PT-2024-17231 · WordPress · Tcbd Popover

Name of the Vulnerable Software and Affected Versions: TCBD Popover plugin for WordPress versions prior to 1.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'tcbd-popover-image' shortcode due to insufficient input sanitization and output escaping on user-suppli...

WordPress plugin TCBD Popover 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2024-54296

CVE-2024-54296 describes an Authentication Bypass in CoSchool LMS (Codexpert, Inc.), allowing bypass of authentication due to Missing Authorization to Privilege Escalation. Affected versions: CoSchool LMS up to 1.2 (inclusive). Patch status in the provided records is Unpatched. CVSS v3.1 is liste...

WordPress WP-HideThat plugin <= 1.2 - CSRF to Stored Cross-Site Scripting vulnerability

CSRF to Stored Cross-Site Scripting vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin WP-HideThat versions = 1.2...

CVE-2024-12481

A vulnerability was found in cjbi wetech-cms 1.0/1.1/1.2. It has been declared as critical. Affected by this vulnerability is the function findUser of the file wetech-cms-master\wetech-core\src\main\java\tech\wetech\cms\dao\UserDao.java. The manipulation of the argument searchValue/gId/rId leads ...

CVE-2024-53734

Cross-Site Request Forgery CSRF vulnerability in Jamie O Idealien Category Enhancements idealien-category-enhancements allows Stored XSS.This issue affects Idealien Category Enhancements: from n/a through = 1.2...

WordPress plugin Custom Shortcode Sidebars 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

WordPress plugin Idealien Category Enhancements 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

PT-2024-35844 · Unknown · Jason Grim Custom Shortcode Sidebars

Name of the Vulnerable Software and Affected Versions: Jason Grim Custom Shortcode Sidebars versions 1.2 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a we...

WordPress plugin Ragic Shortcode 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Security Bulletin: IBM Data Virtualization Manager for z/OS has a remote code execution (RCE) vulnerability

Summary IBM Data Virtualization Manager for z/OS has a remote code execution RCE vulnerability. Vulnerability Details CVEID:CVE-2024-52899 DESCRIPTION: IBM Data Virtualization Manager for z/OS could allow an authenticated user to inject malicious JDBC URL parameters and execute code on the server...

WordPress Idealien Category Enhancements Plugin <= 1.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Idealien Category Enhancements Type Plugin Vulnerable versions = 1.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Request Forgery CSRF CVE CVE-2024-53734 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 2f6659c8a44b Credits SOPROBRO Required...

WordPress plugin WP-Orphanage Extended 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

WordPress Custom Shortcode Sidebars Plugin <= 1.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Custom Shortcode Sidebars Type Plugin Vulnerable versions = 1.2 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-53736 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID f06eb016030e Credits SOPROBRO...

PT-2024-16973 · WordPress · Wp-Orphanage Extended

Name of the Vulnerable Software and Affected Versions: WP-Orphanage Extended plugin for WordPress versions up to, and including, 1.2 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the wporphanageex menu settings function. This allow...

WordPress plugin Pure CSS Circle Progress bar 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists i...

CVE-2024-51209

Cross-Site Scripting XSS vulnerabilities in Anuj Kumar's Client Management System Version 1.2 allow local attackers to inject arbitrary web script or HTML via the search input field parameter to admin search invoice page and client search invoice page...

upKeeper 安全漏洞

upKeeper is a cloud-based or local solution from upKeeper Inc. A security vulnerability exists in upKeeper versions prior to 1.2, which stems from the presence of an incorrect privilege management vulnerability that allows privilege escalation...

CVE-2024-51209

The CVE describes Cross-Site Scripting (XSS) in Anuj Kumar’s Client Management System Version 1.2. The vulnerability affects the search input fields on the admin search invoices page and the client search invoices page, allowing an attacker to inject arbitrary web script or HTML. Technical contex...

CVE-2024-51636

CVE-2024-51636 corresponds to a CSRF to Stored XSS vulnerability in the GMO Social Connection WordPress plugin (versions &lt;= 1.2). The issue, defined as CSRF enabling XSS, affects that plugin as described in multiple feeds (including Patchstack/Red Hat/NVD references). No explicit fix version i...