WordPress plugin BuddyPress Greeting Message 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

PT-2024-34265 · Unknown · Priyabrata Sarkar Token Login

Name of the Vulnerable Software and Affected Versions: Priyabrata Sarkar Token Login versions 1.0.3 and earlier Description: The issue allows for authentication bypass using an alternate path or channel. This can lead to unauthorized access. Recommendations: For Priyabrata Sarkar Token Login...

WordPress Token Login plugin <= 1.0.3 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin Token Login versions = 1.0.3...

WordPress 3D Work In Progress plugin <= 1.0.3 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin 3D Work In Progress versions = 1.0.3...

WordPress BuddyPress Greeting Message plugin <= 1.0.3 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin BuddyPress Greeting Message versions = 1.0.3...

WordPress 3D Work In Progress Plugin <= 1.0.3 is vulnerable to Arbitrary File Deletion

Software 3D Work In Progress Type Plugin Vulnerable versions = 1.0.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Deletion CVE CVE-2024-49657 Patch priority High CVSS severity High 7.7 Developer Claim ownership PSID 209728d5f5a9 Credits stealthcopter Required privilege...

WordPress plugin Photo Gallery Slideshow & Masonry Tiled Gallery SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A SQL injection vulnerability exists in the...

WordPress plugin Social Share With Floating Bar 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress plugin Social Share With Floating Bar version...

CVE-2024-49219

Incorrect Privilege Assignment vulnerability in themexpo RS-Members allows Privilege Escalation.This issue affects RS-Members: from n/a through 1.0.3...

WordPress Social Share With Floating Bar plugin <= 1.0.3 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Social Share With Floating Bar versions = 1.0.3...

PT-2024-33355 · Themexpo · Themexpo Rs-Members

Name of the Vulnerable Software and Affected Versions: themexpo RS-Members versions 1.0.3 and earlier Description: The issue is related to an Incorrect Privilege Assignment vulnerability, which allows Privilege Escalation in themexpo RS-Members. Recommendations: For themexpo RS-Members versions...

PT-2024-39254 · WordPress · Social Share With Floating Bar

Name of the Vulnerable Software and Affected Versions: The Social Share With Floating Bar plugin for WordPress versions up to, and including, 1.0.3 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg without appropriate escaping on the URL. This...

WordPress Easy Load More plugin <= 1.0.3 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Easy Load More versions = 1.0.3...

WordPress plugin Easy Load More 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

TP-LINK Kasa KP125M 安全漏洞

TP-LINK Kasa KP125M is a smart plug from China P&L TP-LINK. A security vulnerability exists in the TP-Link Kasa KP125M v1.0.3, which stems from an issue in the API gateway that can be exploited by an attacker to establish a connection by impersonating a device owned by another user...

Malicious code in randompackage-notreal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1f9c2160c65a4352d89013d032c20e0f4cf59a5f34ca2f96baf3aeeca5858a7b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-6925

CVE-2024-6925 affects the TrueBooker WordPress plugin. Technical details in connected sources show that prior to version 1.0.3, the plugin did not perform a CSRF check when updating its settings, enabling a logged-in admin to be coerced into changing settings via CSRF. Red Hat notes mirror this d...

WordPress plugin TrueBooker 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2024-37962 · WordPress · Truebooker

Name of the Vulnerable Software and Affected Versions: The TrueBooker WordPress plugin versions prior to 1.0.3 Description: The issue is related to a SQL injection vulnerability. It occurs because the plugin does not properly sanitise and escape a parameter before using it in a SQL statement via ...

PT-2024-37963 · WordPress · Truebooker

Name of the Vulnerable Software and Affected Versions: The TrueBooker WordPress plugin versions prior to 1.0.3 Description: The issue is related to the lack of a CSRF check when updating settings in the plugin. This could allow attackers to make a logged-in admin change settings via a CSRF attack...