CVE-2024-43275

...

CVE-2024-43275

The CVE-2024-43275 entry maps to a CSRF vulnerability in the WordPress plugin “Insert PHP Code Snippet” (versions

CVE-2024-43275

...

WordPress Insert PHP Code Snippet plugin <= 1.3.6 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin Insert PHP Code Snippet versions = 1.3.6...

CVE-2024-7420

The Insert PHP Code Snippet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.6. This is due to missing or incorrect nonce validation in the /admin/snippets.php file. This makes it possible for unauthenticated attackers to activate/deactiva...

CVE-2024-7094

The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to PHP Code Injection leading to Remote Code Execution in all versions up to, and including, 2.8.6 via the 'storeTheme' function. This is due to a lack of sanitization on user-supplied values, which...

CVE-2024-7094 JS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.6 - Unauthenticated PHP Code Injection to Remote Code Execution

The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to PHP Code Injection leading to Remote Code Execution in all versions up to, and including, 2.8.6 via the 'storeTheme' function. This is due to a lack of sanitization on user-supplied values, which...

CVE-2024-7094

The CVE-2024-7094 issue affects the WordPress plugin JS Help Desk (JS Help Desk – The Ultimate Help Desk & Support Plugin). It enables PHP code injection leading to remote code execution due to unsanitized user input in storeTheme and missing capability checks, allowing unauthenticated code execu...

CVE-2024-7094 JS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.6 - Unauthenticated PHP Code Injection to Remote Code Execution

The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to PHP Code Injection leading to Remote Code Execution in all versions up to, and including, 2.8.6 via the 'storeTheme' function. This is due to a lack of sanitization on user-supplied values, which...

CVE-2024-5709

The WPBakery Visual Composer plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.7 via the 'layoutname' parameter. This makes it possible for authenticated attackers, with Author-level access and above, and with post permissions granted by an...

CVE-2024-6589

The CVE-2024-6589 entry concerns LearnPress – WordPress LMS Plugin (versions

CVE-2024-6589 LearnPress <= 4.2.6.8.2 - Authenticated (Contributor+) Local File Inclusion

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.6.8.2 via the 'rendercontentblocktemplate' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to include a...

CVE-2024-6589 LearnPress <= 4.2.6.8.2 - Authenticated (Contributor+) Local File Inclusion

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.6.8.2 via the 'rendercontentblocktemplate' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to include a...

CVE-2024-6164

The Filter & Grids WordPress plugin before 2.8.33 is vulnerable to Local File Inclusion via the postlayout parameter. This makes it possible for an unauthenticated attacker to include and execute PHP files on the server, allowing the execution of any PHP code in those files...

CVE-2024-6164

CVE-2024-6164 affects the WordPress plugin “Filter & Grids” (ymc-smart-filter). The vulnerability is a Local File Inclusion via the post_layout parameter, allowing an unauthenticated attacker to include and execute PHP code on the server. This directly enables arbitrary PHP execution through the ...

CVE-2024-6467

The BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin plugin for WordPress is vulnerable to Arbitrary File Read to Arbitrary File Creation in all versions up to, and including, 1.1.5 via the 'bookingpresssavelitewizardsettingsfunc' function. This makes it possible fo...

CVE-2024-6467

BookingPress (Appointment Booking Calendar & Scheduling plugin for WordPress) is affected by CVE-2024-6467 and related disclosures. The vulnerability stems from the function bookingpress_save_lite_wizard_settings_func() which saves wizard settings without proper capability checks, and with a publ...

PT-2024-37649 · WordPress · Bookingpress

Name of the Vulnerable Software and Affected Versions: The BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin versions up to, and including, 1.1.5 Description: The issue allows authenticated attackers with Subscriber-level access and above to create arbitrary files...

CVE-2024-40624 Deserialization of untrusted data in torrentpier/torrentpier

TorrentPier is an open source BitTorrent Public/Private tracker engine, written in php. In torrentpier/library/includes/functions.php, gettracks uses the unsafe native PHP serialization format to deserialize user-controlled cookies. One can use phpggc and the chain Guzzle/FW1 to write PHP code to...

File Upload Vulnerability in YouDianCMS (CNVD-2024-34730)

YouDianCMS is a domestic open source five-station outstanding solution. YouDianCMS has a file upload vulnerability that can be exploited by attackers to execute malicious php code to achieve remote code execution...