Archive
5 March 2024
Vulnerabilities first published on this day (UTC), newest first.
64 results · Clear filters · Feed
-
Medium 5.3
JM Twitter Cards <= 14 - Information Exposure via Meta Description
The JM Twitter Cards plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 14 via the meta description data. This makes it possible for unauthenticated attackers to view password protected post content when viewing t…
-
Medium 5.3
Change Memory Limit <= 1.0 - Missing Authorization via admin_logic()
The Change Memory Limit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the admin_logic() function hooked via admin_init in all versions up to, and including, 1.0. This makes it possible for unauthe…
-
Medium 6.5
Page Builder Sandwich – Front End WordPress Page Builder Plugin <= 5.1.0 - Sensitive Information Exposure
The Page Builder Sandwich – Front End WordPress Page Builder Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.0. This makes it possible for authenticated attackers, with subscriber access an…
-
Medium 5.3
Password Protected Store for WooCommerce <= 2.2 - Information Exposure via REST API
The Password Protected Store for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2 via the REST API. This makes it possible for unauthenticated attackers to extract sensitive data includ…
-
Medium 6.5
Page Builder Sandwich <= 5.1.0 - Missing Authorization to Authenticated(Subscriber+) Arbitrary Post Editing
The Page Builder Sandwich – Front End WordPress Page Builder Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'gambit_builder_save_content' function in all versions up to, and including, 5…
-
Medium 6.4
Easy!Appointments <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Easy!Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'easyappointments' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attri…
-
Medium 5.3
Build & Control Block Patterns – Boost up Gutenberg Editor <= 1.3.5.4 - Missing Authorization
The Build & Control Block Patterns – Boost up Gutenberg Editor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the settings_export() function in all versions up to, and including, 1.3.5.4. This makes it p…
-
Medium 5.3
Maintenance Mode <= 3.0.1 - Information Exposure
The Maintenance Mode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.1 via the REST API. This makes it possible for unauthenticated attackers to obtain post and page content via API thus bypassing…
-
Medium 6.1
Blue Triad EZAnalytics <= 1.0 - Reflected Cross-Site Scripting via 'bt_webid'
The Blue Triad EZAnalytics plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'bt_webid' parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unaut…
-
Medium 5.3
SportsPress – Sports Club & League Manager <= 2.7.17 - Missing Authorization to Unauthenticated Event Permalink Update
The SportsPress – Sports Club & League Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the settings_save() function in all versions up to, and including, 2.7.17. This makes it possible for u…
-
Medium 6.1
An issue was discovered in the Archibus app 4.0.3 for iOS. There is an XSS vulnerability in the create work request fea…
-
Medium 6.1
Online Flight Booking Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via t…
-
Medium 5.8
pictureproxy.php in the dirk1983 mm1.ltd source code f9f4bbc allows SSRF via the url parameter. NOTE: the references se…
-
Medium 6.1
A reflected cross-site scripting (XSS) vulnerability exists in SuperCali version 1.1.0, allowing remote attackers to ex…
-
Medium 5.3
Directory Traversal vulnerability in Jeewms v.3.7 and before allows a remote attacker to obtain sensitive information v…
-
Medium 6.1
A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in Dotclear version 2.29. The flaw exists with…
-
Medium 6.5
A Server-Side Request Forgery (SSRF) in the getFileFromRepo function of WonderCMS v3.1.3 allows attackers to force the …
-
Medium 4.8
CMS Made Simple Version 2.2.19 is vulnerable to Cross Site Scripting (XSS). This vulnerability resides in the File Mana…
-
Medium 5.9
CMS Made Simple version 2.2.19 is vulnerable to Server-Side Template Injection (SSTI). The vulnerability exists within …
-
Medium 5.5CVE-2024-22889 Public exploit
Phone information disclosure vulnerability
Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a crafted request.
-
Medium 5.5
swftools v0.9.2 was discovered to contain a segmentation violation via the function state_free at swftools/src/swfc-his…
-
Medium 5.5
swftools v0.9.2 was discovered to contain a segmentation violation via the function free_lines at swftools/lib/modules/…
-
Medium 6.2
swftools v0.9.2 was discovered to contain a segmentation violation via the function compileSWFActionCode at swftools/li…
-
Medium 4.3
swftools v0.9.2 was discovered to contain a segmentation violation via the function s_font at swftools/src/swfc.c.