الباحثون
رجوع
Minhtuanact
#296
من 60,452
589.3
إجمالي CVSS
الثغرات
·
81
متوسطة
24
عالية
45
حرجة
12
PT-2025-14929
2025-04-04
6.6
CVE-2025-32138
Unknown
Supsystic Easy Google Maps
تتعلق المشكلة بثغرة أمنية تتمثل في «تقييد غير صحيح لمراجع الكيانات الخارجية في XML»، مما يسمح بـ«حقن XML».
PT-2025-14740
2025-04-03
4.9
CVE-2025-31827
Vlad.Olaru
Fonto
تتعلق المشكلة بـ«تقييد غير صحيح» لمسار دليل محظور، والمعروف أيضًا باسم ثغرة «عبور المسار» (Path Traversal). تسمح هذه الثغرة بـ«عبور المسار» في برنامج Fonto الخاص بـ vlad.olaru.
PT-2025-14739
2025-04-03
4.9
CVE-2025-31825
Pixelgrade
Category Icon
تتعلق المشكلة بـ«تقييد غير صحيح» لاسم مسار إلى دليل محظور، وهو ما يُعرف أيضًا باسم «عبور المسار» (Path Traversal). وهذا يسمح بإجراء «عبور المسار» في برنامج Category Icon من pixelgrade.
PT-2025-4659
2025-01-14
7.1
CVE-2025-22735
WordPress
Taxopress Wordpress Tag Cloud Plugin
تتعلق المشكلة بعدم معالجة المدخلات بشكل صحيح أثناء إنشاء صفحات الويب، مما يسمح بحدوث هجمات «التنفيذ البرمجي عبر المواقع» (XSS) المنعكسة. وهذا يمكّن المهاجمين من إدخال نصوص برمجية ضارة في صفحات الويب. تؤثر هذه المشكلة على المكون الإضافي «Tag Cloud» الخاص بـ WordPress، وتحديدًا مكون «Tag Groups».
PT-2025-1769
2025-01-06
5.4
CVE-2024-12170
WordPress
Viewmedica
تعود المشكلة إلى عدم وجود التحقق من صحة الرقم العشوائي (nonce) أو وجود خطأ فيه في صفحة «Viewmedica-Admin»، مما يتيح للمهاجمين غير المصادق عليهم إدخال استعلامات SQL تعسفية عبر طلب مزور. وقد يحدث ذلك إذا تمكن المهاجم من خداع أحد مسؤولي الموقع للقيام بإجراء ما، مثل النقر على رابط.
PT-2025-4461
2025-01-03
8.2
CVE-2025-22347
Unknown
Bsk Forms Blacklist
تتعلق المشكلة بثغرة أمنية من نوع «تزوير الطلبات عبر المواقع» (CSRF) تتيح «الحقن الأعمى لـ SQL». وهذا يعني أن المهاجم يمكنه خداع المستخدم لتنفيذ إجراءات غير مقصودة على تطبيق ويب، مما قد يؤدي إلى استخراج بيانات حساسة من قاعدة البيانات دون علم المستخدم.
PT-2024-36194
2024-12-13
7.1
CVE-2024-54312
Unknown
Persian Woocommerce Sms
Name of the Vulnerable Software and Affected Versions: Persian Woocommerce SMS versions 7.0.5 and earlier Description: The issue is related to improper neutralization of input during web page generation, which leads to a Cross-site Scripting (XSS) vulnerability. This allows for Reflected XSS attacks. Recommendations: For versions 7.0.5 and earlier, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
PT-2024-12329
2024-12-13
7.3
CVE-2023-32507
WordPress
Wp3Sixty Woo Custom Emails
The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels.
PT-2024-12495
2024-12-13
5.4
CVE-2023-35046
Elementor
Dynamic Visibility For Elementor
The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels.
PT-2024-12213
2024-12-09
4.3
CVE-2023-29422
Unknown
Alexacrm Dynamics 365 Integration
The issue is related to a Missing Authorization vulnerability in AlexaCRM Dynamics 365 Integration, which allows exploiting incorrectly configured access control security levels.
PT-2024-12070
2024-04-03
9.8
CVE-2023-25699
Unknown
Videowhisper Live Streaming Integration
The issue is related to an OS Command Injection vulnerability due to improper neutralization of special elements used in an OS command. This allows for OS Command Injection, potentially enabling attackers to execute arbitrary commands on the affected system.
PT-2023-23850
2023-12-29
6.1
CVE-2023-32517
Pluginops
Popup Builder
The issue is related to a URL Redirection to Untrusted Site, also known as an 'Open Redirect' vulnerability. This vulnerability affects the PluginOps MailChimp Subscribe Form, Optin Builder, PopUp Builder, and Form Builder.
PT-2023-21756
2023-12-20
7.2
CVE-2023-28491
Tribulant
Tribulant Slideshow Gallery
The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for potential exploitation by injecting malicious SQL code.
PT-2023-21963
2023-12-20
8.8
CVE-2023-28788
WordPress
Advanced Page Visit Counter
The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for potential exploitation by injecting malicious SQL code.
PT-2023-29405
2023-12-19
6.1
CVE-2023-45105
WordPress
Affiliate-Toolkit
The issue is related to a URL Redirection to Untrusted Site, also known as an 'Open Redirect' vulnerability. This vulnerability affects the affiliate-toolkit – WordPress Affiliate Plugin, allowing potential redirection to untrusted sites.
PT-2023-27533
2023-12-19
6.1
CVE-2023-40602
WordPress
Doofinder Wp & Woocommerce Search
The issue is related to a URL Redirection to Untrusted Site, also known as an 'Open Redirect' vulnerability. This vulnerability affects Doofinder WP & WooCommerce Search, allowing redirection to untrusted sites.
PT-2023-30498
2023-12-07
6.1
CVE-2023-47548
WordPress
Softlab Integrate Google Drive
The issue is related to a URL Redirection to Untrusted Site, also known as an 'Open Redirect' vulnerability. This vulnerability allows an attacker to redirect users to untrusted sites. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.
PT-2023-30785
2023-12-07
6.1
CVE-2023-48325
WordPress
Pluginops Landing Page Builder
The issue is related to a URL Redirection to Untrusted Site, also known as an 'Open Redirect' vulnerability. This vulnerability allows an attacker to redirect users to untrusted sites.
PT-2023-29721
2023-11-30
5.3
CVE-2023-45834
Libsyn
Libsyn Publisher Hub
The issue is related to the exposure of sensitive information to an unauthorized actor. This is a problem where sensitive data is made available to individuals who should not have access to it.
PT-2023-30499
2023-11-14
6.8
CVE-2023-47549
Eazydocs
Eazydocs
The issue is related to an Unauth. Reflected Cross-Site Scripting (XSS) vulnerability. This vulnerability occurs on the 302 response page.