BIT-MEMCACHED-2022-48571

memcached 1.6.7 allows a Denial of Service via multi-packet uploads in UDP...

RLSA-2024:8842 Moderate: python3.12-urllib3 security update

urllib3 is a powerful, user-friendly HTTP client for Python. urllib3 brings many critical features that are missing from the Python standard libraries: • Thread safety. • Connection pooling. • Client-side SSL/TLS verification. • File uploads with multipart encoding. • Helpers for retrying request...

CVE-2024-10325

The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 1.6.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-10325

CVE-2024-10325 affects Elementor Header & Footer Builder (Ultimate Addons for Elementor) for WordPress. Desktop/REST SVG File Uploads allow Stored XSS due to insufficient input sanitization and output escaping in SVG handling. Affected versions: up to 1.6.45. Exploitation requires authentication ...

CVE-2024-10269

The Easy SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access a...

PT-2024-16421

Name of the Vulnerable Software and Affected Versions WooCommerce Support Ticket System plugin for WordPress versions up to, and including, 17.7 Description The issue is related to arbitrary file uploads due to missing file type validation in the ajax manage file chunk upload function. This allow...

PT-2024-16189

Name of the Vulnerable Software and Affected Versions Elementor Header & Footer Builder plugin for WordPress versions up to, and including, 1.6.45 Description The issue is related to Stored Cross-Site Scripting via REST API SVG File uploads due to insufficient input sanitization and output...

CVE-2024-10269: Improper Neutralization of Input During Web Page Generation

The Easy SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access a...

CodeAstro Real Estate Management System code-related vulnerabilities

CodeAstro Real Estate Management System is a real estate management system from CodeAstro. A code issue vulnerability exists in CodeAstro Real Estate Management System version 1.0, which stems from the parameter aimage in the file /aboutedit.php that can lead to unrestricted uploads...

Codezips Online Institute Management System code-related vulnerabilities

Codezips Online Institute Management System is a Codezips open source online institute management system. A code issue vulnerability exists in Codezips Online Institute Management System version 1.0, which stems from the parameter websiteimage in the file /managewebsite.php that can lead to...

Codezips Online Institute Management System security vulnerabilities

Codezips Online Institute Management System is an open source online institute management system from Codezips. A security vulnerability exists in Codezips Online Institute Management System version 1.0, which stems from the parameter image in the file /edituser.php that can lead to unrestricted...

PT-2024-39528 · WordPress · Lenxel Core For Lenxel(Lnx) Lms

Name of the Vulnerable Software and Affected Versions: Lenxel Core for LenxelLNX LMS plugin for WordPress versions up to, and including, 1.1 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allow...

CVE-2024-10325: Improper Neutralization of Input During Web Page Generation

The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 1.6.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CodeAstro Real Estate Management System code-related vulnerabilities

CodeAstro Real Estate Management System is a real estate management system from CodeAstro. A code issue vulnerability exists in CodeAstro Real Estate Management System version 1.0, which stems from the parameter aimage in the file /aboutadd.php that can lead to unrestricted uploads...

PT-2024-39338

Name of the Vulnerable Software and Affected Versions: The Cowidgets – Elementor Addons plugin for WordPress versions up to, and including, 1.2.0 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This...

PT-2024-16148

Name of the Vulnerable Software and Affected Versions Easy SVG Support plugin for WordPress versions up to, and including, 3.7 Description The Easy SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads due to insufficient input sanitization an...

WordPress AI Pack Code Execution

Vulnerability of the handleimageUpload function in the plugin for creating customizable content based on artificial intelligence AI: The Complete AI Pack of the WordPress content management system is associated with unlimited uploading of dangerous types of files. Exploiting this vulnerability...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the Create User function. An attacker can inject malicious scripts by uploading specially crafted SVG files. This is only exploitable if the application does not properly sanitize user input specifically...

CVE-2024-20476

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to bypass the authorization mechanisms for specific file management functions. This vulnerability is due to lack of server-side validation of Administrator permissions. An attacker cou...

CVE-2024-8614

The JobSearch WP Job Board plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jobsearchwphandleupload function in all versions up to, and including, 2.6.7. This makes it possible for authenticated attackers, with subscriber-level access and...