CMSimple_XH Security Vulnerability

CMSimpleXH is a fast, small, easy-to-use and easy-to-install modular content management system CMS from CMSimpleXH open source. A security vulnerability exists in CMSimpleXH version 1.7.6, which stems from a cross-site scripting attack that can be performed by uploading a carefully crafted SVG...

PT-2024-25906 · Unknown · Cmsimple Xh

Name of the Vulnerable Software and Affected Versions: CMSimple XH version 1.7.6 Description: The issue allows for cross-site scripting XSS by uploading a crafted SVG document. Recommendations: For CMSimple XH version 1.7.6, as a temporary workaround, consider restricting the upload of SVG...

WordPress Opal Estate Pro plugin <= 1.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by emad in WordPress Plugin Opal Estate Pro versions = 1.7.6...

WordPress plugin MailerLite 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2024-17998 · WordPress · Mailerlite

Name of the Vulnerable Software and Affected Versions: MailerLite – Signup forms plugin for WordPress versions 1.5.0 through 1.7.6 Description: The issue is related to Stored Cross-Site Scripting via the plugin's shortcodes due to insufficient input sanitization and output escaping on user-suppli...

PT-2024-22175 · Mailerlite · Mailerlite – Signup Forms

Name of the Vulnerable Software and Affected Versions: MailerLite – Signup forms official plugin for WordPress versions up to, and including, 1.7.6 Description: The issue allows unauthorized plugin setting changes due to a missing capability check on the toggleRolesAndPermissions and...

WordPress MailerLite – Signup forms (official) plugin <= 1.7.6 - Missing Authorization vulnerability

Missing Authorization vulnerability discovered by Krzysztof Zając in WordPress Plugin MailerLite versions = 1.7.6...

PT-2024-24017

Name of the Vulnerable Software and Affected Versions WP Event Aggregator versions 1.7.6 and earlier Description A Cross-Site Request Forgery CSRF issue has been identified. This type of issue allows an attacker to trick a user into performing unintended actions on a web application that the user...

PT-2024-24299 · Unknown · Simple Post Notes

Name of the Vulnerable Software and Affected Versions: Simple Post Notes versions 1.7.6 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software. This type of issue allows an attacker to perform unintended actions on a user's behalf. Recommendations: For versions 1.7....

WordPress WP Event Aggregator plugin <= 1.7.6 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Majed Refaea Patchstack Alliance in WordPress Plugin WP Event Aggregator versions = 1.7.6...

WordPress WP Event Aggregator Plugin <= 1.7.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP Event Aggregator Type Plugin Vulnerable versions = 1.7.6 Fixed in 1.7.7 OWASP Top 10 A4: Insecure Design Classification Cross Site Request Forgery CSRF CVE CVE-2024-31371 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID c79f1a6daa54 Credits Majed Refaea Required...

CVE-2024-23683 Artemis Java Test Sandbox InvocationTargetException Subclass Escape

Artemis Java Test Sandbox versions less than 1.7.6 are vulnerable to a sandbox escape when an attacker crafts a special subclass of InvocationTargetException. An attacker can abuse this issue to execute arbitrary Java when a victim executes the supposedly sandboxed code...

PT-2023-31847 · WordPress · Fluent Support

Name of the Vulnerable Software and Affected Versions: Fluent Support – WordPress Helpdesk and Customer Support Ticket Plugin versions 1.7.6 and earlier Description: The issue is related to an SQL Injection vulnerability due to the improper neutralization of special elements used in an SQL comman...

CVE-2023-51687

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in impleCode Product Catalog Simple.This issue affects Product Catalog Simple: from n/a through 1.7.6...

PT-2023-31881 · Unknown · Implecode Product Catalog Simple

Name of the Vulnerable Software and Affected Versions: impleCode Product Catalog Simple versions 1.7.6 and earlier Description: The issue is related to the exposure of sensitive information to an unauthorized actor. This is a problem where sensitive data is made available to individuals who shoul...

CVE-2023-28491

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Tribulant Slideshow Gallery LITE.This issue affects Slideshow Gallery LITE: from n/a through 1.7.6...

PT-2023-21756 · Tribulant · Tribulant Slideshow Gallery

Name of the Vulnerable Software and Affected Versions: Tribulant Slideshow Gallery LITE versions 1.7.6 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for potential exploitation ...

CVE-2023-48780

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in EnigmaWeb WP Catalogue allows Stored XSS.This issue affects WP Catalogue: from n/a through 1.7.6...

CVE-2023-5756

The Digital Publications by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.6. This is due to missing or incorrect nonce validation on the AJAX action handler. This makes it possible for unauthenticated attackers to execute AJAX...

PT-2023-32305 · Supsystic · Digital Publications By Supsystic

Name of the Vulnerable Software and Affected Versions: Digital Publications by Supsystic plugin for WordPress versions up to, and including, 1.7.6 Description: The issue is due to missing or incorrect nonce validation on the AJAX action handler, making it possible for unauthenticated attackers to...