WordPress Meta slider and carousel with lightbox Plugin <= 1.8.2 is vulnerable to Broken Access Control

Software Meta slider and carousel with lightbox Type Plugin Vulnerable versions = 1.8.2 Fixed in 1.8.3 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-40200 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 708ddfc78d3b Credits Abdi...

WordPress Popup by Supsystic Plugin <= 1.10.19 is vulnerable to Broken Access Control

Software Popup by Supsystic Type Plugin Vulnerable versions = 1.10.19 Fixed in 1.10.20 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-39997 Patch priority Low CVSS severity Low 5.3 Developer Supsystic PSID 6f37d18ff2b4 Credits Rafshanzani Suhada Required...

WordPress Photo Gallery by Ays Plugin <= 5.2.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software Photo Gallery by Ays Type Plugin Vulnerable versions = 5.2.6 Fixed in 5.2.7 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-39917 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID dcde53c55582 Credits Skalucy Requir...

WordPress Duplicate Post Plugin <= 1.4.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Duplicate Post Type Plugin Vulnerable versions = 1.4.1 Fixed in 1.4.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE N/A Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 80f37ad53409 Credits N/A Required privilege...

UBUNTU-CVE-2023-3106

A NULL pointer dereference vulnerability was found in netlinkdump. This issue can occur when the Netlink socket receives the messagesendmsg for the XFRMMSGGETSA, XFRMMSGGETPOLICY type message, and the DUMP flag is set and can cause a denial of service or possibly another unspecified impact. Due t...

WordPress Metform Elementor Contact Form Builder Plugin <= 3.3.0 is vulnerable to Cross Site Scripting (XSS)

Software Metform Elementor Contact Form Builder Type Plugin Vulnerable versions = 3.3.0 Fixed in 3.3.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0708 Patch priority Low CVSS severity Low 6.5 Developer Wpmet PSID d2490fc4db6a Credits Ramuel Gall...

WordPress Contact Form Entries Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

Software Contact Form Entries Type Plugin Vulnerable versions = 1.3.0 Fixed in 1.3.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-33311 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID eead2c1f0998 Credits Rafie Muhammad...

WordPress reCAPTCHA for all Plugin <= 1.22 is vulnerable to Broken Access Control

Software reCAPTCHA for all Type Plugin Vulnerable versions = 1.22 Fixed in 1.23 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-32599 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 97d938ca1868 Credits Jonas Höbenreich Required...

QEMU: ACPI ERST: memory corruption issues in read_erst_record and write_erst_record

An integer overflow and buffer overflow issues were found in the ACPI Error Record Serialization Table ERST device of QEMU in the readerstrecord and writeerstrecord functions. Both issues may allow the guest to overrun the host buffer allocated for the ERST memory device. A malicious guest could...

WordPress Emails & Newsletters with Jackmail Plugin <= 1.2.22 is vulnerable to CSV Injection

Software Emails & Newsletters with Jackmail Type Plugin Vulnerable versions = 1.2.22 Fixed in N/A OWASP Top 10 A1: Injection Classification CSV Injection CVE CVE-2022-46821 Patch priority Low CVSS severity Low 5.8 Developer Claim ownership PSID 513c44c8232d Credits Mika Required privilege...

WordPress Blog Navigator Chatbot by Xatkit Plugin <= 4.4.9 is vulnerable to Cross Site Scripting (XSS)

Software Blog Navigator Chatbot by Xatkit Type Plugin Vulnerable versions = 4.4.9 Fixed in 4.5.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-1649 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 73a888678fc8 Credits Erwan L...

WordPress Booking calendar, Appointment Booking System Plugin <= 3.2.7 is vulnerable to SQL Injection

Software Booking calendar, Appointment Booking System Type Plugin Vulnerable versions = 3.2.7 Fixed in 3.2.8 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2022-47428 Patch priority Low CVSS severity Low 6.7 Developer Claim ownership PSID be3286ef939c Credits thiennv Required...

WordPress WP Education Plugin < 1.2.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP Education Type Plugin Vulnerable versions 1.2.7 Fixed in 1.2.7 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-0498 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID bede27b04a59 Credits Lana Codes Required...

WordPress Solidres – Hotel booking plugin Plugin <= 0.9.4 is vulnerable to Cross Site Scripting (XSS)

Software Solidres – Hotel booking plugin Type Plugin Vulnerable versions = 0.9.4 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-1374 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 2295c3bbe77d Credits Daniel...

WordPress WP Coder Plugin < 2.5.4 is vulnerable to SQL Injection

Software WP Coder Type Plugin Vulnerable versions 2.5.4 Fixed in 2.5.4 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-0895 Patch priority Low CVSS severity Low 5.5 Developer Claim ownership PSID af35ebdc8e18 Credits Etan Imanol Castro Aldrete Required privilege Administrator...

WordPress All-in-one Floating Contact Form – My Sticky Elements Plugin < 2.0.9 is vulnerable to SQL Injection

Software All-in-one Floating Contact Form – My Sticky Elements Type Plugin Vulnerable versions 2.0.9 Fixed in 2.0.9 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-0487 Patch priority Low CVSS severity Low 5.5 Developer Claim ownership PSID cdb7568b0dc6 Credits qerogramat Kak...

CVE-2015-10075 Custom-Content-Width custom-content-width.php register_settings cross site scripting

A vulnerability was found in Custom-Content-Width 1.0. It has been declared as problematic. Affected by this vulnerability is the function overridecontentwidth/registersettings of the file custom-content-width.php. The manipulation leads to cross site scripting. The attack can be launched remotel...

WordPress Email Subscribers & Newsletters Plugin <= 5.5.2 is vulnerable to CSV Injection

Software Email Subscribers & Newsletters Type Plugin Vulnerable versions = 5.5.2 Fixed in 5.5.3 OWASP Top 10 A1: Injection Classification CSV Injection CVE CVE-2022-45810 Patch priority Low CVSS severity Low 6.1 Developer Claim ownership PSID bc18fb9ece3e Credits Mika Required privilege...

WordPress Posts and Users Stats Plugin <= 1.1.3 is vulnerable to CSV Injection

Software Posts and Users Stats Type Plugin Vulnerable versions = 1.1.3 Fixed in 1.1.4 OWASP Top 10 A1: Injection Classification CSV Injection CVE CVE-2022-44738 Patch priority Low CVSS severity Low 5.8 Developer Claim ownership PSID adb9c8d12136 Credits Mika Required privilege Subscriber Publishe...

WordPress Royal Elementor Addons Plugin <= 1.3.59 is vulnerable to Cross Site Request Forgery (CSRF)

Software Royal Elementor Addons Type Plugin Vulnerable versions = 1.3.59 Fixed in 1.3.60 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-4707 Patch priority Low CVSS severity Low 4.3 Developer WProyal PSID d1eebd7ac349 Credits Ramuel Gall Require...