CVE-2024-1468 Avada | Website Builder For WordPress & WooCommerce <= 7.11.4 - Authenticated (Contributor+) Arbitrary File Upload

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajaximportoptions function in all versions up to, and including, 7.11.4. This makes it possible for authenticated attackers, with...

CVE-2023-25921

IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. IBM X-Force ID: 247620...

WordPress Plugin Mollie Payments for WooCommerce Code Issue Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists in...

CVE-2024-25859

A path traversal vulnerability in the /path/to/uploads/ directory of Blesta before v5.9.2 allows attackers to takeover user accounts and execute arbitrary code...

Blesta Security Breach

Blesta is a customer relationship management system from Blesta. A security vulnerability exists in Blesta versions prior to v5.9.2 that stems from a path traversal vulnerability in the /path/to/uploads/ directory. An attacker can exploit this vulnerability to take over a user account and execute...

PT-2024-18072 · WordPress · Avada

Name of the Vulnerable Software and Affected Versions: Avada | Website Builder For WordPress & WooCommerce theme for WordPress versions up to, and including, 7.11.4 Description: The issue is related to arbitrary file uploads due to missing file type validation in the ajax import options function...

IBM Security Guardium Code Issue Vulnerability

IBM Security Guardium is a suite of platforms from International Business Machines IBM that provide data protection capabilities. The platform includes features such as customized UI, report management and streamlined audit process building. A code issue vulnerability exists in IBM Security...

PT-2024-12078 · Ibm · Ibm Security Guardium Key Lifecycle Manager

Name of the Vulnerable Software and Affected Versions: IBM Security Guardium Key Lifecycle Manager versions 3.0 through 4.1.1 Description: The issue allows an attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment...

WordPress plugin WP JobSearch security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

Beijing Baichuo Smart S42 Management Platform Code Issue Vulnerability

Beijing Baichuo Smart S42 is an Internet Behavior Management appliance from Beijing Baichuo, China. A code issue exists in Beijing Baichuo Smart S42 Management Platform 20240219 and prior versions, which originates from an unknown function in /useratte/userattestation.php that causes unrestricted...

LightPicture Code Issue Vulnerability

LightPicture is an enterprise/team/individual image resource management system, graphic bed system by osuuuu individual developers. LightPicture 1.2.2 and previous versions have a code issue vulnerability, the vulnerability stems from the file /app/controller/Setup.php will lead to unrestricted...

freescout Code Issue Vulnerability

freescout is an ultra-lightweight and powerful free open source helpdesk and shared inbox built using PHP Laravel framework. A code issue vulnerability exists in freescout that stems from allowing unlimited uploads of dangerous types of files...

CVE-2024-1710

The Addon Library plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the onAjaxAction function action in all versions up to, and including, 1.3.76. This makes it possible for authenticated attackers, with subscriber-level access and above, to...

WordPress Plugin Moveto Code Issue Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists i...

Complaint Management System Code Issue Vulnerability

Complaint Management System is a complaint management system by the individual developer Arvin Arandilla. A code issue vulnerability exists in version 1.0 of Complaint Management System, which stems from unrestricted file uploads...

WordPress Plugin Icons Font Loader Code Issue Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in...

PT-2024-18241 · WordPress · Addon Library

Name of the Vulnerable Software and Affected Versions: Addon Library plugin for WordPress versions up to, and including, 1.3.76 Description: The issue is related to a missing capability check on the onAjaxAction function action, allowing authenticated attackers with subscriber-level access and...

Brizy – Page Builder < 2.4.41 - Authenticated (Contributor+) Arbitrary File Upload

Description The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the storeImages function in all versions up to, and including, 2.4.40. This makes it possible for authenticated attackers, with contributor access or above, to...

CodeAstro Membership Management System Code Issue Vulnerability

CodeAstro Membership Management System is a membership management system from CodeAstro. A code issue vulnerability exists in CodeAstro Membership Management System version 1.0, which stems from the component Logo Handler's file /uploads/ that can lead to unrestricted uploads...

PT-2024-18333 · Unknown · Codeastro Membership Management System

Name of the Vulnerable Software and Affected Versions: CodeAstro Membership Management System version 1.0 Description: A critical issue was found in the Logo Handler component, specifically affecting some unknown functionality of the file /uploads/. This issue leads to unrestricted upload. The...