KMQTT 安全漏洞

KMQTT is a Kotlin multi-platform MQTT 3.1.1/5.0 client and proxy from the individual developer Davide Pianca. A security vulnerability exists in KMQTT version v0.2.7 that stems from an issue that allows an attacker to cause a denial of service DoS via a crafted request...

VulnCheck KEV: CVE-2020-36834

The Discount Rules for WooCommerce plugin for WordPress is vulnerable to missing authorization via several AJAX actions in versions up to, and including, 2.0.2 due to missing capability checks on various functions. This makes it possible for subscriber-level attackers to execute various actions...

VulnCheck KEV: CVE-2016-15040

The Kento Post View Counter plugin for WordPress is vulnerable to SQL Injection via the 'kentopvcgeo' parameter in versions up to, and including, 2.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

PT-2024-38379 · WordPress · Forms For Mailchimp By Optin Cat

Name of the Vulnerable Software and Affected Versions: The Forms for Mailchimp by Optin Cat – Grow Your MailChimp List plugin for WordPress versions up to, and including, 2.5.6 Description: The issue is related to Stored Cross-Site Scripting via the form color parameters due to insufficient input...

PT-2024-39767 · WordPress · Rescue Shortcodes

Name of the Vulnerable Software and Affected Versions: Rescue Shortcodes plugin for WordPress versions up to, and including, 2.8 Description: The issue is related to Stored Cross-Site Scripting via the plugin's rescue tab shortcode due to insufficient input sanitization and output escaping on...

Security update for apache-commons-io

This update for apache-commons-io fixes the following issues: Upgrade to 2.17.0: CVE-2024-47554: Fixed untrusted input to XmlStreamReader can lead to uncontrolled resource consumption bsc1231298 Other changes: - https://commons.apache.org/proper/commons-io/changes-report.htmla2.17.0 Patch...

CVE-2024-9520

The UserPlus plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 2.0. This makes it possible for authenticated attackers with subscriber-level permissions or above, ...

CVE-2024-9522

The WP Users Masquerade plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.0. This is due to incorrect authentication and capability checking in the 'ajaxmasqlogin' function. This makes it possible for authenticated attackers, with subscriber-level...

Classroombookings 安全漏洞

Classroombookings is a Php, Mysql based school room booking system by Craig A Rodway Individual Developer. A security vulnerability exists in Classroombookings version 2.8.7, which stems from the parameter Name of the file/sessions of the component Session Page can lead to a cross-site scripting...

DEBIAN-CVE-2024-28168

Improper Restriction of XML External Entity Reference 'XXE' vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: 2.9. Users are recommended to upgrade to version 2.10, which fixes the issue...

UBUNTU-CVE-2024-28168

Improper Restriction of XML External Entity Reference 'XXE' vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: 2.9. Users are recommended to upgrade to version 2.10, which fixes the issue...

WordPress Telecash Ricaricaweb plugin <= 2.2 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin Telecash Ricaricaweb versions = 2.2...

PT-2024-39605 · WordPress · [Product]

Name of the Vulnerable Software and Affected Versions: Products, Order & Customers Export for WooCommerce plugin for WordPress versions up to, and including, 2.0.15 Description: The issue is related to Reflected Cross-Site Scripting, which occurs due to the use of add query arg and remove query a...

eWeLink 安全漏洞

eWeLink is a smart home assistant from eWeLink, Inc. A security vulnerability exists in eWeLink version 2.0.0 and prior versions that stems from SSL Pinning bypassing certain hardware products, allowing a local attacker to decrypt TLS communications and extract secrets in order to clone the devic...

CVE-2024-47356

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Catch Themes Create allows Stored XSS.This issue affects Create: from n/a through 2.9.1...

PT-2024-32546 · Unknown · Sky Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Sky Addons for Elementor versions through 2.5.11 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Stored XSS. This means that an attacker ca...

WordPress plugin Payflex Payment Gateway 输入验证错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An input validation error...

WordPress plugin WP Cleanup and Basic Functions 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

TP-LINK TL-WDR5620 安全漏洞

TP-LINK TL-WDR5620 is a wireless router from China P&L TP-LINK. A security vulnerability exists in TP-LINK TL-WDR5620 version 2.3, which originates from a remote code execution vulnerability contained in the httpProcDataSrv function...

WordPress Paid Membership Subscriptions plugin <= 2.12.8 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Colin Xu in WordPress Plugin Paid Member Subscriptions versions = 2.12.8...