WordPress Interface theme <= 3.1.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Theme Interface versions = 3.1.0...

Telerik Report Server Authentication Bypass / Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/zip' class MetasploitModule 'Telerik Report Server Auth Bypass and Deserialization RCE', 'Description' = %q This module chains an authentication bypass...

WordPress Weather Widget Pro plugin <= 1.1.40 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin Weather Widget Pro versions = 1.1.40...

WordPress Photo Gallery by 10Web plugin <= 1.8.23 - Authenticated (Contributor+) Path Traversal via esc_dir Function vulnerability

Authenticated Contributor+ Path Traversal via escdir Function vulnerability discovered by Tobias Weißhaar kun19 in WordPress Plugin Photo Gallery by 10Web versions = 1.8.23...

WordPress WooCommerce Tools plugin <= 1.2.9 - Missing Authorization to Authenticated (Subscriber+) Plugin Module Deactivation vulnerability

Missing Authorization to Authenticated Subscriber+ Plugin Module Deactivation vulnerability discovered by Lucio Sá in WordPress Plugin WooCommerce Tools versions = 1.2.9...

MLflow Security Vulnerabilities

Mlflow is an open source platform for machine learning lifecycles. A security vulnerability exists in MLflow that stems from the discovery of a Local File Inclusion LFI vulnerability...

Wipro Holmes Orchestrator 20.4.1 - Log File Disclosure Exploit

Exploit Title: Wipro Holmes Orchestrator 20.4.1 - Log File Disclosure Exploit Author: Rizal Muhammed @ub3rsick Vendor Homepage: https://www.wipro.com/holmes/ Version: Wipro Holmes Orchestrator v20.4.1 Tested on: Windows CVE : CVE-2021-38283 import requests as rq import argparse import datetime...

Wipro Holmes Orchestrator 20.4.1 - Log File Disclosure

Exploit Title: Wipro Holmes Orchestrator 20.4.1 - Log File Disclosure Date: 09/08/2021 Exploit Author: Rizal Muhammed @ub3rsick Vendor Homepage: https://www.wipro.com/holmes/ Version: Wipro Holmes Orchestrator v20.4.1 Tested on: Windows CVE : CVE-2021-38283 import requests as rq import argparse...

WordPress WP Prayer II plugin <= 2.4.7 - CSRF Leading to Email Settings Change vulnerability

CSRF Leading to Email Settings Change vulnerability discovered by Bob Matyas in WordPress Plugin WP Prayer II versions = 2.4.7...

CVE-2024-35561

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/cadeal.php?mudi=add&nohrefStr=close...

WordPress WPKoi Templates for Elementor plugin <= 2.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Parameters vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Multiple Parameters vulnerability discovered by stealthcopter in WordPress Plugin WPKoi Templates for Elementor versions = 2.5.9...

WordPress Elegant Blocks – Amazing Gutenberg Blocks plugin <= 1.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by 4rCanJ0x! Patchstack Alliance in WordPress Plugin Elegant Blocks versions = 1.7...

CVE-2024-34958

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component admin/bannerdeal.php?mudi=add...

WordPress Ketos theme <= 1.0.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Theme Ketos versions = 1.0.5...

WordPress Envo's Elementor Templates & Widgets for WooCommerce plugin <=1.4.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by 4rCanJ0x! Patchstack Alliance in WordPress Plugin Envo's Elementor Templates & Widgets for WooCommerce versions = 1.4.8...

WordPress Breakdance plugin <= 1.7.1 - Authenticated (Contributor+) Remote Code Execution vulnerability

Authenticated Contributor+ Remote Code Execution vulnerability discovered by Francesco Carlucci in WordPress Plugin Breakdance versions = 1.7.1...

WordPress Startklar Elementor Addons plugin <= 1.7.13 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by István Márton in WordPress Plugin Startklar Elementor Addons versions = 1.7.13...

WordPress Auto Affiliate Links plugin <= 6.4.3.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Do Truong Giang Patchstack Alliance in WordPress Plugin Auto Affiliate Links versions = 6.4.3.1...

Elber Cleber/3 Broadcast Multi-Purpose Platform 1.0.0 - Authentication Bypass

Elber Cleber/3 Broadcast Multi-Purpose Platform 1.0.0 Authentication Bypass Vendor: Elber S.r.l. Product web page: https://www.elber.it Affected version: 1.0.0 Revision 7304 1.0.0 Revision 7284 1.0.0 Revision 6505 1.0.0 Revision 6332 1.0.0 Revision 6258 XS2DAB v1.50 rev 6267 Summary: Cleber offer...

WordPress WPify Woo Czech plugin <= 4.0.10 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Dimas Maulana Patchstack Alliance in WordPress Plugin WPify Woo Czech versions = 4.0.10...