WordPress Restaurant Menu – Food Ordering System – Table Reservation Plugin <= 2.4.0 is vulnerable to Cross Site Scripting (XSS)

Software Restaurant Menu – Food Ordering System – Table Reservation Type Plugin Vulnerable versions = 2.4.0 Fixed in 2.4.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1399 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID...

WordPress Video Gallery Plugin <= 1.3.13 is vulnerable to Local File Inclusion

Software Video Gallery Type Plugin Vulnerable versions = 1.3.13 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-4551 Patch priority Low CVSS severity Low 6.4 Developer Claim ownership PSID 0a0b54f79834 Credits Foxyyy Required privilege Contributor Publishe...

WordPress Folders Plugin <= 3.0 is vulnerable to Path Traversal

Software Folders Type Plugin Vulnerable versions = 3.0 Fixed in 3.0.1 OWASP Top 10 A1: Broken Access Control Classification Path Traversal CVE CVE-2024-2023 Patch priority Medium CVSS severity Medium 4.1 Developer Claim ownership PSID 79dd420f62c9 Credits Colin Xu Required privilege Author...

WordPress Gutenberg Blocks by Kadence Blocks Plugin <= 3.2.38 is vulnerable to Cross Site Scripting (XSS)

Software Gutenberg Blocks by Kadence Blocks Type Plugin Vulnerable versions = 3.2.38 Fixed in 3.2.39 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4863 Patch priority Low CVSS severity Low 6.5 Developer KadenceWP PSID 422e929006f1 Credits...

WordPress Folders Pro Plugin <= 3.0.2 is vulnerable to Arbitrary File Upload

Software Folders Pro Type Plugin Vulnerable versions = 3.0.2 Fixed in 3.0.3 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-2024 Patch priority Medium CVSS severity Medium 8 Developer Claim ownership PSID 56270bd65a1a Credits Colin Xu Required privilege Author Publish...

WordPress Themify Builder Plugin < 7.5.8 is vulnerable to Open Redirection

Software Themify Builder Type Plugin Vulnerable versions 7.5.8 Fixed in 7.5.8 OWASP Top 10 A1: Injection Classification Open Redirection CVE CVE-2024-3032 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID 72a5598c790a Credits Valentin LOBSTEIN Required privilege...

WordPress PowerPack Addons for Elementor Plugin <= 2.7.20 is vulnerable to Cross Site Scripting (XSS)

Software PowerPack Addons for Elementor Type Plugin Vulnerable versions = 2.7.20 Fixed in 2.7.21 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5787 Patch priority Low CVSS severity Low 6.5 Developer IdeaBox Creations PSID 1bf7fbc45735 Credits wesle...

CVE-2024-37301 document-merge-service vulnerable to Remote Code Execution via Server-Side Template Injection

Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Versions 6.5.1 and prior are vulnerable to remote code execution via server-side template injection which, when executed as root, can result in full takeover of the...

WordPress ShopLentor Plugin <= 2.9.0 is vulnerable to Cross Site Scripting (XSS)

Software ShopLentor Type Plugin Vulnerable versions = 2.9.0 Fixed in 2.9.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5530 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 7f83560dcee5 Credits wesley wcraft Required...

WordPress Bookly Plugin <= 23.2 is vulnerable to Cross Site Scripting (XSS)

Software Bookly Type Plugin Vulnerable versions = 23.2 Fixed in 23.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5584 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 6392bd62a07f Credits 0xBishop Required privilege...

Google Chrome 安全漏洞

Google Chrome is a web browser from Google, an American company. A security bypass vulnerability exists in versions prior to Google Chrome 126.0.6478.54, which can be exploited by an attacker to bypass autonomous access control via a crafted HTML page...

PT-2024-26961 · Awkblog · Awkblog

Name of the Vulnerable Software and Affected Versions: awkblog versions 0.0.1 and earlier Description: A remote unauthenticated attacker can execute an arbitrary OS command with the privileges of the affected product by sending a specially crafted HTTP request. This issue allows for the execution...

WordPress Premium Addons for Elementor Plugin <= 4.10.33 is vulnerable to Cross Site Scripting (XSS)

Software Premium Addons for Elementor Type Plugin Vulnerable versions = 4.10.33 Fixed in 4.10.34 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5553 Patch priority Low CVSS severity Low 6.5 Developer LeapWorx PSID 89dccdfaef3d Credits wesley wcraft...

@1xtr/yc-log-client (>=1.0.6, <=1.1.1), @a11ywatch/a11ywatch (>=0.2.126, <=0.3.82) +82 more potentially affected by CVE-2024-37168 via @grpc/grpc-js (>=1.10.0, <=1.10.8)

@grpc/grpc-js NPM version =1.10.0, =1.0.6, =0.2.126, =0.8.16, =0.9.58, =3.1.9, =0.78.0, =1.68.0, =8.5.1-alpha.4, =3.5.2, =17.8.3, =0.0.1-hw-fix-code-nightly-gha.29105, =0.1.5-hw-fix-code-nightly-gha.29105, =0.1.5-pd-ent-755-gha.29158 and more Source cves: CVE-2024-37168 Source advisory:...

PT-2024-27170 · Linksys · Linksys Velop Wifi 5

Name of the Vulnerable Software and Affected Versions: Linksys Velop WiFi 5 WHW01v1 version 1.1.13.202617 Description: The issue is related to insecure permissions, allowing attackers to escalate privileges from Guest to root. Recommendations: For version 1.1.13.202617, at the moment, there is no...

WordPress Custom Field Template Plugin <= 2.6.1 is vulnerable to Cross Site Scripting (XSS)

Software Custom Field Template Type Plugin Vulnerable versions = 2.6.1 Fixed in 2.6.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-0653 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID fe4e0cf2229e Credits Sh Required privilege Administrat...

WordPress Custom Field Template Plugin <= 2.6.1 is vulnerable to Cross Site Scripting (XSS)

Software Custom Field Template Type Plugin Vulnerable versions = 2.6.1 Fixed in 2.6.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0627 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 79102f5cc8d6 Credits Luk 6785 Required...

CVE-2023-5424

The CVE-2023-5424 entry refers to WS Form LITE for WordPress being vulnerable to CSV Injection in versions up to 1.9.217. An unauthenticated attacker could embed untrusted input into exported CSV files, which is stated to lead to code execution when a vulnerable file is opened. The connected docu...

CVE-2023-5424 WS Form LITE <= 1.9.217 - Unauthenticated CSV Injection

The WS Form LITE plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.9.217. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system...

WordPress Music Store Plugin <= 1.1.13 is vulnerable to SQL Injection

Software Music Store Type Plugin Vulnerable versions = 1.1.13 Fixed in 1.1.14 OWASP Top 10 A3: Injection Classification SQL Injection CVE N/A Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 3ee22c619ee0 Credits Noriko Totsuka JPCERT/CC Required privilege Unauthenticated...