CVE-2024-1109

The Podlove Podcast Publisher plugin for WordPress (versions ≤ 4.0.11) has a vulnerability caused by a missing capability check in the init_download() and init() functions, allowing unauthenticated attackers to export the plugin’s tracking data and podcast information. The issue is tied to Broken...

CVE-2024-1118

CVE-2024-1118 affects the Podlove Subscribe button plugin for WordPress. The vulnerability is a UNION-based SQL Injection in the podlove-subscribe-button shortcode's button parameter, present in all versions up to 1.3.10 due to insufficient escaping and inadequate query preparation. An authentica...

CVE-2024-1110

The Podlove Podcast Publisher plugin for WordPress (up to and including version 4.0.11) is vulnerable to unauthorized data modification due to a missing capability check on init(). This enables unauthenticated attackers to import or modify the plugin’s settings. The issue is triggered across all ...

Sql injection

SQL Injection vulnerability in HiPresta "Gift Wrapping Pro" hiadvancedgiftwrapping module for PrestaShop before version 1.4.1, allows remote attackers to escalate privileges and obtain sensitive information via the HiAdvancedGiftWrappingGiftWrappingModuleFrontController::addGiftWrappingCartValue...

Path traversal

Path Traversal vulnerability in Linea Grafica "Multilingual and Multistore Sitemap Pro - SEO" lgsitemaps module for PrestaShop before version 1.6.6, a guest can download personal information without restriction...

Sql injection

SQL Injection vulnerability in RM bookingcalendar module for PrestaShop versions 2.7.9 and before, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via icsexport.php...

CVE-2024-0977

The CVE-2024-0977 entry concerns Timeline Widget For Elementor (WordPress) up to version 1.5.3, which is vulnerable to stored XSS via image URLs due to insufficient input sanitization and output escaping. Exploitation requires authenticated access (Contributor+). The issue is mitigated by upgradi...

Cross site scripting

The All-In-One Security AIOS – Security and Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 5.2.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2024-0628

CVE-2024-0628 affects the WordPress WP RSS Aggregator plugin. The vulnerability is a Server-Side Request Forgery (SSRF) in all versions up to and including 4.23.5, exploitable by authenticated attackers with administrator-level access to issue web requests from the application (via the RSS feed s...

CVE-2024-1037

The CVE-2024-1037 entry concerns All-In-One Security (AIOS) for WordPress, affecting versions up to 5.2.5. The vulnerability is a Reflected Cross-Site Scripting via the tab parameter caused by insufficient input sanitization and output escaping, enabling unauthenticated attackers to inject web sc...

CVE-2024-1055

PowerPack Addons for Elementor (PowerPack Lite for Elementor) is affected by a stored cross-site scripting (XSS) vulnerability in versions up to and including 2.7.14. The issue stems from insufficient input sanitization and output escaping on user-supplied URL values, allowing authenticated attac...

CVE-2024-0256

CVE-2024-0256 concerns the Starbox WordPress plugin. The vulnerability is a Stored Cross-Site Scripting (XSS) via Profile Display Name and Social Settings in all versions up to 3.4.8, caused by insufficient input sanitization and output escaping. It requires authenticated access at subscriber lev...

CVE-2024-23447

The CVE-2024-23447 entry relates to Elastic Network Drive Connector and the Windows Network Drive Connector, where a misconfiguration of Document Level Security (explicit allow write and deny read) allows a user to see a document in search results even though it is not accessible in the network d...

CVE-2024-23446

CVE-2024-23446 pertains to Kibana’s Detection Engine Search API failing to enforce Document-level security (DLS) and Field-level security (FLS) on .alerts-security.alerts-{space_id} indices. The issue allows users with API access and DLS/FLS-enabled roles to potentially read unauthorized document...

Code injection

Leanote version 2.7.0 allows obtaining arbitrary local files. This is possible because the application is vulnerable to LFR...

CVE-2023-6388

SuiteCRM 7.14.2 is affected by an SSRF vulnerability that allows an attacker to make arbitrary HTTP requests through the vulnerable server. Root cause: SSRF in the application; impact is the ability to trigger outbound requests via the server. Remediation: upgrade to a version that fixes the SSRF...

CVE-2024-1268

CVE-2024-1268 concerns CodeAstro Restaurant POS System 1.0. The vulnerability affects an unknown part of the file update_product.php, enabling an unrestricted upload that could be triggered remotely. Multiple sources (NVD, Red Hat, CVE listings, PRION) describe it as a critical issue with potenti...

Cross site scripting

A vulnerability, which was classified as problematic, has been found in CodeAstro Restaurant POS System 1.0. Affected by this issue is some unknown functionality of the file createaccount.php. The manipulation of the argument Full Name leads to cross site scripting. The attack may be launched...

Sql injection

A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass in crafted offset, limit, and sort parameters to perform SQL injection via /system/roleDataPerm/list...

Cross site scripting

A vulnerability classified as problematic was found in CodeAstro University Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /streg.php of the component Student Registration Form. The manipulation of the argument Address leads to cross site scripting...