Lingdang CRM 代码问题漏洞

Lingdang CRM Lingdang CRM is a customer relationship management system from the Chinese company Lingdang Lingdang. A code issue vulnerability exists in Lingdang CRM version 8.6.4.3 and prior versions, which stems from the parameter file in file/crm/wechatSession/index.php?msgid=1&operation=upload...

WordPress Instant Image Generator (One Click Image Uploads from Pixabay, Pexels and OpenAI) plugin <= 1.5.2 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin Instant Image Generator versions = 1.5.2...

WordPress plugin Forms 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

WordPress plugin Audio Record 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in...

PT-2024-34918

Name of the Vulnerable Software and Affected Versions Made I.T. Forms versions from n/a through 2.8.0 Description The issue allows for the unrestricted upload of files with dangerous types, enabling the upload of a web shell to a web server. This can lead to remote code execution RCE. The...

CVE-2024-10801

The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajaxmanagefilechunkupload function in all versions up to, and including, 16.5. This makes it possible for unauthenticated attackers to upload arbitrary files on...

CVE-2024-10547

The WP Membership plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the userprofileimageupload function in all versions up to, and including, 1.6.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected...

CVE-2024-10547

CVE-2024-10547 (WP Membership, WordPress) is documented with concrete details: the WP Membership plugin (all versions up to and including 1.6.2) is vulnerable to unauthenticated arbitrary file uploads due to missing file type validation in user_profile_image_upload(). This can allow an attacker t...

CVE-2024-10627

The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajaxmanagefilechunkupload function in all versions up to, and including, 17.7. This makes it possible for unauthenticated attackers to upload arbitrary fil...

CVE-2024-10627

The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajaxmanagefilechunkupload function in all versions up to, and including, 17.7. This makes it possible for unauthenticated attackers to upload arbitrary fil...

CVE-2024-8960

The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level...

CVE-2024-8960

The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level...

CVE-2024-8960

CVE-2024-8960: Cowidgets – Elementor Addons for WordPress suffers Stored Cross-Site Scripting via SVG uploads in all versions

CVE-2024-9270

CVE-2024-9270 is active in Lenxel Core LMS (Lenxel Core) WordPress plugin prior to 1.2.3, vulnerable to Stored XSS via SVG file uploads due to insufficient input sanitization and output escaping. Affected versions up to 1.1 allow an authenticated attacker (Author+ level) to inject scripts in page...

PT-2024-16560

Name of the Vulnerable Software and Affected Versions WordPress User Extra Fields plugin versions up to and including 16.5 Description The WordPress User Extra Fields plugin is vulnerable to arbitrary file uploads due to missing file type validation in the ajax manage file chunk upload function...

WordPress plugin WordPress User Extra Fields 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists i...

BIT-MEMCACHED-2022-48571

memcached 1.6.7 allows a Denial of Service via multi-packet uploads in UDP...

RLSA-2024:8842 Moderate: python3.12-urllib3 security update

urllib3 is a powerful, user-friendly HTTP client for Python. urllib3 brings many critical features that are missing from the Python standard libraries: • Thread safety. • Connection pooling. • Client-side SSL/TLS verification. • File uploads with multipart encoding. • Helpers for retrying request...

CVE-2024-10325

The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 1.6.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-10325

CVE-2024-10325 affects Elementor Header & Footer Builder (Ultimate Addons for Elementor) for WordPress. Desktop/REST SVG File Uploads allow Stored XSS due to insufficient input sanitization and output escaping in SVG handling. Affected versions: up to 1.6.45. Exploitation requires authentication ...