Kruxton 1.0 Shell Upload

Title: kruxton-1.0-FileUpload-RCE Author: nu11secur1ty Date: 04/15/2024 Vendor: https://www.mayurik.com/ Software: https://www.sourcecodester.com/php/16127/best-pos-management-system-php.html Reference: https://portswigger.net/web-security/file-upload Description: The system setting with paramete...

CVE-2024-2583

The Shortcodes Ultimate WordPress plugin (versions before 7.0.5 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly escape certain shortcode attributes before they are echoed back to users. This flaw allows users with the contributor role to conduct XS...

CVE-2023-51515

CVE-2023-51515 affects Uncode Core (WordPress plugin) up to version 2.8.8, with a Missing Authorization vulnerability enabling Privilege Escalation. Multiple sources confirm the issue and that a fix exists; remediation is to upgrade to a non-vulnerable version (patched). If upgrading is not immed...

CVE-2023-51499

CVE-2023-51499 affects the WordPress WooCommerce Shipping Per Product plugin. Connected sources describe a Missing Authorization/Broken Access Control flaw in versions up to 2.5.4, enabling unauthorized access to affected resources. Remediation per sources is to upgrade to a fixed version (2.5.5+...

CVE-2023-52211

The CVE-2023-52211 entry concerns the WordPress WP Job Manager plugin (

CVE-2022-40211

CVE-2022-40211 affects the WordPress GiveWP plugin

CVE-2023-6257

The Inline Related Posts WordPress plugin, in versions prior to 3.6.0 , is vulnerable to Broken Access Control (OWASP Top 10 A1). The root cause is missing authorization in an AJAX action , which allows any authenticated user, such as a subscriber , to retrieve the content of password-protected p...

CVE-2023-29483

The dnspython library (versions before 2.6.0 ) is vulnerable to a denial of service (DoS) in the stub resolver, as used in eventlet versions before 0.35.2 . The root cause is that dnspython fails to wait for a valid packet within the full time window, allowing a remote attacker to interfere with ...

CVE-2023-2794

ofono on Linux is affected by a stack-based buffer overflow in decode_deliver() during SMS decoding, due to a missing bound check that exists in decode_submit(). This can enable remote code execution when an attacker sends crafted SMS or via a compromised modem/malicious base station. Connected a...

CVE-2024-2243

CVE-2024-2243 affects the csmock component used with OSH (OAuth? Kerberos-based) in Tencent/TencentOS and Fedora/RHEL packaging. The vulnerability allows a regular OSH-service user (anyone with a Kerberos ticket) to disclose the confidential Snyk authentication token and to run arbitrary commands...

CVE-2023-6385

The WordPress Ping Optimizer plugin (versions through 2.35.1.3.0 ) is vulnerable to a Cross-Site Request Forgery (CSRF) flaw due to missing CSRF checks in certain areas. This allows an attacker to trick a logged-in user—such as an administrator—into performing unwanted actions, specifically clear...

CVE-2022-4965

The CVE-2022-4965 entry concerns the Invitation Code Content Restriction Plugin for WordPress by CreativeMinds. It describes a reflected Cross-Site Scripting (XSS) vulnerability via the target_id parameter present in all versions up to and including 1.5.4, caused by insufficient input sanitizatio...

CVE-2024-1412

CVE-2024-1412 concerns the WordPress Memberpress plugin. Connected sources confirm a reflected Cross‑Site Scripting (XSS) vulnerability in the plugin’s handling of the message and error parameters, affecting all versions up to 1.11.26. The vulnerability is unauthenticated and could allow an attac...

CVE-2024-2138

CVE-2024-2138 concerns the WordPress plugin JetWidgets For Elementor. The Red Hat and Wordfence entries describe a stored cross-site scripting (XSS) vulnerability in the Animated Box widget, affecting all versions up to and including 1.0.15. The issue arises from insufficient input sanitization a...

CVE-2024-2866

CVE-2024-2866 is a placeholder entry that has been superseded by CVE-2024-2509 for the Kadence Blocks WordPress plugin. Connected data show that CVE-2024-2509 details a Stored Cross-Site Scripting (XSS) vulnerability in the Gutenberg Blocks by Kadence Blocks plugin prior to version 3.2.26 , where...

CVE-2024-2957

CVE-2024-2957 is a duplicate of CVE-2024-1983. The linked Red Hat/NVD details show Simple Ajax Chat for WordPress (before 20240223) suffers a stored XSS via the name field, reflecting unsanitized input to other users. This confirms the vulnerability context, affected component, and root cause; CV...

CVE-2024-2093

CVE-2024-2093 affects the VK All in One Expansion Unit WordPress plugin. All versions up to and including 9.95.0.1 are vulnerable to Sensitive Information Exposure via social meta tags, allowing unauthenticated attackers to view limited password‑protected content. Root cause: improper handling of...

CVE-2024-1458

CVE-2024-1458 : Elementor Addons by Livemesh for WordPress is vulnerable to stored XSS via the Animated Text widget’s text_alignment attribute in all versions up to and including 8.3.4 due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level acc...

CVE-2024-1461

Elementor Addons by Livemesh (WordPress) contains a Stored XSS in Team Members widget via the style attribute in all versions up to 8.3.4 due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor+ access can inject scripts that execute for users visiting...

CVE-2024-2344

CVE-2024-2344 (Avada Theme for WordPress) : SQL Injection via the 'entry' parameter affects all versions up to 7.11.6. Root cause: insufficient escaping of user input and inadequate preparation of the existing SQL query. Exploitation requires editor-level access or higher (authenticated). Impact ...