Benzdeus

A potential security vulnerability has been identified in the HP ImageDiags for versions prior to 5.0.0.36. The vulnerability could potentially allow a local attacker to escalate privileges due to insufficient access controls.

**Name of the Vulnerable Software and Affected Versions** Sekander Badsha Crew HRM versions prior to 1.2.2 **Description** Missing authorization allows for the exploitation of incorrectly configured access control security levels. **Recommendations** Update to a version later than 1.2.2.

**Name of the Vulnerable Software and Affected Versions** PDF Poster versions prior to 2.4.1 **Description** A missing authorization issue in bPlugins PDF Poster allows for the exploitation of incorrectly configured access control security levels. **Recommendations** Update to a version later than 2.4.1.

**Name of the Vulnerable Software and Affected Versions** BEAR versions prior to 1.1.6 **Description** A Cross-Site Request Forgery (CSRF) flaw in PluginUs.Net BEAR allows an attacker to induce a user to perform actions they did not intend to do. **Recommendations** Update to a version later than 1.1.5.

**Name of the Vulnerable Software and Affected Versions** Ryan Howard Website LLMs.Txt versions through 8.2.6 **Description** The Ryan Howard Website LLMs.Txt software contains a flaw related to improper input handling during web page generation, specifically a Reflected Cross-Site Scripting (XSS) issue. This allows for the injection of malicious scripts into web pages. The vulnerability exists due to insufficient sanitization of user-supplied input, potentially enabling an attacker to execute arbitrary code within the context of a user's browser. The affected component is Website LLMs.Txt. **Recommendations** Update Ryan Howard Website LLMs.Txt to a version later than 8.2.6.

**Name of the Vulnerable Software and Affected Versions** Marketing Fire Editorial Calendar versions prior to 3.9.1 **Description** The software contains a flaw related to improper input handling during web page generation, specifically a DOM-Based Cross-site Scripting issue. This allows for the potential execution of malicious scripts within the context of a user's browser. The issue exists in the 'editorial-calendar' component. **Recommendations** Update to a version greater than 3.9.0.

**Name of the Vulnerable Software and Affected Versions** WP Food versions prior to 2.7.1 **Description** An authorization issue exists in WP Food. The issue involves exploiting incorrectly configured access control security levels. The vulnerability allows unauthorized access. **Recommendations** Update WP Food to version 2.7.1 or later.

**Name of the Vulnerable Software and Affected Versions** Cozy Vision SMS Alert Order Notifications versions through 3.9.0 **Description** An authorization issue exists in Cozy Vision SMS Alert Order Notifications. The issue involves incorrectly configured access control security levels, potentially allowing unauthorized access. **Recommendations** Update Cozy Vision SMS Alert Order Notifications to a version later than 3.9.0.

**Name of the Vulnerable Software and Affected Versions** WP Job Portal versions through 2.4.4 **Description** The WP Job Portal software contains a flaw related to incorrectly configured access control security levels, potentially allowing unauthorized access. The issue is a missing authorization check. **Recommendations** Update WP Job Portal to a version newer than 2.4.4.

**Name of the Vulnerable Software and Affected Versions** Shahjahan Jewel FluentForm versions through 6.1.14 **Description** FluentForm is susceptible to a missing authorization issue stemming from incorrectly configured access control security levels. This allows for potential exploitation. **Recommendations** Update FluentForm to a version later than 6.1.14.

**Name of the Vulnerable Software and Affected Versions** HurryTimer versions through 2.14.2 **Description** The software contains a flaw due to improper handling of user-supplied data when creating web pages, leading to a potential Cross-site Scripting (XSS) issue. Specifically, the vulnerability allows for Stored XSS attacks. **Recommendations** Update HurryTimer to a version later than 2.14.2.

**Name of the Vulnerable Software and Affected Versions** nicdark Hotel Booking versions through 3.8 **Description** An authorization issue exists in nicdark Hotel Booking, allowing exploitation of incorrectly configured access control security levels. This enables unauthorized access to the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HR Management Lite versions prior to 3.6 **Description** An incorrect access control configuration exists in Weblizar HR Management Lite, potentially allowing unauthorized access. The issue involves a missing authorization check. **Recommendations** Update HR Management Lite to version 3.6 or later.

**Name of the Vulnerable Software and Affected Versions** Stratum versions through 1.6.1 **Description** An authorization issue exists in jetmonsters Stratum. The issue involves incorrectly configured access control security levels, potentially allowing unauthorized access. **Recommendations** Update Stratum to a version newer than 1.6.1.

**Name of the Vulnerable Software and Affected Versions** VillaTheme HAPPY versions through 1.0.9 **Description** A missing authorization issue exists in VillaTheme HAPPY, allowing exploitation of incorrectly configured access control security levels. **Recommendations** Update VillaTheme HAPPY to a version later than 1.0.9.

**Name of the Vulnerable Software and Affected Versions** WPBulky versions through 1.1.13 **Description** An improper neutralization of special elements used in an SQL command ('SQL Injection') issue exists in VillaTheme WPBulky, allowing for Blind SQL Injection. The issue affects versions from n/a through 1.1.13. **Recommendations** Update WPBulky to a version later than 1.1.13.

**Name of the Vulnerable Software and Affected Versions** jetmonsters Hotel Booking Lite versions through 5.2.3 **Description** A code injection issue exists in jetmonsters Hotel Booking Lite, potentially allowing for remote code inclusion. This could lead to a full system takeover on WordPress sites. **Recommendations** Update jetmonsters Hotel Booking Lite to a version newer than 5.2.3. Restrict the use of the plugin until a patch is available.

**Name of the Vulnerable Software and Affected Versions** WP AI CoPilot versions through 1.2.7 **Description** A flaw exists in WP Messiah WP AI CoPilot that allows the retrieval of embedded sensitive data due to the insertion of sensitive information into sent data. **Recommendations** Update WP AI CoPilot to a version later than 1.2.7.

**Name of the Vulnerable Software and Affected Versions** ThimPress LearnPress versions through 4.2.9.4 **Description** A missing authorization issue exists in ThimPress LearnPress, allowing exploitation of incorrectly configured access control security levels. **Recommendations** Update ThimPress LearnPress to a version later than 4.2.9.4.