WordPress AffiliateX plugin <= 1.2.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin AffiliateX versions = 1.2.9...

WordPress Landing Page Cat plugin <= 1.7.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Savphill Patchstack Alliance in WordPress Plugin Landing Page Cat versions = 1.7.4...

WordPress iBryl Switch User plugin <= 1.0.1 - Account Takeover vulnerability

Account Takeover vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin iBryl Switch User versions = 1.0.1...

WordPress Simple Load More plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin Simple Load More versions = 1.0...

WordPress WP ERP plugin <= 1.13.2 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Le Ngoc Anh Patchstack Alliance in WordPress Plugin WP ERP versions = 1.13.2...

WordPress Simple Custom Admin plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin Simple Custom Admin versions = 1.2...

PT-2024-28773 · Unknown · Vilo 5 Mesh Wifi System

Name of the Vulnerable Software and Affected Versions: Vilo 5 Mesh WiFi System versions = 5.16.1.33 Description: A Buffer Overflow issue in the local app set router wan function allows remote, unauthenticated attackers to execute arbitrary code. This is achieved by exploiting the pppoe username a...

CVE-2024-49325

Subscriber Broken Access Control in Photo Gallery Builder = 3.0 versions...

CVE-2024-49250

Cross-Site Request Forgery CSRF vulnerability in Michael Tran Table of Contents Plus allows Cross Site Request Forgery.This issue affects Table of Contents Plus: from n/a through 2408...

CVE-2024-49274

Cross-Site Request Forgery CSRF vulnerability in Infomaniak Staff VOD Infomaniak allows Cross Site Request Forgery.This issue affects VOD Infomaniak: from n/a through 1.5.7...

CVE-2024-49610

Unrestricted Upload of File with Dangerous Type vulnerability in Jack Zhu allows Upload a Web Shell to a Web Server.This issue affects photokit: from n/a through 1.0...

CVE-2024-49631

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Md Abdul Kader Easy Addons for Elementor allows Stored XSS.This issue affects Easy Addons for Elementor: from n/a through 1.3.0...

CVE-2024-49626

Deserialization of Untrusted Data vulnerability in Piyushmca Shipyaari Shipping Management allows Object Injection.This issue affects Shipyaari Shipping Management: from n/a through 1.2...

PT-2024-33572 · Unknown · Bhaskar Dhote Back Link Tracker

Name of the Vulnerable Software and Affected Versions: Bhaskar Dhote Back Link Tracker versions n/a through 1.0.0 Description: The issue affects Bhaskar Dhote Back Link Tracker, allowing Blind SQL Injection via a Cross-Site Request Forgery CSRF vulnerability. This enables an attacker to inject...

PT-2024-33576 · Unknown · Apa Register Newsletter Form

Name of the Vulnerable Software and Affected Versions: APA Register Newsletter Form versions n/a through 1.0.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows SQL Injection in the APA Register Newsletter Form. This means an attacker can trick a user into...

PT-2024-33569 · Dan Alexander · Sermonaudio Widgets

Name of the Vulnerable Software and Affected Versions: Dan Alexander SermonAudio Widgets versions n/a through 1.9.3 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection,...

WordPress Photo Gallery Slideshow & Masonry Tiled Gallery plugin <= 1.0.3 - Authenticated (Admin+) SQL Injection vulnerability

Authenticated Admin+ SQL Injection vulnerability discovered by Ala Arfaoui in WordPress Plugin Photo Gallery Slideshow & Masonry Tiled Gallery versions = 1.0.3...

WordPress WP Education for Elementor plugin <= 1.2.8 - Stored Cross Site Scripting (XSS) vulnerability

Stored Cross Site Scripting XSS vulnerability discovered by Gab Patchstack Alliance in WordPress Plugin WP Education versions = 1.2.8...

WordPress Advanced Advertising System plugin <= 1.3.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin Advanced Advertising System versions = 1.3.1...

WordPress SafetyForms plugin <= 1.0.0 - CSRF to SQL Injection vulnerability

CSRF to SQL Injection vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin SafetyForms versions = 1.0.0...