21827 matches found
CVE-2014-125134
The ChurcHope theme for WordPress (versions before 2.2 ) is vulnerable to a path traversal vulnerability. Unauthenticated attackers can exploit the file parameter of the /wp-content/themes/churchope/lib/downloadlink.php component by providing directory traversal sequences. This flaw allows the do...
CVE-2014-125133
The NativeChurch theme for WordPress (versions before 1.6.2 ) is vulnerable to a path traversal vulnerability. Unauthenticated attackers can exploit the file parameter of download.php by sending GET requests containing directory traversal sequences. This allows for the arbitrary download of sensi...
CVE-2014-125133 NativeChurch WordPress Theme < 1.6.2 Arbitrary File Download via download.php
NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter of download.php. Attackers can send GET requests with directory traversal sequences in the file parameter to retrieve...
EUVD-2014-9826
NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter of download.php. Attackers can send GET requests with directory traversal sequences in the file parameter to retrieve...
CVE-2026-92449
gxbinrespixelmaptableload in the GUIX binary resource theme loader indexes the pixelmap table with a value read verbatim from the resource file and never bounds it against the table size. A crafted theme drives a write of up to roughly 256 KB past the end of the table. The overflowed buffer is...
CVE-2026-91189
The GUIX binary resource loader is vulnerable to a heap out-of-bounds write when processing untrusted fonts or themes. The root cause is an integer underflow occurring because the loader fails to verify that a font page's glyph range is well-formed; specifically, if first_glyph > last_glyph, t...
CVE-2026-91189 GUIX binary resource loader: unvalidated glyph range causes an integer underflow and a heap out-of-bounds write when loading an untrusted font or theme
The GUIX binary resource loader never checks that a font page's glyph range is well formed. gxpageheaderfirstglyph and gxpageheaderlastglyph are read verbatim from the file and only the upper bound of lastglyph is validated, so a page declaring firstglyph lastglyph makes last - first + 1 underflo...
CVE-2026-92449
The GUIX binary resource (theme) loader contains a heap out-of-bounds write vulnerability in the _gx_binres_pixelmap_table_load() function. The root cause is the lack of bounds checking on the map_id value read directly from a resource file when indexing the pixelmap table . A crafted theme file ...
CVE-2026-92449 Binary resource loader: unbounded map_id from a theme file causes a heap out-of-bounds write in the GUIX-allocated arena
gxbinrespixelmaptableload in the GUIX binary resource theme loader indexes the pixelmap table with a value read verbatim from the resource file and never bounds it against the table size. A crafted theme drives a write of up to roughly 256 KB past the end of the table. The overflowed buffer is...
EUVD-2026-105036
gxbinrespixelmaptableload in the GUIX binary resource theme loader indexes the pixelmap table with a value read verbatim from the resource file and never bounds it against the table size. A crafted theme drives a write of up to roughly 256 KB past the end of the table. The overflowed buffer is...
CVE-2024-43998
CVE-2024-43998 Blogpoet = 1.0.2 - Missing Authorization via blogpoetinstallandactivateplugins Published: 2024-08-29 00:00:00 Classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N cvss-score: 5.3 cve-id: CVE-2024-43998 cpe: cpe:2.3:a:blogpoet:blogpoet:::::::: cwe-id: CWE-862...
CVE-2023-41425-WonderCMS-Authenticated-RCE
CVE-2023-41425-WonderCMS-Authenticated-RCE Description WonderCMS v3.2.0 - v3.4.2 is vulnerable. Remote attackers can take full control of the server using a Cross-Site Scripting XSS exploit For educational purposes only . Here's the game plan: How it works: The exploit abuses the installModule...
PT-2026-116360
Name of the Vulnerable Software and Affected Versions Post Export Import with Media versions prior to 1.17.3 Description The Post Export Import with Media plugin for WordPress contains a Directory Traversal flaw. This issue allows authenticated users with administrator-level access or higher to...
CVE-2026-111413
Cross-Site Request Forgery CSRF vulnerability in aThemeArt aThemeArt Theme Helper athemeart-theme-helper allows Cross Site Request Forgery.This issue affects aThemeArt Theme Helper: from n/a through 1.0.8...
EUVD-2026-102870
Cross-Site Request Forgery CSRF vulnerability in aThemeArt aThemeArt Theme Helper athemeart-theme-helper allows Cross Site Request Forgery.This issue affects aThemeArt Theme Helper: from n/a through 1.0.8...
CVE-2026-111413 WordPress aThemeArt theme Helper plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in aThemeArt aThemeArt Theme Helper athemeart-theme-helper allows Cross Site Request Forgery.This issue affects aThemeArt Theme Helper: from n/a through 1.0.8...
CVE-2026-111413
The aThemeArt Theme Helper WordPress plugin (versions up to and including 1.0.8 ) is vulnerable to a Cross-Site Request Forgery (CSRF) . This flaw allows an attacker to perform actions on behalf of an authenticated user. No specific remediation or exploit information is provided in the documents.
WordPress aThemeArt theme Helper plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by mamgad in WordPress Plugin aThemeArt Theme Helper versions = 1.0.8...