PT-2023-24095 · WordPress · Grid-Kit-Premium

Name of the Vulnerable Software and Affected Versions: grid-kit-premium WordPress plugin versions prior to 2.2.0 Description: The issue concerns Reflected Cross-Site Scripting, where some parameters and generated URLs are not properly escaped before being outputted in attributes. This could be...

Jupiter X Core <= 2.5.0 - Unauthenticated Arbitrary File Download

Description The plugin does not have authorisation checks and does not validate file paths in the handlefiledownload function, allowing unauthenticated users to download arbitrary files from the server when the premium version of the plugin is activated...

CVE-2023-3813

The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file downloads in versions up to, and including, 4.6.6. This makes it possible for unauthenticated attackers to download the contents of arbitrary files on the server, which can contain sensitive information. The requires the...

CVE-2023-3813

The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file downloads in versions up to, and including, 2.5.0. This makes it possible for unauthenticated attackers to download the contents of arbitrary files on the server, which can contain sensitive information. The requires the...

PT-2023-26314 · WordPress · Jupiter X Core

Name of the Vulnerable Software and Affected Versions: Jupiter X Core plugin for WordPress versions up to, and including, 2.5.0 Description: The issue allows unauthenticated attackers to download the contents of arbitrary files on the server, which can contain sensitive information. This requires...

CVE-2023-37600

Office Suite Premium Version v10.9.1.42602 was discovered to contain a reflected cross-site scripting XSS vulnerability via the id parameter at /api?path=profile...

CVE-2023-37600

Office Suite Premium Version v10.9.1.42602 was discovered to contain a reflected cross-site scripting XSS vulnerability via the id parameter at /api?path=profile...

CVE-2023-38617

Office Suite Premium Version v10.9.1.42602 was discovered to contain a reflected cross-site scripting XSS vulnerability via the filter parameter at /api?path=files...

CVE-2023-38617

Office Suite Premium Version v10.9.1.42602 was discovered to contain a reflected cross-site scripting XSS vulnerability via the filter parameter at /api?path=files...

CVE-2023-37601

Office Suite Premium v10.9.1.42602 was discovered to contain a local file inclusion LFI vulnerability via the component /etc/hosts...

CVE-2023-37600

Office Suite Premium Version v10.9.1.42602 was discovered to contain a reflected cross-site scripting XSS vulnerability via the id parameter at /api?path=profile...

CVE-2023-38617

Office Suite Premium Version v10.9.1.42602 was discovered to contain a reflected cross-site scripting XSS vulnerability via the filter parameter at /api?path=files...

CVE-2023-37601

Office Suite Premium v10.9.1.42602 was discovered to contain a local file inclusion LFI vulnerability via the component /etc/hosts...

Cross site scripting

Office Suite Premium Version v10.9.1.42602 was discovered to contain a reflected cross-site scripting XSS vulnerability via the filter parameter at /api?path=files...

Design/Logic Flaw

Office Suite Premium v10.9.1.42602 was discovered to contain a local file inclusion LFI vulnerability via the component /etc/hosts...

Cross site scripting

Office Suite Premium Version v10.9.1.42602 was discovered to contain a reflected cross-site scripting XSS vulnerability via the id parameter at /api?path=profile...

CVE-2023-3779 Essential Addons For Elementor <=5.8.1 - Unauthenticated MailChimp API Key Disclosure

The Essential Addons For Elementor plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 5.8.1 due to the plugin adding the API key to the source code of any page running the MailChimp block. This makes it possible for unauthenticated attackers...

CVE-2023-3779

The Essential Addons For Elementor plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 5.8.1 due to the plugin adding the API key to the source code of any page running the MailChimp block. This makes it possible for unauthenticated attackers...

MobiSystems Office Suite Premium 跨站脚本漏洞

MobiSystems Office Suite Premium is an office software suite from MobiSystems. A security vulnerability exists in Office Suite Premium version 10.9.1.42602, which stems from a reflected cross-site scripting XSS vulnerability in parameter id...

PT-2023-26038 · Unknown · Office Suite Premium

Name of the Vulnerable Software and Affected Versions: Office Suite Premium Version v10.9.1.42602 Description: A reflected cross-site scripting XSS issue was found, which can be exploited via the id parameter at the "/api?path=profile" API endpoint. Recommendations: For Office Suite Premium Versi...