138 matches found
CVE-2025-29773 Froxlor allows Multiple Accounts to Share the Same Email Address Leading to Potential Privilege Escalation or Account Takeover
Froxlor is open-source server administration software. A vulnerability in versions prior to 2.2.6 allows users such as resellers or customers to create accounts with the same email address as an existing account. This creates potential issues with account identification and security. This...
Improper Authentication
Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Improper Authentication due to missing restrictions to create accounts using the same email address, allowing an attacker to escalate privileges or take over accounts by registering...
FlowiseAI Flowise arbitrary file upload vulnerability
FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments...
Flowise 代码问题漏洞
Flowise is a FlowiseAI open source tool for easily building LLM applications. A security vulnerability exists in Flowise version 2.2.6 that stems from the presence of an arbitrary file upload issue...
CVE-2024-32555
Incorrect Privilege Assignment vulnerability in InspiryThemes Easy Real Estate easy-real-estate allows Privilege Escalation.This issue affects Easy Real Estate: from n/a through = 2.2.9...
WordPress Safe SVG Plugin < 2.2.6 XSS Vulnerability
The WordPress plugin SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:safesvgproject:safesvg"; ifdescription...
CVE-2024-13372
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.6 via the getresumefiledownloadbyid and getallresumefiles functions due to missing validation on a us...
CVE-2024-13371
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized arbitrary emails sending due to a missing capability check on the sendEmailToJobSeeker function in all versions up to, and including, 2.2.6. This makes it possible...
WordPress plugin WP Job Portal 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
WordPress WP Job Portal plugin <= 2.2.6 - Insecure Direct Object Reference to Authenticated (Employer+) Arbitrary Company Deletion vulnerability
Insecure Direct Object Reference to Authenticated Employer+ Arbitrary Company Deletion vulnerability discovered by thevietronin in WordPress Plugin WP Job Portal versions = 2.2.6...
WordPress WP Job Portal plugin <= 2.2.6 - Insecure Direct Object Reference to Unauthenticated Company Logo Deletion vulnerability
Insecure Direct Object Reference to Unauthenticated Company Logo Deletion vulnerability discovered by thevietronin in WordPress Plugin WP Job Portal versions = 2.2.6...
CVE-2024-32555
CVE-2024-32555 : An Unauthenticated Privilege Escalation in the WordPress plugin Easy Real Estate (affected: from n/a through 2.2.6) arises from an Incorrect Privilege Assignment . The CVE is categorized with a CRITICAL impact (CVSS 3.1: 9.8; vectors: NETWORK, no user interaction required, privil...
CVE-2024-32555 WordPress Easy Real Estate plugin <= 2.2.6 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in NotFound Easy Real Estate allows Privilege Escalation. This issue affects Easy Real Estate: from n/a through 2.2.6...
WordPress plugin Easy Real Estate 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...
WordPress WordPress Brute Force Protection – Stop Brute Force Attacks Plugin <= 2.2.6 is vulnerable to Cross Site Scripting (XSS)
Software WordPress Brute Force Protection – Stop Brute Force Attacks Type Plugin Vulnerable versions = 2.2.6 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10869 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership...
PT-2024-16602 · WordPress · Wordpress Brute Force Protection – Stop Brute Force Attacks
Name of the Vulnerable Software and Affected Versions: WordPress Brute Force Protection – Stop Brute Force Attacks plugin for WordPress versions up to, and including, 2.2.6 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg and remove query arg...
WordPress plugin Safe SVG 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
PT-2024-38982 · WordPress · Safe-Svg
Name of the Vulnerable Software and Affected Versions: Safe SVG WordPress plugin versions prior to 2.2.6 Description: The issue arises because the sanitisation code in the Safe SVG WordPress plugin only runs for paths that call wp handle upload, but not for code that uses wp handle sideload, whic...
WordPress AForms Plugin <= 2.2.6 is vulnerable to Sensitive Data Exposure
Software AForms Type Plugin Vulnerable versions = 2.2.6 Fixed in 2.2.7 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-6565 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 25ef6cfd65dd Credits stealthcopter Required privilege...