231580 matches found
CVE-2024-28675
DedeCMS v5.7 is affected by a Cross-Site Request Forgery (CSRF) vulnerability exposed via the /dede/diy_edit.php endpoint. The CVE describes CSRF with high impact potential (C, I, A HIGH; CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No exploit details are provided in the primary documents; exp...
CVE-2024-28677
DedeCMS v5.7 contains a Cross-Site Request Forgery (CSRF) vulnerability via the /dede/article_keywords_main.php endpoint. Multiple sources (NVD/Red Hat/CNNVD/CVE listings, OpenVAS notes) corroborate a CSRF issue affecting DedeCMS 5.7; no explicit exploit details or fixed version are provided in t...
CVE-2024-1326
CVE-2024-1326 : Jeg Elementor Kit for WordPress is vulnerable to Stored Cross-Site Scripting via HTML tag attributes in versions up to 2.6.2 due to insufficient input sanitization/output escaping. Authentication at contributor level or higher is required to inject scripts, which may execute for u...
CVE-2023-6500
The CVE-2023-6500 entry refers to the Shariff Wrapper WordPress plugin vulnerable to a Stored Cross-Site Scripting (XSS) via the shariff shortcode in all versions up to and including 4.6.9. The root cause is insufficient input sanitization and output escaping on user-supplied attributes (e.g., se...
CVE-2024-1278
CVE-2024-1278 affects the WordPress plugin “Easy Social Feed – Social Photos Gallery – Post Feed – Like Box.” The vulnerability is Stored XSS through the plugin’s shortcodes, specifically the efb_likebox shortcode, in all versions up to 6.5.4. The root cause is insufficient input sanitization and...
CVE-2024-0966
CVE-2024-0966 : The Shariff Wrapper WordPress plugin is vulnerable to Stored XSS via the plugin’s shariff shortcode in versions up to and including 4.6.9 due to insufficient input sanitization and output escaping on user-supplied attributes (e.g., info_text). This allows authenticated attackers w...
CVE-2024-1502
CVE-2024-1502 affects Tutor LMS – eLearning and online course solution for WordPress. The vulnerability is caused by a missing capability check in the function tutor_delete_announcement(), impacting all versions up to and including 2.6.1. This allows authenticated attackers with subscriber-level ...
CVE-2024-1503
CVE-2024-1503 affects Tutor LMS – eLearning and online course solution (WordPress) up to version 2.6.1. Root cause: missing/incorrect nonce validation in erase_tutor_data(), enabling CSRF. Impact: unauthenticated attackers can deactivate the plugin and erase data via forged requests if the "Erase...
CVE-2024-1450
The CVE-2024-1450 entry concerns the Shariff Wrapper WordPress plugin. It is vulnerable to a Stored XSS via the plugin shortcode shariff in all versions up to and including 4.6.10 due to insufficient input sanitization and output escaping on user-supplied attributes (e.g., align). Exploitation re...
Default credentials
The Post Grid Combo – 36+ Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.68 via the 'getposts' REST API Endpoint. This makes it possible for unauthenticated attackers to extract sensitive data including full draft...
CVE-2024-1421
CVE-2024-1421: HT Mega – Absolute Addons For Elementor stores XSS via the Post Carousel border_type in all versions
CVE-2024-1397
CVE-2024-1397 concerns the HT Mega – Absolute Addons For Elementor WordPress plugin. The vulnerability is a Stored Cross-Site Scripting (XSS) in the plugin blocks via the titleTag attributes supplied by users, caused by insufficient input sanitization and output escaping. Affected versions are up...
Sql injection
Code-projects Scholars Tracking System 1.0 is vulnerable to SQL Injection under Eligibility Information Update...
Null pointer dereference
Null Pointer Dereference in maskcidr6 component at cidr.c in Tcpreplay 4.4.4 allows attackers to crash the application via crafted tcprewrite command...
CVE-2024-2107
CVE-2024-2107 affects the Blossom Spa WordPress theme (versions up to 1.3.4). The vulnerability enables sensitive information exposure via generated source, allowing unauthenticated attackers to retrieve contents of password-protected or scheduled posts. The connected Red Hat advisory reiterates ...
CVE-2024-2395
CVE-2024-2395 : Bulgarisation for WooCommerce (WordPress) is affected by a CSRF vulnerability due to missing/incorrect nonce validation in multiple functions, enabling unauthenticated attackers to forge requests to generate/delete labels if a site admin is induced to click a link. This vulnerabil...
Sql injection
SQL Injection vulnerability in Code-projects.org Scholars Tracking System 1.0 allows attackers to run arbitrary code via login.php...
Cross site scripting
Cross Site Scripting XSS vulnerability in Code-Projects Exam Form Submission 1.0 allows attackers to run arbitrary code via "Subject Name" and "Subject Code" section...
Cross site scripting
Cross Site Scripting vulnerability in My Food Recipe Using PHP with Source Code v.1.0 allows a local attacker to execute arbitrary code via a crafted payload to the Recipe Name, Procedure, and ingredients parameters...