CVE-2024-0826 Qi Addons For Elementor <= 1.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-2513 WP Chat App <= 3.6.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Block Image Attribute

The WP Chat App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'imageAlt' block attribute in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-2845 BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg <= 3.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.4.2 due to insufficient input...

CVE-2023-6993

The Custom post types, Custom Fields & more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode and custom post meta in all versions up to, and including, 5.0.4 due to insufficient input sanitization and output escaping on user supplied post meta values...

CVE-2024-3266 Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget URL Attribute

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attribute of widgets in all versions up to, and including, 4.8.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-3064

CVE-2024-3064 affects the Elementor Addons, Widgets and Enhancements – Stax plugin for WordPress. It is a Stored XSS in the plugin’s Heading widget across versions up to 1.4.4.1 due to insufficient input sanitization and output escaping. Exploitation requires authenticated access at contributor l...

Arista NG Firewall ReportEntry SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Arista NG Firewall. Authentication is required to exploit this vulnerability. The specific flaw exists within the ReportEntry class. The issue results from the lack of proper validation of a...

Shortcodes Ultimate < 7.0.5 - Contributor+ Stored Cross-Site Scripting via 'note_color' Shortcode

Description The plugin is vulnerable to Stored Cross-Site Scripting via the plugin's 'notecolor' shortcode in all versions up to, and including, 7.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

SQL Injection

Centreon is vulnerable to SQL Injection. The vulnerability is due to improper validation of user-supplied strings before using them to construct SQL queries, specifically within the updateDirectory function. An attacker can leverage this vulnerability to execute code in the context of the service...

SQL Injection

Centreon is vulnerable to SQL Injection. The vulnerability is due to improper validation of user-supplied strings before using them to construct SQL queries, specifically within the updateLCARelation function. An attacker can leverage this vulnerability to execute code in the context of the servi...

SQL Injection

Centreon is vulnerable to SQL Injection. The vulnerability is due to improper validation of user-supplied strings before using them to construct SQL queries, specifically within the updateContactServiceCommands function. An attacker can leverage this vulnerability to execute code in the context o...

SQL Injection

centreon is vulnerable to SQL Injection. The vulnerability is due to improper sanitization of user-supplied strings before using them to construct SQL queries, specifically within the updateGroups function. An attacker can leverage this vulnerability to execute code in the context of the service...

GPT Academic 安全漏洞

GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. GPT Academic suffers from a code execution vulnerability that arises from unsafe deserialization of serialized data received by an application from a user, which can be exploited by an...

CVE-2024-2499 Squelch Tabs and Accordions Shortcodes <= 0.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via accordions Shortcode

The Squelch Tabs and Accordions Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'accordions' shortcode in all versions up to, and including, 0.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

Sql Injection

centreon/centreon is vulnerable to Sql Injection.The vulnerability is due to inadequate validation of user-supplied input in the updateContactHostCommands function, enabling attackers to execute arbitrary code with the privileges of the service account...

Cisco Unified Communications Manager IM & Presence XSS (cisco-sa-cucm-imps-xss-quWkd9yF)

According to its self-reported version, Cisco Unified Communications Manager IM & Presence running on the report host is affected by a coss-site scripting XSS vulnerability. The vulnerability exists in the web-based management interface due to improper validation of user-supplied input before...

CVE-2024-2830

The CVE-2024-2830 issue affects the WordPress Tag and Category Manager – AI Autotagger (Simple Tags) plugin, vulnerable up to version 3.13.0. A stored XSS flaw exists in the st_tag_cloud shortcode caused by insufficient input sanitization and escaping of user-supplied attributes. In the shortcode...

CVE-2024-2830 WordPress Tag and Category Manager – AI Autotagger <= 3.13.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The WordPress Tag and Category Manager – AI Autotagger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sttagcloud' shortcode in all versions up to, and including, 3.13.0 due to insufficient input sanitization and output escaping on user supplied attributes. Thi...

CVE-2024-2803 ElementsKit Elementor addons <= 3.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget

The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the countdown widget in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

WP Travel Engine < 5.8.0 - Authenticated (Administrator+) SQL Injection

Description The WP Travel Engine plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers...