Podatności

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'attachments[name]' Parameter in all versions up to, and including, 1.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…

CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'qsm_hidden_questions' parameter in all versions up to, and including, 11.2.6 due to insufficient input sanitization and output escaping. This makes it…

CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 3.4.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to…

CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 2.34.8 due to insufficient input sanitization and output escaping. This makes it possible…

CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via <presto-player> Tag in all versions up to, and including, 4.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject…

CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web…

CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via display_name User Field in all versions up to, and including, 5.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to…

CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'order_email' in all versions up to, and including, 7.0.5 due to insufficient input sanitization and output escaping. This makes it possible for…

CVSS 7,2 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validating their scheme. Authenticated users can embed javascript: links in shared chats that, when clicked by a victim, steal…

CVSS 7,2 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

n8n before 2.41.4 and 2.42.0 before 2.42.1 does not validate credential ids stored in agent node parameters when an editor saves a shared workflow, because the check inspects only a node's credentials field. An editor can configure a Message an Agent node in inline mode with tools they control to…

CVSS 7,2 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

Unauthenticated Server Side Request Forgery (SSRF) in StreamCast <= 2.4.5 versions.

CVSS 7,2 · EPSS 0,19 % · rekomendacja wg zapisanej polityki

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PayPal IPN Parameters in all versions up to, and including, 3.6.9 due to insufficient input sanitization and output escaping. This makes it possible for…

CVSS 7,2 · EPSS 0,19 % · rekomendacja wg zapisanej polityki

Server-Side Request Forgery (SSRF) vulnerability in Builderius.io Builderius allows Server Side Request Forgery. This issue affects Builderius: from 1.4 through 1.4-beta.

CVSS 7,2 · EPSS 0,16 % · rekomendacja wg zapisanej polityki

An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later

CVSS 6,9 · EPSS 1,64 % · rekomendacja wg zapisanej polityki

VeraCrypt 1.26.29 (FUSE-T build) on macOS sometimes allows unintended access to decrypted data. It does not terminate the FUSE-T auxiliary service (go-nfsv4) and its associated VeraCrypt core-service helper processes when a volume is dismounted. After VeraCrypt reports the volume as dismounted,…

CVSS 7,2 · EPSS 0,11 % · rekomendacja wg zapisanej polityki

Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Before 0.9.1, an attacker with local access could modify workload code, data, and configuration at any time after successful connection establishment. Once Evidence was successfully…

CVSS 7,2 · EPSS 0,08 % · rekomendacja wg zapisanej polityki

Use after free in Windows Enterprise App Management allows an authorized attacker to elevate privileges over a network.

CVSS 7,1 · EPSS 0,58 % · rekomendacja wg zapisanej polityki

VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or use unguarded…

CVSS 7,1 · EPSS 0,57 % · rekomendacja wg zapisanej polityki

ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploit depends on conditions beyond the attacker's control.…

CVSS 7,1 · EPSS 0,55 % · rekomendacja wg zapisanej polityki

KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the {path} placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting…

CVSS 7,0 · EPSS 1,02 % · rekomendacja wg zapisanej polityki

Lenve vhr through commit 03abbd3 contains an information disclosure vulnerability that allows any authenticated user to retrieve other operators' BCrypt password hashes via GET /chat/hrs. Low-privileged operators can collect administrator password hashes, phone numbers, and addresses from the…

CVSS 7,1 · EPSS 0,5 % · rekomendacja wg zapisanej polityki

The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Referer Header in all versions up to, and including, 6.2.9 due to insufficient input sanitization and output escaping. This…

CVSS 7,2 · rekomendacja wg zapisanej polityki

The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS) in all versions up to, and including,…

CVSS 7,2 · rekomendacja wg zapisanej polityki

The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'CalendarTitle' parameter in all versions up to, and including, 1.4.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to…

CVSS 7,2 · rekomendacja wg zapisanej polityki

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.3.7 due to insufficient input sanitization and output escaping. This makes it possible for…

CVSS 7,2 · rekomendacja wg zapisanej polityki