2455 matches found
CVE-2024-11356
CVE-2024-11356 affects the Tour Master - Tour Booking, Travel, Hotel WordPress plugin (versions prior to 5.3.4). The issue is an Cross-Site Scripting (XSS) vulnerability caused by insufficient sanitization/escaping of parameters when rendered on pages, allowing unauthenticated users to inject scr...
CVE-2024-10584
CVE-2024-10584 affects the DirectoryPress – Business Directory And Classified Ad Listing WordPress plugin. It is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to 3.6.16 due to insufficient input sanitization/output escaping. Exploitation requires authenticated ...
CVE-2024-11721 Frontend Admin by DynamiApps <= 3.24.5 - Unauthenticated Privilege Escalation
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.24.5. This is due to insufficient controls on the user role select field when utilizing the 'Role' field in a form. This makes it possible for unauthenticated...
CVE-2024-11107
The System Dashboard WordPress plugin before 2.8.15 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks...
CVE-2024-11107 System Dashboard < 2.8.15 - Unauthenticated Stored XSS
The System Dashboard WordPress plugin before 2.8.15 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks...
CVE-2024-11107
CVE-2024-11107 refers to the WordPress System Dashboard plugin vulnerability where versions before 2.8.15 allow unauthenticated stored XSS due to insufficient sanitization/escaping of output parameters. Affected software: System Dashboard plugin prior to 2.8.15. Impact: unauthenticated users can ...
WordPress plugin System Dashboard 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPress...
PT-2024-16767 · WordPress · Simple Restrict
Name of the Vulnerable Software and Affected Versions: Simple Restrict plugin for WordPress versions up to, and including, 1.2.7 Description: The issue allows unauthenticated attackers to extract sensitive data from posts restricted to higher-level roles, such as administrators, via the WordPress...
PT-2024-16768 · WordPress · System Dashboard
Name of the Vulnerable Software and Affected Versions: System Dashboard WordPress plugin versions prior to 2.8.15 Description: The issue allows unauthenticated users to perform Cross-Site Scripting attacks due to the plugin not sanitizing and escaping some parameters when outputting them in the...
CVE-2024-54151 Directus allows unauthenticated access to WebSocket events and operations
Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 11.0.0 and prior to version 11.3.0, when setting WEBSOCKETSGRAPHQLAUTH or WEBSOCKETSRESTAUTH to "public", an unauthenticated user is able to do any of the supported operations CRUD, subscriptions...
CVE-2024-37302
Synapse is an open-source Matrix homeserver. Synapse versions before 1.106 are vulnerable to a disk fill attack, where an unauthenticated adversary can induce Synapse to download and cache large amounts of remote media. The default rate limit strategy is insufficient to mitigate this. This can le...
CVE-2024-11599 Domain Restriction Bypass on Registration
Mattermost versions 10.0.x = 10.0.1, 10.1.x = 10.1.1, 9.11.x = 9.11.3, 9.5.x = 9.5.11 fail to properly validate email addresses which allows an unauthenticated user to bypass email domain restrictions via carefully crafted input on email registration...
CVE-2024-50375
A CWE-306 "Missing Authentication for Critical Function" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G = 1.6.3, EKI-6333AC-2GD = v1.6.3 and EKI-6333AC-1GPO = v1.2.1. The vulnerability can be exploited by remote unauthenticated users capable of interacting...
CVE-2024-50375
A CWE-306 "Missing Authentication for Critical Function" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G = 1.6.3, EKI-6333AC-2GD = v1.6.3 and EKI-6333AC-1GPO = v1.2.1. The vulnerability can be exploited by remote unauthenticated users capable of interacting...
CVE-2024-50373
A CWE-78 "Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection'" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G = 1.6.3, EKI-6333AC-2GD = v1.6.3 and EKI-6333AC-1GPO = v1.2.1. The vulnerability can be exploited by remote...
CVE-2024-50373
A CWE-78 "Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection'" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G = 1.6.3, EKI-6333AC-2GD = v1.6.3 and EKI-6333AC-1GPO = v1.2.1. The vulnerability can be exploited by remote...
CVE-2024-50372
A CWE-78 "Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection'" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G = 1.6.3, EKI-6333AC-2GD = v1.6.3 and EKI-6333AC-1GPO = v1.2.1. The vulnerability can be exploited by remote...
CVE-2024-50371
CVE-2024-50371 affects Advantech EKI-6333AC devices: EKI-6333AC-2G <= 1.6.3, EKI-6333AC-2GD <= 1.6.3, and EKI-6333AC-1GPO
CVE-2024-11666 Unauthenticated Remote Command Injection in eCharge Salia PLCC
Affected devices beacon to eCharge cloud infrastructure asking if there are any command they should run. This communication is established over an insecure channel since peer verification is disabled everywhere. Therefore, remote unauthenticated users suitably positioned on the network between an...
CVE-2024-10813
The Product Table for WooCommerce by CodeAstrology wooproducttable.com plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.1 via the vardumptable parameter. This makes it possible for unauthenticated attackers var data...