813 matches found
Ultimate Weather Plugin <= 1.0 - Cross-Site Scripting
The ultimate-weather plugin 1.0 for WordPress contains a cross-site scripting vulnerability. id: CVE-2014-4561 info: name: Ultimate Weather Plugin = 1.0 - Cross-Site Scripting author: daffainfo severity: medium description: The ultimate-weather plugin 1.0 for WordPress contains a cross-site...
Personal Weather Station Dashboard 12 - Directory Traversal
Personal Weather Station Dashboard 12lts allows unauthenticated remote attackers to read arbitrary files via ../ directory traversal in the test parameter to /others/test.php, as demonstrated by reading the server's private SSL key in cleartext. id: CVE-2025-47423 info: name: Personal Weather...
CVE-2025-47423
CVE-2025-47423 – Local File Inclusion in Personal Weather Station Dashboard 12lts Discovered by: Matthew Eagle Status: Public Disclosure Date Reported: 2025-05-05 CVE ID: CVE-2025-47423 🧩 Summary A Local File Inclusion LFI vulnerability in the Personal Weather Station Dashboard version 12lts allo...
EUVD-2026-87365
Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single...
CVE-2026-100418
Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single...
CVE-2026-100418 Flame through 2.4.0 Information Exposure via GET /api/config
Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single...
CVE-2026-100418
The software Flame through 2.4.0 contains an information exposure vulnerability within the unauthenticated GET /api/config endpoint. The root cause is a lack of field redaction, allowing the endpoint to return the entire configuration object. Attackers can send a single unauthenticated request to...
CVE-2026-100418 Flame through 2.4.0 Information Exposure via GET /api/config
Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single...
CVE-2026-100418 Flame through 2.4.0 Information Exposure via GET /api/config
Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single...
PT-2026-99130
Name of the Vulnerable Software and Affected Versions Flame versions prior to 2.4.1 Description An information exposure issue exists in the unauthenticated 'GET /api/config' endpoint, which returns the complete configuration object without redacting sensitive fields. This allows an attacker to...
CVE-2026-100418: Exposure of Sensitive Information to an Unauthorized Actor
Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single...
CVE-2026-66433
Contributor Cross Site Scripting XSS in Location Weather = 3.0.6 versions...
CVE-2026-66433
CVE-2026-66433 affects the WordPress plugin Location Weather (versions <= 3.0.6). The vulnerability is a Cross Site Scripting (XSS) issue in that plugin/version. The CVE entry identifies the affected software, with a medium overall risk (CVSS 3.1 base score 6.5) from Patchstack data, noting ne...
EUVD-2026-49242
Contributor Cross Site Scripting XSS in Location Weather = 3.0.6 versions...
CVE-2026-66433
Contributor Cross Site Scripting XSS in Location Weather = 3.0.6 versions...
CVE-2026-66433 WordPress Location Weather plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Location Weather = 3.0.6 versions...
CVE-2026-66433 WordPress Location Weather plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Location Weather = 3.0.6 versions...
WordPress Location Weather plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Location Weather versions = 3.0.6...