WordPress Quiz And Survey Master Plugin < 9.1.1 is vulnerable to Cross Site Scripting (XSS)

Software Quiz And Survey Master Type Plugin Vulnerable versions 9.1.1 Fixed in 9.1.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6879 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 69638eed0571 Credits Bereket Miheret...

WordPress Animated Number Counters Plugin <= 1.9 is vulnerable to Local File Inclusion

Software Animated Number Counters Type Plugin Vulnerable versions = 1.9 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Local File Inclusion CVE CVE-2024-43957 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 357a00e40951 Credits João Pedro S Alcântara...

WordPress WPMobile.App Plugin <= 11.48 is vulnerable to Cross Site Request Forgery (CSRF)

Software WPMobile.App Type Plugin Vulnerable versions = 11.48 Fixed in 11.49 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-43933 Patch priority Low CVSS severity Low 7.1 Developer Amauri.IO PSID 8f2aea19dd33 Credits Muhammad Daffa Required...

WordPress Simple Job Board Plugin <= 2.12.3 is vulnerable to PHP Object Injection

Software Simple Job Board Type Plugin Vulnerable versions = 2.12.3 Fixed in 2.12.4 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-7351 Patch priority Medium CVSS severity Medium 8 Developer Claim ownership PSID a1947bfcfa95 Credits Francesco Carlucci Required privileg...

WordPress SKT Blocks – Gutenberg based Page Builder Plugin <= 1.6 is vulnerable to Cross Site Scripting (XSS)

Software SKT Blocks – Gutenberg based Page Builder Type Plugin Vulnerable versions = 1.6 Fixed in 1.7 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43946 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 747508d88809 Credits 4rCanJ0x! Requir...

WordPress Memberpress Plugin <= 1.11.34 is vulnerable to Broken Access Control

Software Memberpress Type Plugin Vulnerable versions = 1.11.34 Fixed in 1.11.35 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-43956 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 4067cee8925c Credits Ananda Dhakal Patchstack...

WordPress LWS Affiliation Plugin <= 2.3.4 is vulnerable to Broken Access Control

Software LWS Affiliation Type Plugin Vulnerable versions = 2.3.4 Fixed in 2.3.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-43962 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID a2763521797a Credits Fariq Fadillah Gusti Insani...

WordPress DSGVO All in one for WP Plugin <= 4.5 is vulnerable to Cross Site Scripting (XSS)

Software DSGVO All in one for WP Type Plugin Vulnerable versions = 4.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43964 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 7d6d328e43e7 Credits Ngô Thiên An ancorn from VNPT-VCI...

PT-2024-38791 · Unknown · Sourcecodester Online Health Care System

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Health Care System version 1.0 Description: A critical vulnerability has been found in the SourceCodester Online Health Care System. The issue is related to an unknown function of the file search.php, where the...

WordPress Themify Builder Plugin <= 7.6.1 is vulnerable to Broken Access Control

Software Themify Builder Type Plugin Vulnerable versions = 7.6.1 Fixed in 7.6.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-7836 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID bd6e0e69059b Credits Peter Thaleikis Required...

CVE-2024-5335 Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 1.6.4 - Unauthenticated PHP Object Injection

The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin is vulnerable to PHP Object Injection via deserialization of untrusted input via the ultimatestorekitcompareproducts cookie in versions up to ...

PT-2024-6664 · D Link · D-Link Di-8100

Name of the Vulnerable Software and Affected Versions: D-Link DI-8100G version 17.12.20A1 Description: The issue is related to a command injection vulnerability via the sub47A60C function in the upgrade filter.asp file. This vulnerability is associated with the failure to neutralize special...

WordPress Woo Inquiry Plugin <= 0.1 is vulnerable to SQL Injection

Software Woo Inquiry Type Plugin Vulnerable versions = 0.1 Fixed in N/A OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-7854 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID ca23e91f2448 Credits theviper17y Required privilege Unauthenticated Published...

WordPress Smart Online Order for Clover Plugin <= 1.5.6 is vulnerable to Broken Access Control

Software Smart Online Order for Clover Type Plugin Vulnerable versions = 1.5.6 Fixed in 1.5.7 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-7032 Patch priority Medium CVSS severity Medium 6.5 Developer Zaytech PSID 1d01355fa1e4 Credits Lucio Sá Required...

WordPress LH Add Media From Url Plugin <= 1.23 is vulnerable to Cross Site Scripting (XSS)

Software LH Add Media From Url Type Plugin Vulnerable versions = 1.23 Fixed in 1.30 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-7090 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID b062d0fb1671 Credits Piotr Kuśpit...

Kashipara Music Management System 安全漏洞

Kashipara Music Management System is a music management system from Kashipara. Kashipara Music Management System v1.0 suffers from a SQL injection vulnerability, which originates from the lack of validation of the search parameter of /music/ajax.php?action=findmusic against external SQL input,...

WordPress GiveWP Plugin <= 3.14.1 is vulnerable to Arbitrary File Deletion

Software GiveWP Type Plugin Vulnerable versions = 3.14.1 Fixed in 3.14.2 OWASP Top 10 A5: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2024-5941 Patch priority Low CVSS severity Low 5.4 Developer Liquid Web / StellarWP PSID 0a50b2a00b5f Credits villu164 Required privilege...

WordPress Snapshot Backup Plugin <= 2.1.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Snapshot Backup Type Plugin Vulnerable versions = 2.1.1 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-7689 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 5c418561fc96 Credits Bob Matyas Required...

WordPress GiveWP Plugin <= 3.13.0 is vulnerable to Broken Access Control

Software GiveWP Type Plugin Vulnerable versions = 3.13.0 Fixed in 3.14.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-5940 Patch priority Medium CVSS severity Medium 6.5 Developer Liquid Web / StellarWP PSID c733c510d1d3 Credits villu164 Required...

WordPress SmartSearch WP Plugin <= 2.4.4 is vulnerable to SQL Injection

Software SmartSearch WP Type Plugin Vulnerable versions = 2.4.4 Fixed in 2.4.5 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-6847 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 2bfe1eee61ea Credits Karolis Narvilas Required privilege Unauthenticat...