lunary 信息泄露漏洞

lunary is a production toolkit for LLM. lunary suffers from an information disclosure vulnerability that stems from inadequate validation of user permissions when joining the organization. An attacker could use this vulnerability to read and modify all data within the organization...

PT-2024-18409 · Lunary · Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary affected versions not specified Description: The issue allows a removed user to change the organization name without proper authorization due to the lack of validation to check if a user is still part of an organization befor...

CVE-2022-4965

The CVE-2022-4965 entry concerns the Invitation Code Content Restriction Plugin for WordPress by CreativeMinds. It describes a reflected Cross-Site Scripting (XSS) vulnerability via the target_id parameter present in all versions up to and including 1.5.4, caused by insufficient input sanitizatio...

CVE-2024-1412

CVE-2024-1412 concerns the WordPress Memberpress plugin. Connected sources confirm a reflected Cross‑Site Scripting (XSS) vulnerability in the plugin’s handling of the message and error parameters, affecting all versions up to 1.11.26. The vulnerability is unauthenticated and could allow an attac...

CVE-2024-2311

CVE-2024-2311 affects Avada (WordPress theme) up to version 7.11.6. The vulnerability is a Stored XSS via plugin shortcodes due to insufficient input sanitization and output escaping of user-supplied shortcode attributes. Exploitation requires contributor-level or higher authentication, and affec...

CVE-2024-2138

CVE-2024-2138 concerns the WordPress plugin JetWidgets For Elementor. The Red Hat and Wordfence entries describe a stored cross-site scripting (XSS) vulnerability in the Animated Box widget, affecting all versions up to and including 1.0.15. The issue arises from insufficient input sanitization a...

CVE-2024-2957

CVE-2024-2957 is a duplicate of CVE-2024-1983. The linked Red Hat/NVD details show Simple Ajax Chat for WordPress (before 20240223) suffers a stored XSS via the name field, reflecting unsanitized input to other users. This confirms the vulnerability context, affected component, and root cause; CV...

CVE-2024-2347

CVE-2024-2347 concerns the Astra WordPress theme. It is a Stored Cross-Site Scripting (XSS) via a user’s display name in all versions up to and including 4.6.8, caused by insufficient input sanitization and output escaping. Exploitation requires authenticated access at contributor level or higher...

CVE-2024-2341

CVE-2024-2341 refers to the WordPress plugin Appointment Booking Calendar — Simply Schedule Appointments (plugin) with SQL Injection via the keys parameter in all versions up to 1.6.7.7, allowing authenticated subscribers to append queries and potentially exfiltrate data. Red Hat and NVD entries ...

CVE-2024-1984

CVE-2024-1984 affects the WordPress Graphene theme (versions ≤ 2.9.2). The issue allows unauthenticated users to access post contents of password-protected posts via a meta tag in the page source, indicating a missing authorization check (low-severity info exposure). Reported by Krzysztof Zając a...

CVE-2024-1461

Elementor Addons by Livemesh (WordPress) contains a Stored XSS in Team Members widget via the style attribute in all versions up to 8.3.4 due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor+ access can inject scripts that execute for users visiting...

CVE-2024-1812

CVE-2024-1812 affects the Everest Forms plugin for WordPress, enabling Server-Side Request Forgery via the font_url parameter in all versions up to and including 2.0.7. This allows unauthenticated attackers to issue web requests from the vulnerable site to internal or arbitrary locations, potenti...

CVE-2024-2344

CVE-2024-2344 (Avada Theme for WordPress) : SQL Injection via the 'entry' parameter affects all versions up to 7.11.6. Root cause: insufficient escaping of user input and inadequate preparation of the existing SQL query. Exploitation requires editor-level access or higher (authenticated). Impact ...

CVE-2024-2117

CVE-2024-2117 affects Elementor Website Builder – More than Just a Page Builder (WordPress) via the Path Widget. All versions up to 3.20.2 are vulnerable due to insufficient output escaping on user-supplied attributes, enabling stored XSS. Exploitation requires an authenticated attacker with cont...

CVE-2024-2504

CVE-2024-2504 affects Page Builder: Pagelayer (WordPress plugin) up to version 1.8.4. The vulnerability is a stored XSS via the attr parameter caused by insufficient input sanitization/output escaping. Impact: authenticated users with Contributor+ can inject scripts that execute when any user loa...

CVE-2024-1424

CVE-2024-1424 affects GiveWP – Donation Plugin and Fundraising Platform for WordPress. All versions up to 3.5.1 are vulnerable to Stored Cross-Site Scripting via shortcode attributes due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-l...

CVE-2024-1587

CVE-2024-1587 affects the WordPress Newsmatic theme up to version 1.3.0. It enables Sensitive Information Exposure via the newsmatic_filter_posts_load_tab_content, allowing unauthenticated users to view draft posts and post content. The CVSS v3.1 base score is 5.3 (Medium) with network attack vec...

CVE-2024-2222

CVE-2024-2222 (Advanced Classifieds & Directory Pro for WordPress) : Vulnerability due to a missing capability check in ajax_callback_delete_attachment across all versions up to 3.0.0. This allows authenticated users with subscriber+ access to delete arbitrary media uploads, i.e., unauthorized da...

CVE-2024-2623

The CVE-2024-2623 entry concerns the WordPress plugin “Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders.” Connected sources confirm a Stored Cross-Site Scripting (XSS) vulnerability in the countdown widget’s message parameter caused by insufficient i...

CVE-2024-1999

The WordPress plugin Gutenberg Blocks by Kadence Blocks – Page Builder Features is affected by CVE-2024-1999: Stored XSS via the Testimonial Widget anchor style parameter in versions up to 3.2.25. Exploitation requires at least Contributor‑level access and can lead to stored scripts executing on ...