WordPress WPSection Plugin <= 1.3.8 is vulnerable to Local File Inclusion

Software WPSection Type Plugin Vulnerable versions = 1.3.8 Fixed in 1.3.9 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-43165 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID cd0a6805dc6f Credits João Pedro S Alcântara Kinorth Required privileg...

WordPress Modern Events Calendar Plugin <= 7.12.1 is vulnerable to Server Side Request Forgery (SSRF)

Software Modern Events Calendar Type Plugin Vulnerable versions = 7.12.1 Fixed in 7.13.0 OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2024-6522 Patch priority Low CVSS severity Low 6.4 Developer Claim ownership PSID 2c1730c6aa47 Credits Foxyyy Required...

WordPress Event Manager for WooCommerce Plugin <= 4.2.1 is vulnerable to Local File Inclusion

Software Event Manager for WooCommerce Type Plugin Vulnerable versions = 4.2.1 Fixed in 4.2.2 OWASP Top 10 A1: Broken Access Control Classification Local File Inclusion CVE CVE-2024-43138 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 721149c5cd33 Credits João Pedro S...

CVE-2024-33992

Cross-Site Scripting XSS vulnerability in School Event Management System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the 'view' parameter in '/student/index.php'...

WordPress WPBakery Page Builder Plugin <= 7.7 is vulnerable to Local File Inclusion

Software WPBakery Page Builder Type Plugin Vulnerable versions = 7.7 Fixed in 7.8 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-5709 Patch priority Low CVSS severity Low 6.6 Developer WPBakery PSID 1374f7b043bd Credits João Pedro Soares de Alcântara Required privileg...

WordPress Folders Plugin <= 3.0.3 is vulnerable to Cross Site Scripting (XSS)

Software Folders Type Plugin Vulnerable versions = 3.0.3 Fixed in 3.0.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-7317 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e0c9f23ff968 Credits wesley wcraft Required privilege...

WordPress Blox Page Builder Plugin <= 1.0.65 is vulnerable to Arbitrary File Upload

Software Blox Page Builder Type Plugin Vulnerable versions = 1.0.65 Fixed in N/A OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-6315 Patch priority Medium CVSS severity Medium 9.9 Developer Claim ownership PSID ffdf8c3e90d1 Credits István Márton Required privilege...

WordPress WPBakery Page Builder Plugin <= 7.7 is vulnerable to Cross Site Scripting (XSS)

Software WPBakery Page Builder Type Plugin Vulnerable versions = 7.7 Fixed in 7.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5708 Patch priority Low CVSS severity Low 5.9 Developer WPBakery PSID 535392115bbf Credits João Pedro Soares de Alcântar...

WordPress Quiz And Survey Master Plugin < 9.1.0 is vulnerable to Cross Site Scripting (XSS)

Software Quiz And Survey Master Type Plugin Vulnerable versions 9.1.0 Fixed in 9.1.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6390 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 40c6a58c6f1b Credits Dmitrii Ignatyev...

WordPress File Manager Pro Plugin <= 1.8.2 is vulnerable to Settings Change

Software File Manager Pro Type Plugin Vulnerable versions = 1.8.2 Fixed in 1.8.3 OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2024-7031 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID dd2b25032f95 Credits bart Required privilege Subscriber...

WordPress CRM Perks Forms Plugin <= 1.1.3 is vulnerable to Arbitrary File Upload

Software CRM Perks Forms Type Plugin Vulnerable versions = 1.1.3 Fixed in 1.1.4 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-7484 Patch priority Low CVSS severity Low 9.1 Developer Claim ownership PSID c7c64ee12633 Credits István Márton Required privilege...

CVE-2024-7443

CVE-2024-7443 affects Vivotek IB8367A VVTK-0100b. The vulnerability targets the getenv function in upload_file.cgi, where manipulation of QUERY_STRING enables command injection over the network. The issue is exploitable remotely and the affected releases are end-of-life; vendor support has ended ...

0x-relayer-cat (>=0.0.2 <=0.0.10), 0xauth (>=0.0.2 <=0.0.6) +8111 more potentially affected by CVE-2024-42461 via elliptic (>=5.2.1 <=6.5.6)

elliptic NPM version =5.2.1, =0.0.2, =0.0.2, =1.0.6, =0.0.1-beta.1, =0.1.0, =0.0.92, =0.1.3, =4.2.1, =6.2.1, =13.6.1, =13.7.2 and more Source cves: CVE-2024-42461 Source advisory: OSV:GHSA-49Q7-C7J4-3P7M...

WordPress News Element Elementor Blog Magazine Plugin < 1.0.6 is vulnerable to Local File Inclusion

Software News Element Elementor Blog Magazine Type Plugin Vulnerable versions 1.0.6 Fixed in 1.0.6 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-6459 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 9cdb1b21de6f Credits Project Black Required...

PT-2024-7661 · Tenda · Tenda Fh1206

Name of the Vulnerable Software and Affected Versions: Tenda FH1206 version 02.03.01.35 Description: The issue is caused by a stack overflow via the page parameter in the fromSafeClientFilter function, allowing attackers to cause a Denial of Service DoS via a crafted POST request to the affected...

WordPress WordPress File Upload Plugin <= 4.24.7 is vulnerable to Broken Access Control

Software WordPress File Upload Type Plugin Vulnerable versions = 4.24.7 Fixed in 4.24.8 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-39639 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID c24820fca545 Credits emad Required privile...

WordPress Sign-up Sheets Plugin <= 2.2.12 is vulnerable to Broken Access Control

Software Sign-up Sheets Type Plugin Vulnerable versions = 2.2.12 Fixed in 2.2.13 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-39654 Patch priority Low CVSS severity Low 5.3 Developer Fetch Designs PSID bf5384db048d Credits Joshua Chan Required privilege...

WordPress Post Grid and Gutenberg Blocks Plugin <= 2.2.85a is vulnerable to Cross Site Scripting (XSS)

Software Post Grid and Gutenberg Blocks Type Plugin Vulnerable versions = 2.2.85a Fixed in 2.2.86 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6346 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 0a3eb3d1bba0 Credits...

WordPress Ultimate Classified Listings Plugin < 1.4 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate Classified Listings Type Plugin Vulnerable versions 1.4 Fixed in 1.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6529 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 1fa83322914e Credits Erwan LR...

WordPress Essential Addons for Elementor Plugin <= 5.9.26 is vulnerable to Cross Site Scripting (XSS)

Software Essential Addons for Elementor Type Plugin Vulnerable versions = 5.9.26 Fixed in 5.9.27 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-39649 Patch priority Low CVSS severity Low 6.5 Developer WPDeveloper PSID a786e5c76954 Credits wcraft Required privilege...