406 matches found
CVE-2025-23023 Anonymous cache poisoning via request headers in Discourse
Discourse is an open source platform for community discussion. In affected versions an attacker can carefully craft a request with the right request headers to poison the anonymous cache for example, the cache may have a response with missing preloaded data. This issue only affects anonymous...
CVE-2025-23023
CVE-2025-23023 affects Discourse where an attacker can craft a request with specific headers to poison the anonymous cache, potentially returning incomplete preloaded data for anonymous visitors. Multiple sources confirm the issue, and Red Hat and OSV entries mirror this description. The vendor h...
PT-2025-3161 · Discourse · Discourse
Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the latest version Description: Discourse is an open source platform for community discussion. In affected versions, an attacker can make a crafted XHR request to poison the anonymous cache, which may have a respon...
PT-2025-4771 · Discourse · Discourse
Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the latest version Description: Discourse is an open source platform for community discussion. In affected versions, an attacker can carefully craft a request with the right request headers to poison the anonymous...
CVE-2024-11396
The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.3 via the Visitors List Export file. During the export, a CSV file is created in the wp-content folder with a hardcoded filena...
MediaWiki 信息泄露漏洞
MediaWiki is a suite of free and freely available web-based Wiki engines from the Wikimedia Foundation in the United States. The product can be used to deploy internal knowledge management and content management systems. An information disclosure vulnerability exists in Mediawiki - SocialProfile...
CVE-2024-11396 Event monster <= 1.4.3 - Information Exposure Via Visitors List Export
The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.3 via the Visitors List Export file. During the export, a CSV file is created in the wp-content folder with a hardcoded filena...
CVE-2024-11396 Event monster <= 1.4.3 - Information Exposure Via Visitors List Export
The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.3 via the Visitors List Export file. During the export, a CSV file is created in the wp-content folder with a hardcoded filena...
CVE-2024-11396
CVE-2024-11396 : The WordPress plugin Event Monster – Event Management, Tickets Booking, Upcoming Event (versions up to 1.4.3) allows information exposure via the Visitors List Export. During export, a CSV is created in wp-content with a public filename, letting unauthenticated attackers access v...
CVE-2025-22384
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue concerning business logic exists in the Commerce B2B application, which allows storefront visitors to purchase discontinued products in specific scenarios where requests are altered before reaching...
CVE-2025-22384
CVE-2025-22384 affects Optimizely Configured Commerce prior to version 5.2.2408. The issue is a medium-severity business‑logic flaw in the Commerce B2B application that can let storefront visitors purchase discontinued products when requests are manipulated before reaching the server. Impact is d...
1,000+ web shops infected by “Phish ‘n Ships” criminals who create fake product listings for in-demand products
Researchers at the Satori Threat Intelligence and Research team have published their findings about a group of cybercriminals that infect legitimate web shops to create and promote fake product listings. The threat, dubbed "Phish ‘n Ships" by the researchers, reportedly infected more than 1,000...
CVE-2020-36838
The Facebook Chat Plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wpajaxupdateoptions function in versions up to, and including, 1.5. This flaw makes it possible for low-level authenticated attackers to connect their own Facebook Messenger accou...
BIT-DISCOURSE-2024-47773 Anonymous cache poisoning via XHR requests in Discourse
Discourse is an open source platform for community discussion. An attacker can make several XHR requests until the cache is poisoned with a response without any preloaded data. This issue only affects anonymous visitors of the site. This problem has been patched in the latest version of Discourse...
CVE-2024-47773 Anonymous cache poisoning via XHR requests in Discourse
Discourse is an open source platform for community discussion. An attacker can make several XHR requests until the cache is poisoned with a response without any preloaded data. This issue only affects anonymous visitors of the site. This problem has been patched in the latest version of Discourse...
CVE-2024-47773
Discourse CVE-2024-47773 describes an anonymous cache-poisoning vulnerability triggered by multiple XHR requests that can contaminate the cache for anonymous visitors. Affected software is Discourse (noted in multiple sources) with patches in the latest released version; remediation guidance also...
CVE-2024-47773 Anonymous cache poisoning via XHR requests in Discourse
Discourse is an open source platform for community discussion. An attacker can make several XHR requests until the cache is poisoned with a response without any preloaded data. This issue only affects anonymous visitors of the site. This problem has been patched in the latest version of Discourse...
CVE-2024-47773 Anonymous cache poisoning via XHR requests in Discourse
Discourse is an open source platform for community discussion. An attacker can make several XHR requests until the cache is poisoned with a response without any preloaded data. This issue only affects anonymous visitors of the site. This problem has been patched in the latest version of Discourse...
CVE-2022-4541
The WordPress Visitors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a spoofed HTTP Header value in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
CVE-2022-4541
The WordPress Visitors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a spoofed HTTP Header value in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...