125 matches found
CVE-2024-13816
The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability checks on multiple functions in all versions up to, and including, 2.3.6. This mak...
WordPress Aiomatic plugin <= 2.3.6 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrator Actions vulnerability
Missing Authorization to Authenticated Subscriber+ Multiple Administrator Actions vulnerability discovered by Lucio Sá in WordPress Plugin Aiomatic versions = 2.3.6...
WordPress plugin Aiomatic - AI Content Writer, Editor, ChatBot & AI Toolkit 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...
CVE-2024-54954
OneBlog v2.3.6 was discovered to contain a template injection vulnerability via the template management department...
CVE-2024-54954
OneBlog v2.3.6 was discovered to contain a template injection vulnerability via the template management department...
CVE-2024-54954
OneBlog v2.3.6 is affected by a template injection vulnerability in the template management area (CVE-2024-54954). Affected product/component: OneBlog, version 2.3.6. Root cause details are not fully disclosed in the provided documents, but the vulnerability is described as template injection. Im...
CVE-2024-31090
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in 荒野无灯 Hacklog Down As PDF allows Reflected XSS.This issue affects Hacklog Down As PDF: from n/a through 2.3.6...
WordPress plugin Ticketmeo – Sell Tickets – Event Ticketing 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...
PT-2025-3929 · WordPress · Ticketmeo – Sell Tickets – Event Ticketing
Name of the Vulnerable Software and Affected Versions: Ticketmeo – Sell Tickets – Event Ticketing plugin for WordPress versions up to, and including, 2.3.6 Description: The issue is related to Stored Cross-Site Scripting via the plugin's shortcodes due to insufficient input sanitization and outpu...
WeGIA 跨站脚本漏洞
WeGIA is a web manager for welfare organizations by the individual developer Nilson Lazarin. A cross-site scripting vulnerability exists in WeGIA version 2.3.6, which stems from a stored cross-site scripting vulnerability contained in the nome parameter of the adicionaralergia.php page...
CVE-2024-37448
Cross-Site Request Forgery CSRF vulnerability in famethemes OnePress onepress allows Cross Site Request Forgery.This issue affects OnePress: from n/a through = 2.3.6...
CVE-2024-37448 WordPress OnePress theme <= 2.3.6 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in famethemes OnePress onepress allows Cross Site Request Forgery.This issue affects OnePress: from n/a through = 2.3.6...
CVE-2024-37448
CVE-2024-37448 describes a Cross-Site Request Forgery in FameThemes OnePress WordPress theme (affecting version up to 2.3.6). Exploitation would enable unauthorized actions performed by CSRF on behalf of a logged-in user, per Red Hat and Wordfence entries referencing OnePress
WordPress plugin SQL Chart Builder SQL注入漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...
CVE-2024-51378
getresetstatus in dns/views.py and ftp/views.py in CyberPanel aka Cyber Panel before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware which is only for a POST request and using shell...
PT-2024-33216 · Wanxing Technology · Wanxing Technology Yitu Project Management Kirin Edition
Name of the Vulnerable Software and Affected Versions: Wanxing Technology Yitu Project Management Kirin Edition version 2.3.6 Description: The issue allows a remote attacker to execute arbitrary code via a specially constructed so file in /opt/EdrawProj-2/plugins/imageformat. This enables the...
WonderShare Yitu 安全漏洞
WonderShare Yitu Yitu is a one-stop office drawing tool from China-based WonderShare. A security vulnerability exists in WonderShare Yitu version 2.3.6, which can be exploited to execute arbitrary code via the /opt/EdrawProj-2/plugins/imageformat file...
PT-2024-28313
Name of the Vulnerable Software and Affected Versions requirejs version 2.3.6 Description The issue allows attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties through a prototype pollution vulnerability in the config function. Recommendations Fo...
RequireJS Security Vulnerability
RequireJS is an open source library for RequireJS. It is used to load common JavaScript files as well as more defined modules. A security vulnerability exists in RequireJS version v2.3.6, which originates from the inclusion of prototype contamination via the function s.contexts..configure, allowi...
