1551
|
4.8 |
MEDIUM
Network
|
ninjateam
|
header_footer_custom_code
|
The NinjaTeam Header Footer Custom Code WordPress plugin before 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Sit…
|
CWE-79
Cross-site Scripting
|
CVE-2024-6617
|
2024-09-28 06:28 |
2024-09-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
1552
|
4.8 |
MEDIUM
Network
|
ninjateam
|
header_footer_custom_code
|
The NinjaTeam Header Footer Custom Code WordPress plugin before 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Sit…
|
CWE-79
Cross-site Scripting
|
CVE-2024-6493
|
2024-09-28 06:28 |
2024-09-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
1553
|
6.8 |
MEDIUM
Network
|
pixeljar
|
favicon_generator
|
The Favicon Generator (CLOSED) WordPress plugin before 2.1 does not validate files to be uploaded and does not have CSRF checks, which could allow attackers to make logged in admin upload arbitrary f…
|
CWE-352
Origin Validation Error
|
CVE-2024-7863
|
2024-09-28 06:27 |
2024-09-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
1554
|
4.8 |
MEDIUM
Network
|
premio
|
my_sticky_bar
|
The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin before 2.7.3 does not validate and escape some of its settings before outputtin…
|
CWE-79
Cross-site Scripting
|
CVE-2024-7133
|
2024-09-28 06:27 |
2024-09-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
1555
|
6.5 |
MEDIUM
Network
|
pixeljar
|
favicon_generator
|
The Favicon Generator (CLOSED) WordPress plugin before 2.1 does not have CSRF and path validation in the output_sub_admin_page_0() function, allowing attackers to make logged in admins delete arbitra…
|
CWE-352
Origin Validation Error
|
CVE-2024-7864
|
2024-09-28 06:26 |
2024-09-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
1556
|
6.5 |
MEDIUM
Network
|
gowildchild
|
visual_sound
|
The Visual Sound (old) WordPress plugin through 1.06 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
|
CWE-352
Origin Validation Error
|
CVE-2024-8047
|
2024-09-28 06:25 |
2024-09-17 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
1557
|
6.1 |
MEDIUM
Network
|
outtolunchproductions
|
simple_headline_rotator
|
The Simple Headline Rotator WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin …
|
CWE-79
Cross-site Scripting
|
CVE-2024-7860
|
2024-09-28 05:56 |
2024-09-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
1558
|
6.1 |
MEDIUM
Network
|
michalaugustyniak
|
misiek_paypal
|
The Misiek Paypal WordPress plugin through 1.1.20090324 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin a…
|
CWE-79
Cross-site Scripting
|
CVE-2024-7861
|
2024-09-28 05:52 |
2024-09-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
1559
|
8.0 |
HIGH
Adjacent
|
tp-link
|
archer_ax50_firmware archer_a10_firmware archer_ax10_firmware archer_ax11000_firmware
|
Multiple TP-LINK products allow a network-adjacent authenticated attacker to execute arbitrary OS commands. Affected products/versions are as follows: Archer AX50 firmware versions prior to 'Archer A…
|
CWE-78
OS Command
|
CVE-2023-40357
|
2024-09-28 05:35 |
2023-09-6 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
1560
|
5.4 |
MEDIUM
Network
|
isarnet
|
isarflow
|
A stored cross-site scripting (XSS) vulnerability in IsarNet AG IsarFlow v5.23 allows authenticated attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the dashboa…
|
CWE-79
Cross-site Scripting
|
CVE-2023-34637
|
2024-09-28 05:35 |
2023-09-6 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|