CVE-2024-10584

CVE-2024-10584 affects the DirectoryPress – Business Directory And Classified Ad Listing WordPress plugin. It is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to 3.6.16 due to insufficient input sanitization/output escaping. Exploitation requires authenticated ...

CVE-2024-10584 DirectoryPress <= 3.6.16 - Authenticated (Author+) Stored Cross-Site Scripting

The DirectoryPress – Business Directory And Classified Ad Listing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.6.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...

CVE-2024-12881

The PlugVersions – Easily rollback to previous versions of your plugins plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the eospluginreviewsrestoreversion function in all versions up to, and including, 0.0.7. This makes it possible for authenticat...

CVE-2024-12881 PlugVersions – Easily rollback to previous versions of your plugins <= 0.0.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Creation

The PlugVersions – Easily rollback to previous versions of your plugins plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the eospluginreviewsrestoreversion function in all versions up to, and including, 0.0.7. This makes it possible for authenticat...

CVE-2024-12881

The CVE affects PlugVersions – Easily rollback to previous versions of your plugins (WordPress plugin). Root cause: missing capability check in eos_plugin_reviews_restore_version() across all versions up to 0.0.7, enabling authenticated users with Subscriber+ privileges to create arbitrary files ...

PT-2024-17773 · WordPress · Plugversions

Name of the Vulnerable Software and Affected Versions: PlugVersions plugin for WordPress versions up to, and including, 0.0.7 Description: The issue is related to a missing capability check on the eos plugin reviews restore version function, allowing authenticated attackers with Subscriber-level...

PT-2024-16383 · WordPress · Directorypress

Name of the Vulnerable Software and Affected Versions: DirectoryPress – Business Directory And Classified Ad Listing plugin for WordPress versions up to, and including, 3.6.16 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input...

Vulnerabilities fixed in IBM Cognos Analytics

IBM fixed vulnerabilities in IBM Cognos Analytics The vulnerability in IBM Cognos Analytics arises from improper validation of file extensions, allowing remote attackers to upload arbitrary files. This security issue can lead to the execution of malicious code on the affected system, posing a...

PT-2024-36681 · Wplms · Wplms

Name of the Vulnerable Software and Affected Versions: WPLMS versions 1.9.9 and earlier Description: The issue allows for the unrestricted upload of files with dangerous types, enabling an attacker to upload a web shell to a web server. This can be exploited by uploading malicious files,...

CVE-2024-40695

IBM Cognos Analytics 11.2.0 through 11.2.4 FP4 and 12.0.0 through 12.0.4 could be vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface. Attackers can make use of this weakness and upload malicious executable files into the system, and it can ...

CVE-2024-9619

The WP SHAPES plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to...

CVE-2024-9619

CVE-2024-9619 affects the WP SHAPES WordPress plugin. The vulnerability is Stored Cross-Site Scripting via SVG file uploads in all versions up to 1.0.0, caused by insufficient input sanitization and output escaping. It requires authenticated access at Author level or higher to exploit. The connec...

CVE-2024-9619 WP SHAPES <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The WP SHAPES plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to...

PT-2024-39722 · WordPress · Wp Shapes

Name of the Vulnerable Software and Affected Versions: WP SHAPES plugin for WordPress versions up to, and including, 1.0.0 Description: The issue is related to stored Cross-Site Scripting via SVG file uploads due to insufficient input sanitization and output escaping. This allows authenticated...

WordPress plugin WPLMS 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A code issue...

WordPress plugin WPLMS 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A code issue...

WordPress plugin WPLMS 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A code issue...

VulnCheck KEV: CVE-2022-23227

NUUO NVRmini2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users...

WordPress plugin WPLMS 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A code issue...

CVE-2024-55513

A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90. The component affected by this issue is /uploadnetaction.php on the web interface. By crafting a suitable form name, arbitrary files can be uploaded, potentially leading to unauthorized access to server permission...