Dave Jong

An issue exists that allows the retrieval of embedded sensitive data through the insertion of sensitive information into sent data. This flaw enables authenticated users to perform arbitrary WordPress option disclosure.

A missing authorization issue in the WP Sunshine Sunshine Photo Cart plugin allows for the exploitation of incorrectly configured access control security levels. This is a broken access control flaw where the system fails to properly verify if a user has the necessary permissions to perform certain actions.

An incorrect privilege assignment exists in the Modular DS modular-connector component, potentially allowing for privilege escalation. The issue allows an attacker to gain elevated privileges within the system.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to inject malicious scripts into web pages.

Name of the Vulnerable Software and Affected Versions: wProject versions prior to 5.8.0 Description: The issue is related to a Missing Authorization vulnerability. This means that there is a lack of proper authorization checks, potentially allowing unauthorized access to certain features or data. Recommendations: For versions prior to 5.8.0, update to version 5.8.0 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: wProject versions prior to 5.8.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS), which allows Reflected XSS. This type of issue can occur when user input is not properly sanitized, allowing an attacker to inject malicious scripts into a website. Recommendations: For versions prior to 5.8.0, update to version 5.8.0 or later to resolve the issue. As a temporary workaround, consider restricting user input to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: wProject versions prior to 5.8.0 Description: The issue is related to an Incorrect Privilege Assignment vulnerability. This vulnerability affects wProject, with details about the impact or exploitation not specified beyond the general description of the issue. Recommendations: For versions prior to 5.8.0, update to version 5.8.0 or later to resolve the issue.

The issue affects the WP SuperBackup plugin for WordPress, allowing unrestricted upload of files with dangerous types. This enables attackers to upload a web shell to a web server. The vulnerability is due to missing file type validation in all versions up to and including 2.3.3.

The issue is related to Deserialization of Untrusted Data, which affects WP SuperBackup due to a deserialization vulnerability.

The issue is related to a Missing Authorization vulnerability, allowing the exploitation of incorrectly configured access control security levels. This can lead to unauthorized access control bypass in Azzaroco WP SuperBackup.

The issue is related to a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This can lead to unauthorized access.

A missing authorization issue exists in Seraphinite Accelerator, potentially allowing retrieval of embedded sensitive data. The issue affects the `seraphinite-accelerator` component. No information is available regarding the number of potentially affected devices or any real-world incidents where this issue was exploited. The vulnerability allows unauthorized access to data. The affected component does not have specific API endpoints or vulnerable parameters mentioned in the provided information.

The issue affects Azzaroco WP SuperBackup, allowing Reflected XSS due to improper neutralization of input during web page generation. This enables an attacker to inject malicious scripts into a website, potentially leading to unauthorized access or data theft.

The issue affects the Easing Slider plugin, allowing exploitation of incorrectly configured access control security levels due to a missing authorization vulnerability. This can lead to plugin settings reset.

The issue allows authenticated users to activate arbitrary plugins due to missing authorization, exploiting incorrectly configured access control security levels.

The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels.

The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels.

The issue is related to a Missing Authorization vulnerability in Sparkle Themes Chankhe, which allows exploiting incorrectly configured access control security levels.

Name of the Vulnerable Software and Affected Versions: Roninwp Revy versions 1.18 and earlier Description: The issue is related to an Improper Neutralization of Special Elements used in an SQL Command, also known as a SQL Injection vulnerability. This vulnerability affects the Roninwp Revy software. Recommendations: For versions 1.18 and earlier, update to a version later than 1.18 to resolve the issue. As a temporary workaround, consider restricting access to sensitive database queries until a patch is available. Avoid using user-supplied input in SQL commands to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Roninwp FAT Services Booking versions n/a through 5.6 Description: The issue is related to improper neutralization of input during web page generation, which leads to a Cross-site Scripting (XSS) vulnerability. This allows for stored XSS attacks. Recommendations: For versions n/a through 5.6, update to a version that fixes this issue to prevent stored XSS attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.