WordPress HD Quiz – Save Results Light Plugin <= 0.5 is vulnerable to Broken Access Control

Software HD Quiz – Save Results Light Type Plugin Vulnerable versions = 0.5 Fixed in 0.6 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-49689 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 904268a13b03 Credits Fariq Fadillah Gusti...

CVE-2024-47634: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Streamline CartBounty – Save and recover abandoned carts for WooCommerce woo-save-abandoned-carts allows Cross Site Request Forgery.This issue affects CartBounty – Save and recover abandoned carts for WooCommerce: from n/a through = 8.2...

CVE-2024-9361

The Bulk images optimizer: Resize, optimize, convert to webp, rename … plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'saveconfiguration' function in all versions up to, and including, 2.0.1. This makes it possible for authenticate...

WordPress plugin Bulk images optimizer 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Tenda AC8 安全漏洞

Tenda AC8 is a wireless router from Tenda China. A security vulnerability exists in Tenda AC8 version 16.03.34.06, which originates from a stack-based buffer overflow due to the parameter time in the function compareparentcontroltime in file /goform/saveParentControlInfo...

PT-2024-39595 · WordPress · Bulk Images Optimizer

Name of the Vulnerable Software and Affected Versions: The Bulk images optimizer: Resize, optimize, convert to webp, rename … plugin for WordPress versions up to, and including, 2.0.1 Description: The issue is related to a missing capability check on the save configuration function, allowing...

CVE-2024-9263: Authorization Bypass Through User-Controlled Key

The WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin plugin for WordPress is vulnerable to Account Takeover/Privilege Escalation via Insecure Direct Object Reference in all versions up to, and including, 1.0.25 via the save due to missing validation on a user...

VulnCheck KEV: CVE-2023-7289

The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized API key update due to a missing capability check on the paytiumswsaveapikeys function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level...

USN-7064-1 nano vulnerability

It was discovered that nano allowed a possible privilege escalation through an insecure temporary file. If nano was killed while editing, the permissions granted to the emergency save file could be used by an attacker to escalate privileges using a malicious symlink...

PT-2024-11039 · WordPress · Wordpress Mega Menu

Name of the Vulnerable Software and Affected Versions: WordPress Mega Menu plugin versions up to, and including, 2.0.6 Description: The WordPress Mega Menu plugin is vulnerable to Arbitrary File Creation, allowing unauthenticated attackers to create arbitrary PHP files that can be used to execute...

VulnCheck KEV: CVE-2021-4443

The WordPress Mega Menu plugin for WordPress is vulnerable to Arbitrary File Creation in versions up to, and including, 2.0.6 via the compilersave AJAX action. This makes it possible for unauthenticated attackers to create arbitrary PHP files that can be used to execute malicious code...

PT-2024-7979 · Nvidia · Nvidia Nemo

Name of the Vulnerable Software and Affected Versions: NVIDIA NeMo versions up to r2.0.0rc0 Description: The issue is related to the SaveRestoreConnector function in NVIDIA NeMo, which is associated with incorrect restriction of the directory path name with limited access. Exploitation of this...

CVE-2024-9201

The SEUR plugin, in its versions prior to 2.5.11, is vulnerable to time-based SQL injection through the use of the ‘idorder’ parameter of the ‘/modules/seur/ajax/saveCodFee.php’ endpoint...

PT-2024-39065 · WordPress · Qa Analytics – Web Analytics Tool With Heatmaps & Session Replay Across All Pages

Name of the Vulnerable Software and Affected Versions: QA Analytics – Web Analytics Tool with Heatmaps & Session Replay Across All Pages plugin for WordPress versions up to, and including, 4.1.0.0 Description: The issue is related to a missing capability check on the ajax save plugin config...

vscode -- Visual Studio Code for Linux Remote Code Execution Vulnerability

VSCode developers report: Visual Studio Code for Linux Remote Code Execution Vulnerability A remote code execution vulnerability exists in VS Code 1.94.0 and earlier versions in the elevated save flow...

CVE-2024-9572

Cross-Site Scripting XSS vulnerability in SOPlanning 1.45, due to lack of proper validation of user input via /soplanning/www/process/groupesave.php, in the groupeid parameter. This could allow a remote user to send a specially crafted query to an authenticated user and steal their session detail...

PT-2024-7161 · Unknown · Soplanning

Name of the Vulnerable Software and Affected Versions: SOPlanning versions prior to 1.45 Description: The issue is a Cross-Site Scripting XSS vulnerability due to the lack of proper validation of user input. This could allow a remote user to send a specially crafted query to an authenticated user...

Simple Music Management System 1.0 Add Administrator / Cross Site Request Forgery

============================================================================================================================================= | Title : Simple Music Management System v1.0 CSRF Add ADmin Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla...

CVE-2024-7714

The AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 lacks sufficient access controls allowing an unauthenticated user to disconnect the AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 from OpenAI, thereby disabling the AI ChatB...

PT-2024-39549 · Unknown · Dingfanzu Cms

Name of the Vulnerable Software and Affected Versions: dingfanzu CMS up to 29d67d9044f6f93378e6eb6ff92272217ff7225c Description: A critical issue has been found in the software, affecting some unknown functionality of the file saveNewPwd.php. The manipulation of the username argument leads to sql...