CVE-2023-48285

CVE-2023-48285 affects the WordPress plugin Accept Stripe Payments (Stripe Payments) up to version 2.0.79. Root cause: improper neutralization of script-related HTML tags causing content injection (XSS) leading to potential code injection. Affected users could craft unauthenticated content inject...

CVE-2023-48271

CVE-2023-48271 affects WordPress Maspik – Spam Blacklist plugin (legacy

CVE-2023-47837

CVE-2023-47837 . Affected: WordPress ARMember plugin versions up to and including 4.0.10. Issue: Improper Privilege Management allowing Privilege Escalation for subscribers with low privileges. Root cause and impact as described in connected sources align on a membership plan bypass vulnerability...

CVE-2023-47663

CVE-2023-47663 affects the WordPress plugin Foyer (WordPress plugin: Foyer – Digital Signage for WordPress). The issue is Improper Neutralization of Script-Related HTML Tags, resulting in Content Injection (basic XSS). Affected versions are Foyer up to 1.7.5. The vulnerability requires at least C...

CVE-2023-47513

The CVE-2023-47513 entry concerns ARI Stream Quiz for WordPress (ARI Stream Quiz plugin). Affected software: ARI Stream Quiz versions up to and including 1.3.2. Root cause: Improper handling/neutralization of script-related HTML tags enabling content injection (Basic XSS). Impact: potential code ...

CVE-2024-5463

CVE-2024-5463 describes a buffer copy without input size checking (Classic Buffer Overflow) in the login component of Synology Camera Firmware. Affected: Synology Camera Firmware prior to 1.1.1-0383, specifically BC500 and TC500 models. Impact is limited to the login service, which may crash and ...

CVE-2024-4637

Slider Revolution for WordPress (revslider) versions up to and including 6.7.10 are affected by a stored XSS due to insufficient input sanitization and output escaping on Elementor wrapperid and zindex attributes. Exploitation requires authenticated access (Contributor+). Patch/mitigation exists ...

CVE-2023-47189

CVE-2023-47189 affects WordPress Defender Security plugin versions

CVE-2023-46630

CVE-2023-46630 affects WordPress Admin and Site Enhancements (ASE) plugin versions up to 5.7.1. The issue is an unauthenticated bypass of Password Protection Mode due to a flawed authentication flow (reported as bypass via the maybe_process_login path), allowing access to password-protected conte...

CVE-2023-46310

CVE-2023-46310 describes a Content Injection vulnerability in the WordPress plugin wpDiscuz (gVectors Team) affecting versions up to 7.6.10. The issue is due to improper neutralization of script-related HTML tags, enabling code injection via wpDiscuz content. Public sources in the connected docum...

CVE-2023-45009

CVE-2023-45009 is a CAPTCHA/Honeypot plugin vulnerability for WordPress Contact Form 7 (Captcha/Honeypot for Contact Form 7 by Forge12 Interactive GmbH). It allows bypass of authentication-related checks due to improper restriction of excessive authentication attempts in versions up to 1.11.3. Pu...

CVE-2023-5751

CVE-2023-5751 is described across multiple connected sources as affecting the CODESYS development system, with a local attacker of low privileges able to read and modify any user files and trigger a DoS in the working directory due to exposure of a resource to the wrong security sphere. The root ...

CVE-2024-4581

CVE-2024-4581 affects the Slider Revolution WordPress plugin (versions up to and including 6.7.11). The vulnerability is a Stored XSS in the Add Layer widget caused by insufficient input sanitization and output escaping for user-supplied class, id, and title attributes. Exploitation requires an A...

CVE-2024-5422

SEH Computertechnik UTN Server PRO, UTN Server PROMAX, and INU-100 (v20.1.22 and earlier) are vulnerable to a DoS via HTTP due to uncontrolled resource consumption of file descriptors. Affected components: utnserver Pro/ProMAX/INU-100; CVE-2024-5422. Impact: availability degradation. Fixed versio...

CVE-2024-5421

CVE-2024-5421 affects SEH utnserver Pro/ProMAX/INU-100 (version 20.1.22 and earlier). Root cause: missing input validation and OS command integration in the web interface, enabling authenticated command injection. Impact: high. Remediation: update to a newer version (e.g., later than 20.1.22; som...

CVE-2024-5420

SEH utnserver Pro/ProMAX/INU-100 are affected by CVE-2024-5420 due to missing input validation in the web interface, enabling stored XSS in the device description field. The flaw affects versions including 20.1.22 and earlier; multiple sources indicate remediation via upgrading to a newer 20.1.x ...

CVE-2023-44235

CVE-2023-44235 (WP Captcha) is a vulnerability in the WordPress WP Captcha plugin (affected:

CVE-2024-4253

CVE-2024-4253 is a command injection vulnerability in the gradio-app/gradio repository, present in the test-functional.yml workflow. The issue stems from improper neutralization of special elements in a command, enabling potential modification of the base repository or exfiltration of secrets (e....

CVE-2024-36104

CVE-2024-36104 is a path traversal vulnerability in Apache OFBiz prior to 18.12.14 that can lead to remote code execution. The connected documents confirm the affected product (Apache OFBiz), vulnerable component/path handling, and the root cause is improper restriction of a pathname to a restric...

CVE-2023-40673

CVE-2023-40673 : WordPress plugin Cartpauj Register Captcha contains an improper control of interaction frequency that allows a bypass vulnerability in versions ≤ 1.0.02. The issue enables unauthenticated users to misuse the captcha functionality, described as a bypass vulnerability with low seve...