WordPress FraudLabs Pro SMS Verification plugin <= 1.10.1 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin FraudLabs Pro SMS Verification versions = 1.10.1...

WordPress Admin SMS Alert plugin <= 1.1.0 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

CSRF to Stored Cross Site Scripting XSS vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin Admin SMS Alert versions = 1.1.0...

WordPress FraudLabs Pro SMS Verification Plugin <= 1.10.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software FraudLabs Pro SMS Verification Type Plugin Vulnerable versions = 1.10.1 Fixed in 1.10.2 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-51688 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 7924a0d6c9b2 Credits...

WordPress Admin SMS Alert Plugin <= 1.1.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Admin SMS Alert Type Plugin Vulnerable versions = 1.1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Request Forgery CSRF CVE CVE-2024-51637 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 1c184ecc3a88 Credits Joshua Chan Required privilege...

CVE-2024-10233

The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sasubscribe shortcode in all versions up to, and including, 3.7.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes i...

CVE-2024-10233 SMSAlert - WooCommerce <= 3.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_subscribe Shortcode

The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sasubscribe shortcode in all versions up to, and including, 3.7.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes i...

CVE-2024-10233

CVE-2024-10233 affects the SMS Alert Order Notifications – WooCommerce WordPress plugin. It is vulnerable in all versions up to and including 3.7.5 due to insufficient input sanitization and output escaping on the sa_subscribe shortcode attributes, enabling an authenticated attacker with contribu...

PT-2024-16130 · WordPress · Sms Alert Order Notifications

Name of the Vulnerable Software and Affected Versions: SMS Alert Order Notifications – WooCommerce plugin for WordPress versions up to, and including, 3.7.5 Description: The issue is related to Stored Cross-Site Scripting via the plugin's sa subscribe shortcode due to insufficient input...

CVE-2024-10195

A vulnerability was found in Tecno 4G Portable WiFi TR118 V008-20220830. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /goform/goformgetcmdprocess of the component SMS Check. The manipulation of the argument orderby leads to sql injection...

CVE-2024-10195 Tecno 4G Portable WiFi TR118 SMS Check goform_get_cmd_process sql injection

A vulnerability was found in Tecno 4G Portable WiFi TR118 V008-20220830. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /goform/goformgetcmdprocess of the component SMS Check. The manipulation of the argument orderby leads to sql injection...

CVE-2024-10195

The CVE-2024-10195 entry concerns Tecno 4G Portable WiFi TR118 (V008-20220830). A vulnerability exists in the SMS Check module via the endpoint /goform/goform_get_cmd_process where manipulation of the order_by argument enables SQL injection. Exploitation is described as remote. Several sources co...

CVE-2024-10195 Tecno 4G Portable WiFi TR118 SMS Check goform_get_cmd_process sql injection

A vulnerability was found in Tecno 4G Portable WiFi TR118 V008-20220830. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /goform/goformgetcmdprocess of the component SMS Check. The manipulation of the argument orderby leads to sql injection...

PT-2024-16108 · Tecno · Tecno 4G Portable Wifi Tr118

Name of the Vulnerable Software and Affected Versions: Tecno 4G Portable WiFi TR118 version V008-20220830 Description: A critical issue affects an unknown functionality of the file /goform/goform get cmd process of the component SMS Check. The manipulation of the order by argument leads to SQL...

CVE-2024-9213 Persian WooCommerce SMS <= 7.0.2 - Reflected Cross-Site Scripting

The افزونه پیامک ووکامرس Persian WooCommerce SMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of removequeryarg without appropriate escaping on the URL in all versions up to, and including, 7.0.2. This makes it possible for unauthenticated attackers to injec...

PT-2024-39494 · WordPress · Persian Woocommerce Sms

Name of the Vulnerable Software and Affected Versions: Persian WooCommerce SMS plugin for WordPress versions up to, and including, 7.0.2 Description: The issue arises from the use of remove query arg without proper escaping on the URL, leading to a Reflected Cross-Site Scripting vulnerability. Th...

WordPress plugin Persian WooCommerce SMS 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress Persian WooCommerce SMS plugin <= 7.0.2 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Persian Woocommerce SMS versions = 7.0.2...

WordPress Persian Woocommerce SMS Plugin <= 7.0.2 is vulnerable to Cross Site Scripting (XSS)

Software Persian Woocommerce SMS Type Plugin Vulnerable versions = 7.0.2 Fixed in 7.0.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9213 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 9b46c5c8953e Credits vgo0...

[SECURITY] Fedora 41 Update: znc-push-2.0.0-10.20210311git4243934.fc41

ZNC Push is a module for ZNC that will send notifications to multiple push notification services, or SMS for any private message or channel highlight that matches a configurable set of conditions...

Google Adds New Pixel Security Features to Block 2G Exploits and Baseband Attacks

Google has revealed the various security guardrails that have been incorporated into its latest Pixel devices to counter the rising threat posed by baseband security attacks. The cellular baseband i.e., modem refers to a processor on the device that's responsible for handling all connectivity, su...