XootiX Plugins - Various Versions CSRF to Arbitrary Options Update

The plugins Login/Signup Popup, Side Cart Woocommerce, and Waitlist Woocommerce are all vulnerable to cross-site request forgery due to a missing nonce check that would make it possible for attackers to update arbitrary options on a vulnerable WordPress site...

XootiX Plugins - Various Versions CSRF to Arbitrary Options Update

The plugins Login/Signup Popup, Side Cart Woocommerce, and Waitlist Woocommerce are all vulnerable to cross-site request forgery due to a missing nonce check that would make it possible for attackers to update arbitrary options on a vulnerable WordPress site. PoC...

CVE-2022-21661

WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WPQuery, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. This has been patched in WordPress...

DEBIAN-CVE-2022-21661

WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WPQuery, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. This has been patched in WordPress...

WordPress < 5.8.3 - SQL Injection via WP_Query

Description Due to improper sanitization in WPQuery, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way...

[SECURITY] Fedora 34 Update: mutter-40.7-1.fc34

Mutter is a window and compositing manager that displays and manages your desktop via OpenGL. Mutter combines a sophisticated display engine using the Clutter toolkit with solid window-management logic inherited from the Metacity window manager. While Mutter can be used stand-alone, it is primari...

CVE-2021-24981

The Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP shell uploads in the wp-content/plugins directory...

CVE-2021-24981: Unrestricted Upload of File with Dangerous Type

The Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP shell uploads in the wp-content/plugins directory...

WordPress 插件代码问题漏洞

WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. WordPress Directorist plugin has a cross-site request forgery vulnerability, which stems from the fact that the WordPress...

PT-2021-16392

Name of the Vulnerable Software and Affected Versions: The Directorist WordPress plugin versions prior to 7.0.6.2 Description: The issue allows for Cross-Site Request Forgery to Remote File Upload, leading to arbitrary PHP shell uploads in the wp-content/plugins directory. This can be exploited t...

CVE-2021-40883

A Remote Code Execution RCE vulnerability exists in emlog 5.3.1 via content/plugins...

CVE-2021-40883

A Remote Code Execution RCE vulnerability exists in emlog 5.3.1 via content/plugins...

CVE-2021-40883

A Remote Code Execution RCE vulnerability exists in emlog 5.3.1 via content/plugins...

Remote code execution

A Remote Code Execution RCE vulnerability exists in emlog 5.3.1 via content/plugins...

CVE-2021-40883

A Remote Code Execution RCE vulnerability exists in emlog 5.3.1 via content/plugins...

CVE-2021-40883

CVE-2021-40883 affects emlog 5.3.1, with a Remote Code Execution via content/plugins. The root cause is described as failure to properly filter special elements when constructing code segments from external input. The connected documents provide no explicit exploit details, affected versions beyo...

PT-2021-23001

Name of the Vulnerable Software and Affected Versions emlog version 5.3.1 Description A Remote Code Execution RCE issue exists via content/plugins, allowing for potential code execution. Recommendations For emlog version 5.3.1, at the moment, there is no information about a newer version that...

CVE-2021-42547 reflected XSS in search functionality of WP Cloud Plugins - Out-of-the-Box

Insufficient Input Validation in the search functionality of Wordpress plugin Out-of-the-Box prior to 1.20.3 allows unauthenticated user to craft a reflected Cross-Site Scripting attack...

CVE-2021-42546 Reflected XSS in search functionality of WP Cloud Plugins - Use-Your-Drive

Insufficient Input Validation in the search functionality of Wordpress plugin Use-Your-Drive prior to 1.18.3 allows unauthenticated user to craft a reflected Cross-Site Scripting attack...

Sprawling Active Attack Aims to Take Over 1.6M WordPress Sites

An active attack against more than 1.6 million WordPress sites is underway, with researchers spotting tens of millions of attempts to exploit four different plugins and several Epsilon Framework themes. The goal, they said, is complete site takeover using administrative privileges. The scope of t...