PT-2024-17608 · WordPress · Wp Base Booking Of Appointments

Name of the Vulnerable Software and Affected Versions: WP BASE Booking of Appointments, Services and Events plugin for WordPress versions up to, and including, 4.9.1 Description: The issue is related to Reflected Cross-Site Scripting via the status parameter due to insufficient input sanitization...

PT-2024-16881 · WordPress · Ppwp – Password Protect Pages

Name of the Vulnerable Software and Affected Versions: PPWP – Password Protect Pages plugin for WordPress versions up to, and including, 1.9.5 Description: The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Sensitive Information Exposure via the WordPress core search feature...

PT-2024-10439 · Ibm · Ibm Fusion Hci +1

Name of the Vulnerable Software and Affected Versions: IBM Fusion and IBM Fusion HCI versions 2.3.0 through 2.8.2 Description: The issue is related to insufficient restriction of the communication channel for given endpoints, which may allow an attacker to gain unauthorized access to protected...

PT-2024-28642 · Threatquotient · Threatq

Name of the Vulnerable Software and Affected Versions: ThreatQuotient ThreatQ versions prior to 5.29.3 Description: The issue allows authenticated users to execute arbitrary commands by sending a crafted request to an API endpoint. Recommendations: For versions prior to 5.29.3, update to version...

The vulnerability of the CLI command-line interface of the GitHub collaborative development platform involves an incorrect restriction on the path name to the restricted directory. This allows a malicious user to gain read, modify, or delete access to files.

The vulnerability of the CLI command-line interface of the GitHub collaborative development platform relates to incorrect path name restrictions for restricted directories when processing the artifact name and the --dir flag. Exploiting this vulnerability may allow a malicious actor to gain read,...

WordPress Memberful plugin <= 1.73.9 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure vulnerability

Unauthenticated Content Restriction Bypass to Sensitive Information Exposure vulnerability discovered by Francesco Carlucci in WordPress Plugin Memberful - Membership Plugin versions = 1.73.9...

PT-2024-36303 · WordPress · Wp-Hidethat

Name of the Vulnerable Software and Affected Versions: WP-HideThat versions 1.2 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application, potentiall...

PT-2024-36247 · Gutensee · Gutensee

Name of the Vulnerable Software and Affected Versions: Gutensee versions prior to 1.0.1 Description: The issue is related to improper neutralization of input during web page generation, which allows for DOM-Based XSS. This means that an attacker could potentially inject malicious scripts into the...

PT-2024-36633 · Unknown · Webriderz Wr Age Verification

Name of the Vulnerable Software and Affected Versions: Webriderz Wr Age Verification versions n/a through 2.0.0 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection, potentially...

PT-2024-36296 · Unknown · Xpd Reduce Image Filesize

Name of the Vulnerable Software and Affected Versions: XPD Reduce Image Filesize versions n/a through 1.0 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a we...

PT-2024-27744 · Sunbird Dcim · Dctrack

Name of the Vulnerable Software and Affected Versions: Sunbird DCIM dcTrack version 9.1.2 Description: A Cross-Site Request Forgery CSRF issue allows authenticated attackers to escalate their privileges by forcing an Administrator user to perform sensitive requests in some admin screens. This can...

The vulnerability of Ollama’s system for running and managing large language models lies in the improper restriction on the path name to the restricted-access catalog, which allows a violator to trigger a service failure.

The vulnerability of the Ollama system for running and managing large language models is related to an incorrect restriction on the path name to the restricted-access catalog. Exploiting this vulnerability could allow a malicious actor to trigger a service failure...

PT-2024-36254 · Gitsync · Gitsync

Name of the Vulnerable Software and Affected Versions: GitSync versions n/a through 1.1.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Code Injection. This means an attacker can trick a user into performing unintended actions on a web application,...

PT-2024-17232 · WordPress · Eveeno

Name of the Vulnerable Software and Affected Versions: Eveeno plugin for WordPress versions up to, and including, 1.7 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'eveeno' shortcode due to insufficient input sanitization and output escaping on user-supplied...

PT-2024-17628 · WordPress · Simple Locator

Name of the Vulnerable Software and Affected Versions: The Simple Locator plugin for WordPress versions up to, and including, 2.0.3 Description: The issue is related to Stored Cross-Site Scripting via the plugin's shortcodes due to insufficient input sanitization and output escaping on...

PT-2024-12457 · WordPress · Easy Social Icons

Name of the Vulnerable Software and Affected Versions: Easy Social Icons versions 3.2.4 and earlier Description: A broken access control vulnerability has been identified in the Easy Social Icons plugin for WordPress. This issue allows exploiting incorrectly configured access control security...

PT-2024-36229 · Fahad Mahmood · Wp Quick Shop

Name of the Vulnerable Software and Affected Versions: WP Quick Shop versions through 1.3.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS. A Cross-site Scripting XSS vulnerability...

PT-2024-36109 · Unknown · Ni Woocommerce Order Export

Name of the Vulnerable Software and Affected Versions: Ni WooCommerce Order Export versions 3.1.6 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential...

PT-2024-36227 · Woocommerce · Staggs Product Configurator For Woocommerce

Name of the Vulnerable Software and Affected Versions: Staggs Product Configurator for WooCommerce versions through 2.0.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS attacks...

PT-2024-36231 · Skt Themes · Skt Themes Barter

Name of the Vulnerable Software and Affected Versions: SKT Themes Barter versions 1.6 and below Description: The issue is related to improper neutralization of input during web page generation, which leads to a Cross-site Scripting XSS vulnerability, specifically DOM-Based XSS. This problem occur...