CVE-2024-10011 BuddyPress <= 14.1.0 - Authenticated (Subscriber+) Directory Traversal

The BuddyPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 14.1.0 via the id parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform actions on files outside of the originally intended...

PT-2024-15976 · Wpforms · File Upload Types

Name of the Vulnerable Software and Affected Versions: File Upload Types by WPForms plugin for WordPress versions up to, and including, 1.4.0 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allo...

WordPress plugin File Upload Types by WPForms 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in PHP. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress plugin File Upload Typ...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the file name. An attacker who can upload heic images is able to execute code on the remote server. Remediation Upgrade maestroerror/php-heic-to-jpg to version 1.0.5 or higher. References - GitHub Commit -...

CVE-2024-8959

The WP Adminify – Custom WordPress Dashboard, Login and Admin Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.0.1.6 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-8959

CVE-2024-8959 - WP Adminify (WordPress Plugin) Affected: WP Adminify – Custom WordPress Dashboard, Login and Admin Customizer (versions

PT-2024-29465 · Unknown · Money Manager Ex Webapp

Name of the Vulnerable Software and Affected Versions: Money Manager EX WebApp versions 1.2.2 Description: The issue is related to Incorrect Access Control. The redirect if not loggedin function in functions security.php fails to terminate script execution after redirecting unauthenticated users...

PT-2024-33609 · Unknown · Ecomerciar Woocommerce Custom Profile Picture

Name of the Vulnerable Software and Affected Versions: Ecomerciar Woocommerce Custom Profile Picture versions 1.0 and earlier Description: The issue allows for the unrestricted upload of files with dangerous types, enabling an attacker to upload a web shell to a web server. Recommendations: For...

WordPress plugin Verbalize WP 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

ZZCMS 代码问题漏洞

ZZCMS is a content management system CMS by the ZZCMS team in China. A code issue vulnerability exists in ZZCMS version 2023, which stems from the parameter savefilename in file 3/Ebak5.1/upload/ChangeTable.php that can lead to unrestricted uploads...

WordPress plugin INK Official 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in WordPress...

WordPress plugin 3D Work In Progress 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists i...

ZZCMS 代码问题漏洞

ZZCMS is a content management system CMS by the ZZCMS team in China. A code issue vulnerability exists in ZZCMS version 2023, which stems from the parameter file in file 3/Ebbak5.1/upload/class/functions.php that can lead to unrestricted uploads...

The vulnerability of the desktop publishing system Adobe Framemaker lies in the lack of restrictions on file downloads, which allows a hacker to execute arbitrary code.

The vulnerability of the desktop publishing system Adobe Framemaker lies in the lack of restrictions on file uploads. Exploiting this vulnerability allows an attacker to execute arbitrary code...

WordPress plugin Portfolleo 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

CVE-2024-10201

Administrative Management System from Wellchoose does not properly validate uploaded file types, allowing remote attackers with regular privileges to upload and execute webshells...

PT-2024-33468 · Unknown · Woostagram Connect

Name of the Vulnerable Software and Affected Versions: Woostagram Connect versions 1.0.0 through 1.0.2 Description: The issue allows unrestricted upload of dangerous file types, which can lead to web server compromise by uploading a web shell. This can be exploited by uploading malicious files to...

PT-2024-33566 · Unknown · Paxman Product Website Showcase

Name of the Vulnerable Software and Affected Versions: Paxman Product Website Showcase versions n/a through 1.0 Description: The issue allows an unrestricted upload of files with dangerous types, enabling the upload of a web shell to a web server. This can potentially allow attackers to deploy...

PT-2024-33470 · Vivek Tamrakar · Wp Rest Api Fns

Name of the Vulnerable Software and Affected Versions: Vivek Tamrakar WP REST API FNS versions 1.0.0 and earlier Description: The issue allows attackers to upload harmful content, including web shells, to a web server due to an Unrestricted Upload of File with Dangerous Type vulnerability. This c...

WordPress plugin WP Dropbox Dropins 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...