form: from n/a through 5.0.6...

CVE-2024-24804 WordPress MW WP Form Plugin <= 5.0.6 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in websoudan MW WP Form allows Stored XSS.This issue affects MW WP Form: from n/a through 5.0.6...

CVE-2024-24804

CVE-2024-24804 affects MW WP Form (WordPress). The vulnerability is a Stored XSS due to improper input neutralization during web page generation, impacting MW WP Form versions up to 5.0.6. Remediation: upgrade to MW WP Form 5.1.0 (per Patchstack) to address the issue. Exploitation status is not p...

WordPress Plugin MW WP Form Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

MW WP Form < 5.1.0 - Editor+ Stored XSS

Description The plugin is vulnerable to Stored Cross-Site Scripting in versions up to due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access and above, to inject arbitrary web scripts in pages that will execute...

WordPress MW WP Form Plugin <= 5.0.6 is vulnerable to Cross Site Scripting (XSS)

Software MW WP Form Type Plugin Vulnerable versions = 5.0.6 Fixed in 5.1.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-24804 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID a4c6865d5010 Credits Huynh Tien Si Required privilege Editor...

$1,275 Bounty Awarded For Arbitrary File Deletion Vulnerability Patched in MW WP Form WordPress Plugin

Did you know were running a Bug Bounty Extravaganza again? Earn over 6x our usual bounty rates, up to $10,000, for all vulnerabilities submitted through February 29th, 2024 when you opt to have Wordfence handle responsible disclosure! On December 5th, 2023, shortly after the launch of our Holiday...

CVE-2023-6316

The MW WP Form WordPress plugin is affected up to version 5.0.1, with insufficient file-type validation in the _single_file_upload function allowing unauthenticated uploads of arbitrary files and potentially remote code execution. Public sources consistently identify this vulnerability in MW WP F...

Malicious code in mw-common-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ab85f947099773c7e6dd5b4c3abd115db9beee7e407c87916ef282f8992ac845 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-27 Malicious code in mw-common-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ab85f947099773c7e6dd5b4c3abd115db9beee7e407c87916ef282f8992ac845 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the _single_file Upload() function in the MW WP Form plugin for WordPress content management system allows a hacker to upload arbitrary files and execute arbitrary code.

The vulnerability of the singlefile Upload function in the MW WP Form plugin for WordPress content management system involves unlimited uploading of dangerous types of files. Exploiting this vulnerability could allow a malicious actor to upload arbitrary files and execute arbitrary code...

MW WP Form < 5.0.4 - Improper Limitation of File Name to Unauthenticated Arbitrary File Deletion

Description The MW WP Form plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 5.0.3. This is due to the plugin not properly validating the path of an uploaded file prior to deleting it. This makes it possible for unauthenticated attackers to delete...

CVE-2023-6559

The MW WP Form plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 5.0.3. This is due to the plugin not properly validating the path of an uploaded file prior to deleting it. This makes it possible for unauthenticated attackers to delete arbitrary...

Arbitrary file deletion

The MW WP Form plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 5.0.3. This is due to the plugin not properly validating the path of an uploaded file prior to deleting it. This makes it possible for unauthenticated attackers to delete arbitrary...