15315 matches found
CVE-2024-31107 WordPress OpenID plugin <= 3.6.1 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in DiSo Development Team OpenID allows Reflected XSS.This issue affects OpenID: from n/a through 3.6.1...
CVE-2024-31108
CVE-2024-31108 relates to iFlyChat – WordPress Chat (plugin), with a Stored XSS vulnerability in the web page generation input handling. The issue affects iFlyChat – WordPress Chat from n/a through 4.7.2, per the description. The connected data notes the vulnerability as a vulnerability in an act...
CVE-2024-31100 WordPress Popup Cart Lite for WooCommerce plugin <= 1.1 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in Festi-Team Popup Cart Lite for WooCommerce.This issue affects Popup Cart Lite for WooCommerce: from n/a through 1.1...
CVE-2024-31100 WordPress Popup Cart Lite for WooCommerce plugin <= 1.1 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in Festi-Team Popup Cart Lite for WooCommerce.This issue affects Popup Cart Lite for WooCommerce: from n/a through 1.1...
CVE-2024-31100
Technical details about CVE-2024-31100 are not publicly provided in the supplied documents. Monitor for updates from vendors and vulnerability databases.
PT-2024-23769 · Woocommerce · Festi-Team Popup Cart Lite For Woocommerce
Name of the Vulnerable Software and Affected Versions: Festi-Team Popup Cart Lite for WooCommerce versions 1.1 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software. This type of issue allows an attacker to trick a user into performing unintended actions on a web...
ArgoCD's repo server has Uncontrolled Resource Consumption vulnerability
Impact All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, it's possible to crash the repo server component through an out of memory error by pointing it to a malicious Helm registry. The...
GHSA-JHWX-MHWW-RGC3 ArgoCD's repo server has Uncontrolled Resource Consumption vulnerability
Impact All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, it's possible to crash the repo server component through an out of memory error by pointing it to a malicious Helm registry. The...
CVE-2024-30449
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Booking Activities Team Booking Activities allows Reflected XSS.This issue affects Booking Activities: from n/a through 1.15.19...
CVE-2024-30430
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Email Newsletter Team - FluentCRM Fluent CRM allows Stored XSS.This issue affects Fluent CRM: from n/a through 2.8.44...
CVE-2024-30425
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in The Beaver Builder Team Beaver Builder allows Stored XSS.This issue affects Beaver Builder: from n/a through 2.7.4.4...
CVE-2024-30430
CVE-2024-30430 is a stored XSS in the WP Email Newsletter Team (FluentCRM) for FluentCRM, with exploitation possible via input not properly neutralized during web page generation. Affected: FluentCRM up to version 2.8.44. Root cause per Red Hat/other sources is improper input handling leading to ...
WordPress Pods plugin <= 3.0.10 - Authenticated (Contributor+) SQL Injection via Shortcode vulnerability
Authenticated Contributor+ SQL Injection via Shortcode vulnerability discovered by Nex Team in WordPress Plugin Pods versions = 3.0.10...
WordPress Pods Plugin <= 3.0.10 is vulnerable to Broken Access Control
Software Pods Type Plugin Vulnerable versions = 3.0.10 Fixed in 3.0.10.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-6965 Patch priority Low CVSS severity Low 4.3 Developer Pods Framework PSID 636da473e23f Credits Nex Team Required privilege Contributo...
CVE-2024-29200 API returns timesheet entries a user should not be authorized to view
Kimai is a web-based multi-user time-tracking application. The permission viewothertimesheet performs differently for the Kimai UI and the API, thus returning unexpected data through the API. When setting the viewothertimesheet permission to true, on the frontend, users can only see timesheet...
CVE-2024-30224
Deserialization of Untrusted Data vulnerability in Wholesale Team WholesaleX.This issue affects WholesaleX: from n/a through 1.3.2...
CVE-2024-30224
CVE-2024-30224 covers a PHP Object Injection vulnerability in the WordPress plugin WholesaleX (WholesaleX plugin for WooCommerce). The issue arises from deserialization of untrusted data in all versions up to and including 1.3.2, allowing unauthenticated attackers to inject PHP objects. Impact de...
CVE-2024-29804
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Team Heateor Fancy Comments WordPress allows Stored XSS.This issue affects Fancy Comments WordPress: from n/a through 1.2.14...
CVE-2024-29804 WordPress Fancy Comments WordPress plugin <= 1.2.14 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Team Heateor Fancy Comments WordPress allows Stored XSS.This issue affects Fancy Comments WordPress: from n/a through 1.2.14...