CVE-2024-29136

CVE-2024-29136 affects the Tourfic WordPress plugin from Themefic, vulnerable to PHP Object Injection via deserialization of untrusted data in all versions up to 2.11.17. The vulnerability requires at least Subscriber+ authentication and could enable attacker-controlled object injection. Public s...

CVE-2024-29137 WordPress Tourfic plugin <= 2.11.7 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through = 2.11.7...

CVE-2024-29137

The WordPress Tourfic plugin is affected up to version 2.11.7 with a Reflected XSS vulnerability in the place parameter due to insufficient input sanitization and output escaping. This can allow attackers to execute scripts in users’ browsers. Remediation: upgrade to Tourfic 2.11.8 or later. The ...

PT-2024-22756

Name of the Vulnerable Software and Affected Versions Themefic Tourfic versions prior to 2.11.8 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. Recommendations For versions prior to 2.11.8...

PT-2024-22755 · Unknown · Themefic Tourfic

Name of the Vulnerable Software and Affected Versions: Themefic Tourfic versions n/a through 2.11.17 Description: The issue is related to Deserialization of Untrusted Data. This is a type of vulnerability where an application deserializes data from an untrusted source, potentially allowing an...

PT-2024-22753 · Unknown · Themefic Tourfic

Name of the Vulnerable Software and Affected Versions: Themefic Tourfic versions through 2.11.8 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Stored XSS. This means that an attacker can inject...

VulnCheck KEV: CVE-2024-29135

Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through = 2.11.15...

WordPress Tourfic Plugin <= 2.11.15 is vulnerable to Arbitrary File Upload

Software Tourfic Type Plugin Vulnerable versions = 2.11.15 Fixed in 2.11.16 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-29135 Patch priority High CVSS severity High 9.9 Developer Themefic PSID b543d4424f73 Credits LVT-tholv2k Required privilege Subscriber Publishe...

VulnCheck KEV: CVE-2024-29136

Deserialization of Untrusted Data vulnerability in Themefic Tourfic.This issue affects Tourfic: from n/a through 2.11.17...

WordPress Tourfic Plugin <= 2.11.17 is vulnerable to PHP Object Injection

Software Tourfic Type Plugin Vulnerable versions = 2.11.17 Fixed in 2.11.19 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-29136 Patch priority High CVSS severity High 8.5 Developer Themefic PSID 0c2f99b8302e Credits LVT-tholv2k Required privilege Subscriber Published...

WordPress Tourfic Plugin <= 2.11.7 is vulnerable to Cross Site Scripting (XSS)

Software Tourfic Type Plugin Vulnerable versions = 2.11.7 Fixed in 2.11.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-29137 Patch priority Medium CVSS severity Medium 7.1 Developer Themefic PSID 46fbea9a6c10 Credits LVT-tholv2k Required privilege Unauthenticate...

VulnCheck KEV: CVE-2024-29137

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through = 2.11.7...

WordPress Tourfic Plugin <= 2.11.8 is vulnerable to Cross Site Scripting (XSS)

Software Tourfic Type Plugin Vulnerable versions = 2.11.8 Fixed in 2.11.9 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-29134 Patch priority Low CVSS severity Low 6.5 Developer Themefic PSID a61f73e8cf31 Credits LVT-tholv2k Required privilege Contributor Publishe...

CVE-2023-30495

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Themefic Ultimate Addons for Contact Form 7.This issue affects Ultimate Addons for Contact Form 7: from n/a through 3.1.23...

CVE-2023-30495

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Themefic Ultimate Addons for Contact Form 7.This issue affects Ultimate Addons for Contact Form 7: from n/a through 3.1.23...

Sql injection

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Themefic Ultimate Addons for Contact Form 7.This issue affects Ultimate Addons for Contact Form 7: from n/a through 3.1.23...

CVE-2023-30495 WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.1.23 is vulnerable to SQL Injection

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Themefic Ultimate Addons for Contact Form 7.This issue affects Ultimate Addons for Contact Form 7: from n/a through 3.1.23...

CVE-2023-30495

CVE-2023-30495 is an SQL Injection vulnerability in Themefic Ultimate Addons for Contact Form 7. Affected: Ultimate Addons for Contact Form 7

PT-2023-22731 · Unknown · Themefic Ultimate Addons For Contact Form 7

Name of the Vulnerable Software and Affected Versions: Themefic Ultimate Addons for Contact Form 7 versions 3.1.23 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for potential...

CVE-2023-49766

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Themefic Ultimate Addons for Contact Form 7 allows Stored XSS.This issue affects Ultimate Addons for Contact Form 7: from n/a through 3.2.0...