WordPress plugin KBucket 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

WordPress plugin Datasets Manager by Arttia Creative 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A code issue vulnerability exists in WordPress plugin...

WordPress plugin Devexhub Gallery 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

WordPress plugin Instant Image Generator 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

WordPress plugin Do That Task 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists i...

PT-2024-35209 · Webtechglobal · Webtechglobal Easy Csv Importer

Name of the Vulnerable Software and Affected Versions: WebTechGlobal Easy CSV Importer BETA versions n/a through 7.0.0 Description: The issue allows for the unrestricted upload of files with dangerous types, potentially enabling the upload of a web shell to a web server. This poses a significant...

WordPress plugin Sage AI: Chatbots, OpenAI GPT-4 Bulk Articles, Dalle-3 Image Generation 代码问题漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. WordPress plugin Sage AI: Chatbots, OpenAI GPT-...

Java-springboot-codebase 代码问题漏洞

Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects from osama individual developers. A code issue vulnerability exists in Java-springboot-codebase that stems from allowing files to be uploaded without proper authentication or restrictions...

PT-2024-35214 · Bdthemes · Bdthemes Instant Image Generator

Name of the Vulnerable Software and Affected Versions: BdThemes Instant Image Generator versions 1.5.4 and earlier Description: The issue allows an attacker to upload a web shell to a web server due to an Unrestricted Upload of File with Dangerous Type vulnerability. This enables attackers to...

DRUPAL-CONTRIB-2024-060

The module creates an endpoint on the site at /postfile/upload that accepts a POST request for uploading a single file into a specified file system public, private, etc. This module accepts any uploaded file extension, including dangerous file formats so it can be used to bypass the...

CVE-2024-10820

The WooCommerce Upload Files plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadfiles function in all versions up to, and including, 84.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site...

CVE-2024-10820

CVE-2024-10820 : The WooCommerce Upload Files plugin for WordPress (versions ≤ 84.3) is vulnerable to unauthenticated arbitrary file uploads due to missing file type validation in upload_files(). This could allow an attacker to upload arbitrary files to the server and may enable remote code execu...

CVE-2024-9426

The Aqua SVG Sprite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and abov...

PT-2024-39625 · WordPress · Aqua Svg Sprite

Name of the Vulnerable Software and Affected Versions: Aqua SVG Sprite plugin for WordPress versions up to, and including, 3.0.14 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows...

PT-2024-16573 · WordPress · Woocommerce Upload Files

Name of the Vulnerable Software and Affected Versions: WooCommerce Upload Files plugin for WordPress versions up to, and including, 84.3 Description: The issue is related to arbitrary file uploads due to missing file type validation in the upload files function. This allows unauthenticated...

CVE-2024-10323

The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 1.0.18 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-lev...

CVE-2024-10323

JetWidgets For Elementor (WordPress) is affected by a Stored XSS via REST API SVG File Upload in all versions up to 1.0.18. Root cause: insufficient input sanitization and output escaping. Exploitation requires Author-level access or higher and can inject scripts that run when the SVG is viewed. ...

CVE-2024-10790 Admin and Site Enhancements (ASE) <= 7.5.1 - Authenticated Stored Cross-Site Scripting via SVG

The Admin and Site Enhancements ASE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 7.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level...

CVE-2024-10790

CVE-2024-10790 affects the WordPress plugin Admin and Site Enhancements (ASE) up to version 7.5.1 . It allows a Stored Cross-Site Scripting (XSS) via SVG file uploads due to insufficient input sanitization and output escaping. Exploitation requires an authenticated attacker with custom-level acce...

WordPress plugin Admin and Site Enhancements 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...