11782 matches found
WordPress Woo Inquiry plugin <= 0.1 - Unauthenticated SQL Injection vulnerability
Unauthenticated SQL Injection vulnerability discovered by theviper17y in WordPress Plugin Woo Inquiry versions = 0.1...
CVE-2024-43875 PCI: endpoint: Clean up error handling in vpci_scan_bus()
In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Clean up error handling in vpciscanbus Smatch complains about inconsistent NULL checking in vpciscanbus: drivers/pci/endpoint/functions/pci-epf-vntb.c:1024 vpciscanbus error: we previously assumed 'vpcibus' could b...
WordPress plugin Flamix 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...
CVE-2024-5763
The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the videodate attribute within the plugin's Video widget in all versions up to, and including, 5.6.2 due to insufficient inpu...
CVE-2024-5940
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'handlerequest' function in all versions up to, and including, 3.13.0. This makes it possible for unauthenticated attackers to edi...
WordPress GiveWP plugin <= 3.13.0 - Missing Authorization to Limited Information Exposure vulnerability
Missing Authorization to Limited Information Exposure vulnerability discovered by villu164 in WordPress Plugin GiveWP versions = 3.13.0...
PT-2024-38036 · WordPress · Smart Online Order For Clover
Name of the Vulnerable Software and Affected Versions: The Smart Online Order for Clover plugin for WordPress versions up to, and including, 1.5.6 Description: The issue allows authenticated attackers with Subscriber-level access and above to update product and category descriptions, category...
WordPress Admission AppManager plugin <= 1.0.0 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by zulu caPWN in WordPress Plugin Admission AppManager versions = 1.0.0...
PT-2024-30406 · Eyecix · Eyecix Jobsearch
Name of the Vulnerable Software and Affected Versions: eyecix JobSearch versions n/a through 2.3.4 Description: The issue is related to improper privilege management, allowing privilege escalation. This problem affects eyecix JobSearch, enabling unauthorized access to sensitive data and potential...
PT-2024-38714 · Unknown · Sourcecodester Online Graduate Tracer System
Name of the Vulnerable Software and Affected Versions: SourceCodester Online Graduate Tracer System versions up to 1.0 Description: A critical vulnerability was found in the SourceCodester Online Graduate Tracer System, affecting an unknown function of the file /tracking/admin/fetch genderit.php...
PT-2024-30410 · Unknown · Bit Form Pro
Name of the Vulnerable Software and Affected Versions: Bit Form Pro versions n/a through 2.6.4 Description: The issue affects Bit Form Pro, allowing Command Injection due to an Unrestricted Upload of File with Dangerous Type vulnerability. Recommendations: For Bit Form Pro versions n/a through...
CVE-2024-43239
Authorization Bypass Through User-Controlled Key vulnerability in Masteriyo Masteriyo - LMS.This issue affects Masteriyo - LMS: from n/a through 1.11.4...
CVE-2024-43342
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in BdThemes Ultimate Store Kit Elementor Addons allows Stored XSS.This issue affects Ultimate Store Kit Elementor Addons: from n/a through 1.6.4...
CVE-2023-0714
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in versions up to, and including, 3.2.4. This allows unauthenticated visitors to perform a "double extension" attack and upload files containing a malicious...
CVE-2024-42271
In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix use after free in iucvsockclose iucvseverpath is called from process context and from bh context. iucv-path is used as indicator whether somebody else is taking care of severing the path or it is already removed /...
PT-2024-38523 · Armember · Armember
Name of the Vulnerable Software and Affected Versions: The ARMember – Membership Plugin versions up to, and including, 4.0.37 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows authenticated...
CVE-2024-7144
The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' and 'slideid' parameters in all versions up to, and including, 2.6.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-lev...
WordPress All Bootstrap Blocks plugin <= 1.3.19 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by NGÔ THIÊN AN Patchstack Alliance in WordPress Plugin All Bootstrap Blocks versions = 1.3.19...
WordPress ReviewX plugin <= 1.6.28 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Manab Jyoti Dowarah Patchstack Alliance in WordPress Plugin ReviewX versions = 1.6.28...