CVE-2024-3167

The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘twitterusername’ parameter in versions up to, and including, 2.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

WordPress Plugin Ocean Extra 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability exists in...

WordPress Ocean Extra Plugin <= 2.2.6 is vulnerable to Cross Site Scripting (XSS)

Software Ocean Extra Type Plugin Vulnerable versions = 2.2.6 Fixed in 2.2.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3167 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID d97829d0efb6 Credits wesley wcraft Required...

santuario: Private Key disclosure in debug-log output

All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to...

PT-2024-15715 · Unknown · Yunyou Cms

Name of the Vulnerable Software and Affected Versions: Yunyou CMS versions up to 2.2.6 Description: A critical vulnerability has been found in Yunyou CMS, affecting unknown code of the file /app/index/controller/Common.php. The manipulation of the templateFile argument leads to unrestricted uploa...

PT-2023-32113 · WordPress · Templately

Name of the Vulnerable Software and Affected Versions: Templately WordPress plugin versions prior to 2.2.6 Description: The issue concerns improper authorization of the saved-templates/delete API endpoint, allowing unauthenticated users to delete arbitrary posts. Recommendations: For versions pri...

WordPress Plugin Templately Access Control Error Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. An Access Control Error vulnerabili...

PT-2023-28614 · WordPress · Post Timeline

Name of the Vulnerable Software and Affected Versions: The Post Timeline WordPress plugin versions prior to 2.2.6 Description: The issue is related to a Reflected Cross-Site Scripting that could be used against high privilege users, such as admin. This occurs because the plugin does not sanitise...

GHSA-859M-2PFX-FWHF Code injection in oscore

oscore v2.2.6 and below was discovered to contain a code injection vulnerability in the component com.opensymphony.util.EJBUtils.createStateless. This vulnerability is exploited via passing an unchecked argument...

CVE-2023-3369

The About Me 3000 widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permission...

PT-2023-24448 · WordPress · About Me 3000

Name of the Vulnerable Software and Affected Versions: About Me 3000 widget plugin for WordPress versions up to, and including, 2.2.6 Description: The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows...

PT-2023-18747 · WordPress · Otter

Name of the Vulnerable Software and Affected Versions: Otter WordPress plugin versions prior to 2.2.6 Description: The issue arises from the plugin's failure to sanitize user-controlled file paths, leading to a PHAR deserialization vulnerability. This vulnerability can be exploited on PHP version...

WordPress License Manager for WooCommerce plugin <= 2.2.5 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress License Manager for WooCommerce plugin versions = 2.2.5. Solution Update the WordPress License Manager for WooCommerce plugin to the latest available version at least 2.2.6...

CVE-2019-15903 affecting package expat 2.2.6-4

CVE-2019-15903 affecting package expat 2.2.6-4. An upgraded version of the package is available that resolves this issue...

WordPress SupportCandy plugin <= 2.2.6 - Arbitrary Ticket Deletion via Cross-Site Request Forgery (CSRF) vulnerability

Arbitrary Ticket Deletion via Cross-Site Request Forgery CSRF vulnerability discovered by Brandon Roldan in WordPress SupportCandy plugin versions = 2.2.6. Solution Update the WordPress SupportCandy plugin to the latest available version at least 2.2.7...

Apache Archiva < 2.2.6 Multiple Log4j Vulnerabilities (Log4Shell) - Version Check

Apache Archiva is prone to multiple vulnerabilities in the Apache Log4j library. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Schlix CMS 2.2.6-6 - 'title' Persistent Cross-Site Scripting (Authenticated)

Exploit Title: Schlix CMS 2.2.6-6 - 'title' Persistent Cross-Site Scripting Authenticated Date: 2021-05-05 Exploit Author: Emircan Baş Vendor Homepage: https://www.schlix.com/ Software Link: https://www.schlix.com/downloads/schlix-cms/schlix-cms-v2.2.6-6.zip Version: 2.2.6-6 Tested on: Windows &...

Security Bulletin: Multiple security vulnerabilities in JAVA affects IBM Cloud Pak for Multicloud Management Monitoring

Summary Multiple security vulnerabilities in JAVA affects IBM Cloud Pak for Multicloud Management Monitoring Vulnerability Details CVEID: CVE-2020-14621 DESCRIPTION: An unspecified vulnerability in Java SE related to the JAXP component could allow an unauthenticated attacker to cause no...

UrBackup Buffer Overflow Vulnerability

UrBackup is an open source backup and recovery system for multiple platforms. A buffer overflow vulnerability exists in UrBackup version 2.2.6. The vulnerability stems from a networked system or product performing operations in memory without properly validating data boundaries, resulting in...

WordPress Human Resource Management Plugin < 2.2.6 Multiple Vulnerabilities

The WordPress plugin SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mishubd:wphumanresourcemanagement"; if description...