CVE-2020-26309 GHSL-2020-303: Regular Expression Denial of Service (ReDoS) in nope-validator

Validate.js provides a declarative way of validating javascript objects. Versions 0.11.3 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service ReDoS. As of time of publication, it is unknown if any patches are available...

CVE-2020-26303

The CVE-2020-26303 entry concerns the insane HTML sanitizer. Affected versions are 2.6.2 and earlier. The underlying issue is a Regular Expression Denial of Service (ReDoS) vulnerability in one or more regular expressions used by the sanitizer. Public documentation indicates that as of publicatio...

WordPress Sogrid Plugin <= 1.5.6 is vulnerable to Local File Inclusion

Software Sogrid Type Plugin Vulnerable versions = 1.5.6 Fixed in 1.5.7 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-8392 Patch priority Low CVSS severity Low 7.2 Developer Claim ownership PSID 1c3f3f9f16d6 Credits paulmockford Required privilege Administrator...

WordPress Signup Page Plugin <= 1.0 is vulnerable to Privilege Escalation

Software Signup Page Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-50475 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 15ed63623277 Credits Mika Required...

PT-2024-33024 · Hanzhou Haobo · Hanzhou Haobo Network Management System

Name of the Vulnerable Software and Affected Versions: Hanzhou Haobo network management system version 1.0 Description: A SQL injection issue allows a remote attacker to execute arbitrary code via a crafted script. Recommendations: For Hanzhou Haobo network management system version 1.0, at the...

WordPress Poll Maker Plugin <= 5.4.6 is vulnerable to SQL Injection

Software Poll Maker Type Plugin Vulnerable versions = 5.4.6 Fixed in 5.4.7 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-9475 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID be15c21e4c00 Credits Ivan Kuzymchak Required privilege Administrator Publish...

WordPress Wux Blog Editor Plugin <= 3.0.0 is vulnerable to Arbitrary File Upload

Software Wux Blog Editor Type Plugin Vulnerable versions = 3.0.0 Fixed in N/A OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-9932 Patch priority High CVSS severity High 10 Developer Claim ownership PSID fb6562f2b82e Credits István Márton Required privilege...

WordPress Token Login Plugin <= 1.0.3 is vulnerable to Broken Authentication

Software Token Login Type Plugin Vulnerable versions = 1.0.3 Fixed in N/A OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2024-50488 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 18531b1d1720 Credits stealthcopte...

WordPress Acnoo Flutter API Plugin <= 1.0.5 is vulnerable to Privilege Escalation

Software Acnoo Flutter API Type Plugin Vulnerable versions = 1.0.5 Fixed in N/A OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-50486 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 69fb59b59cf8 Credits...

WordPress Cozy Blocks Plugin <= 2.0.18 is vulnerable to Cross Site Scripting (XSS)

Software Cozy Blocks Type Plugin Vulnerable versions = 2.0.18 Fixed in 2.0.19 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-50502 Patch priority Low CVSS severity Low 6.5 Developer CozyThemes PSID 2887e7a845fe Credits Michael Required privilege Contributor...

WordPress ScottCart Plugin <= 1.1 is vulnerable to Remote Code Execution (RCE)

Software ScottCart Type Plugin Vulnerable versions = 1.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Remote Code Execution RCE CVE CVE-2024-50492 Patch priority High CVSS severity High 8.3 Developer Claim ownership PSID bd1f778da3e5 Credits Mika Required privilege Unauthenticated...

WordPress WP Awesome Login Plugin <= 0.4.0 is vulnerable to Cross Site Scripting (XSS)

Software WP Awesome Login Type Plugin Vulnerable versions = 0.4.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9456 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 140160df9cee Credits Francesco Carlucci Requir...

WordPress Realty Workstation Plugin <= 1.0.45 is vulnerable to Broken Authentication

Software Realty Workstation Type Plugin Vulnerable versions = 1.0.45 Fixed in N/A OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2024-50489 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 8f086511377f Credits...

WordPress Forms for Mailchimp by Optin Cat Plugin <= 2.5.6 is vulnerable to Cross Site Scripting (XSS)

Software Forms for Mailchimp by Optin Cat Type Plugin Vulnerable versions = 2.5.6 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8870 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 95ff17d053e3 Credits vgo...

WordPress Extensions by HocWP Team Plugin <= 0.2.3.2 is vulnerable to Broken Authentication

Software Extensions by HocWP Team Type Plugin Vulnerable versions = 0.2.3.2 Fixed in N/A OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2024-9930 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 7d51f78c234b Credit...

WordPress Wux Blog Editor Plugin <= 3.0.0 is vulnerable to Broken Authentication

Software Wux Blog Editor Type Plugin Vulnerable versions = 3.0.0 Fixed in N/A OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2024-9931 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 140fce8f5a83 Credits István...

WordPress Trip Plan Plugin <= 1.0.10 is vulnerable to Cross Site Scripting (XSS)

Software Trip Plan Type Plugin Vulnerable versions = 1.0.10 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-50471 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID be92d248bf15 Credits SOPROBRO Required privilege Contributor...

WordPress App Builder Plugin <= 5.3.7 is vulnerable to Broken Authentication

Software App Builder Type Plugin Vulnerable versions = 5.3.7 Fixed in 5.3.8 OWASP Top 10 A3: Injection Classification Broken Authentication CVE CVE-2024-9302 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 82e5ff2f8d20 Credits wesley wcraft Required privilege...

WordPress Textboxes Plugin <= 0.1.3.1 is vulnerable to Cross Site Scripting (XSS)

Software Textboxes Type Plugin Vulnerable versions = 0.1.3.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-50469 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 50ef1a0649e6 Credits SOPROBRO Required privilege Contributor...

WordPress Qode Essential Addons Plugin <= 1.6.3 is vulnerable to Local File Inclusion

Software Qode Essential Addons Type Plugin Vulnerable versions = 1.6.3 Fixed in 1.6.4 OWASP Top 10 A1: Broken Access Control Classification Local File Inclusion CVE CVE-2024-50457 Patch priority Low CVSS severity Low 7.5 Developer Qode Interactive PSID 91c64e17ca1a Credits João Pedro S Alcântara...