WordPress plugin Broadly for WordPress 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripti...

WordPress Broadly for WordPress plugin <= 3.0.2 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nabil Irawan in WordPress Plugin Broadly for WordPress versions = 3.0.2...

Malicious code in elysium-checkout (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1d164cca14ffe6f3b767b73a34dd534c8b74f7d39d685e0630c29ff04f25fc5a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-31942

Cross-Site Request Forgery CSRF vulnerability in typps Calendarista Basic Edition calendarista-basic-edition.This issue affects Calendarista Basic Edition: from n/a through = 3.0.2...

CVE-2024-3868

The Folders Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's First Name and Last Name in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2024-5001

The Image Hover Effects for Elementor with Lightbox and Flipbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id', 'oxiaddonsftitletag', and 'contentdescriptiontag' parameters in all versions up to, and including, 3.0.2 due to insufficient input sanitization and outpu...

CVE-2024-52585

Autolab is a course management service that enables auto-graded programming assignments. There is an HTML injection vulnerability in version 3.0.1 that can affect instructors and CAs on the grade submissions page. The issue is patched in version 3.0.2. One may apply the patch manually by editing...

CVE-2023-22362

SUSHIRO App for Android outputs sensitive information to the log file, which may result in an attacker obtaining a credential information from the log file. Affected products/versions are as follows: SUSHIRO Ver.4.0.31, Thailand SUSHIRO Ver.1.0.0, Hong Kong SUSHIRO Ver.3.0.2, Singapore SUSHIRO...

CVE-2023-26013

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in WPChill Strong Testimonials plugin = 3.0.2 versions...

CVE-2023-1947

A vulnerability was found in taoCMS 3.0.2. It has been classified as critical. Affected is an unknown function of the file /admin/admin.php. The manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used...

CVE-2021-37832

A SQL injection vulnerability exists in version 3.0.2 of Hotel Druid when SQLite is being used as the application database. A malicious attacker can issue SQL commands to the SQLite database through the vulnerable idappartamenti parameter...

CVE-2009-3974

Multiple SQL injection vulnerabilities in Invision Power Board IPB or IP.Board 3.0.0, 3.0.1, and 3.0.2 allow remote attackers to execute arbitrary SQL commands via the 1 searchterm parameter to admin/applications/core/modulespublic/search/search.php and 2 aid parameter to...

CVE-2024-11372 Connexion Logs <= 3.0.2 - Admin+ SQL Injection

The Connexion Logs WordPress plugin through 3.0.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...

PT-2025-21421 · WordPress · The Connexion Logs Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: The Connexion Logs WordPress plugin versions 3.0.2 and earlier Description: The issue is related to the lack of a CSRF check when updating settings in the plugin, which could allow attackers to make a logged-in admin change them via a CSRF...

CVE-2024-29643

CVE-2024-29643 affects croogo v3.0.2 and is due to Host header injection in the feed.rss component. The vulnerability occurs when the feed.rss code passes the HTTP Host header content into a response element (e.g., a link) without proper filtering, enabling an attacker to influence redirect-like ...

Croogo 安全漏洞

Croogo is Croogo open source a set of CakePHP framework based on the development of content management system CMS. The system provides content type can be customized as Blog, Node, Page, content editing using WYSIWYG editor and other features. Croogo version 3.0.2 security vulnerabilities , the...

PT-2025-17297 · Croogo · Croogo

Name of the Vulnerable Software and Affected Versions: croogo version 3.0.2 Description: The issue allows an attacker to perform Host header injection via the feed.rss component. Recommendations: For croogo version 3.0.2, consider disabling the feed.rss component until a patch is available...

CVE-2024-55211

An issue in Think Router Tk-Rt-Wr135G V3.0.2-X000 allows attackers to bypass authentication via a crafted cookie...

PT-2025-17211 · Unknown · Think Router Tk-Rt-Wr135G

Name of the Vulnerable Software and Affected Versions: Think Router Tk-Rt-Wr135G version 3.0.2-X000 Description: The issue allows attackers to bypass authentication via a crafted cookie. Recommendations: For Think Router Tk-Rt-Wr135G version 3.0.2-X000, as a temporary workaround, consider...

Think Router Tk-Rt-Wr135G 安全漏洞

Think Router Tk-Rt-Wr135G is a router from Think. A security vulnerability exists in the Think Router Tk-Rt-Wr135G version V3.0.2-X000, which originates from an authentication bypass that can be accomplished with a specially crafted cookie...