PT-2024-29465 · Unknown · Money Manager Ex Webapp

Name of the Vulnerable Software and Affected Versions: Money Manager EX WebApp versions 1.2.2 Description: The issue is related to Incorrect Access Control. The redirect if not loggedin function in functions security.php fails to terminate script execution after redirecting unauthenticated users...

PT-2024-39337

Name of the Vulnerable Software and Affected Versions: WP Adminify – Custom WordPress Dashboard, Login and Admin Customizer plugin for WordPress versions up to, and including, 4.0.1.6 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input...

WordPress plugin INK Official 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in WordPress...

ZZCMS 代码问题漏洞

ZZCMS is a content management system CMS by the ZZCMS team in China. A code issue vulnerability exists in ZZCMS version 2023, which stems from the parameter savefilename in file 3/Ebak5.1/upload/ChangeTable.php that can lead to unrestricted uploads...

PT-2024-33609 · Unknown · Ecomerciar Woocommerce Custom Profile Picture

Name of the Vulnerable Software and Affected Versions: Ecomerciar Woocommerce Custom Profile Picture versions 1.0 and earlier Description: The issue allows for the unrestricted upload of files with dangerous types, enabling an attacker to upload a web shell to a web server. Recommendations: For...

WordPress plugin 3D Work In Progress 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists i...

WordPress plugin Verbalize WP 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

ZZCMS 代码问题漏洞

ZZCMS is a content management system CMS by the ZZCMS team in China. A code issue vulnerability exists in ZZCMS version 2023, which stems from the parameter file in file 3/Ebbak5.1/upload/class/functions.php that can lead to unrestricted uploads...

The vulnerability of the desktop publishing system Adobe Framemaker lies in the lack of restrictions on file downloads, which allows a hacker to execute arbitrary code.

The vulnerability of the desktop publishing system Adobe Framemaker lies in the lack of restrictions on file uploads. Exploiting this vulnerability allows an attacker to execute arbitrary code...

WordPress plugin Portfolleo 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

CVE-2024-10201

Administrative Management System from Wellchoose does not properly validate uploaded file types, allowing remote attackers with regular privileges to upload and execute webshells...

WordPress plugin WP Dropbox Dropins 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

PT-2024-33566 · Unknown · Paxman Product Website Showcase

Name of the Vulnerable Software and Affected Versions: Paxman Product Website Showcase versions n/a through 1.0 Description: The issue allows an unrestricted upload of files with dangerous types, enabling the upload of a web shell to a web server. This can potentially allow attackers to deploy...

PT-2024-33468 · Unknown · Woostagram Connect

Name of the Vulnerable Software and Affected Versions: Woostagram Connect versions 1.0.0 through 1.0.2 Description: The issue allows unrestricted upload of dangerous file types, which can lead to web server compromise by uploading a web shell. This can be exploited by uploading malicious files to...

PT-2024-33470 · Vivek Tamrakar · Wp Rest Api Fns

Name of the Vulnerable Software and Affected Versions: Vivek Tamrakar WP REST API FNS versions 1.0.0 and earlier Description: The issue allows attackers to upload harmful content, including web shells, to a web server due to an Unrestricted Upload of File with Dangerous Type vulnerability. This c...

CVE-2024-9674

The Debrandify · Remove or Replace WordPress Branding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2024-9674

The Debrandify · Remove or Replace WordPress Branding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2024-9674

CVE-2024-9674 relates to the Debrandify – Remove or Replace WordPress Branding plugin for WordPress. The vulnerability is a Stored Cross-Site Scripting (XSS) via SVG file uploads in all versions up to 1.1.2, caused by insufficient input sanitization and output escaping. An attacker with Author-le...

CVE-2024-9848

The Product Customizer Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access...

CVE-2024-9366

The Easy Menu Manager | WPZest plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level acces...