The WP Automatic plugin suffers from a Path Traversal vulnerability, which allows attackers to access restricted directories and execute arbitrary code on the server. This security flaw impacts versions of the Automatic plugin from its initial release up to version 3.92.0. Additionally, the vulnerability can lead to Server
A security vulnerability in request-baskets up to version 1.2.1 was identified, involving a Server-Side Request Forgery (SSRF) in the /api/baskets/{name} component. This issue could allow attackers to infiltrate network systems and obtain sensitive data by sending a specifically crafted API request. Disclaimer The content provided here
The WP User Frontend WordPress plugin before version 3.5.26 contains a security vulnerability in the Subscribers dashboard. This vulnerability arises from the plugin's failure to properly validate and escape the 'status' parameter before incorporating it into a SQL statement. As a result, this oversight
BigBlueButton version before 2.2.7 had a security vulnerability that allowed remote authenticated users to read local files and perform Server-Side Request Forgery (SSRF) attacks. This vulnerability could be exploited by uploading an Office document containing a malicious URL in an ODF xlink field, which could then be used
The File Manager plugin (wp-file-manager) before version 6.9 for WordPress has a vulnerability that allows remote attackers to upload and execute arbitrary PHP code. The vulnerability arises from the plugin renaming an unsafe example elFinder connector file to have the .php extension, enabling attackers to use elFinder commands to
Mara CMS 7.5 has a security vulnerability in which there is an arbitrary file upload issue. To exploit this vulnerability, an attacker needs to have a valid authenticated session as an admin or manager. The attacker can then make a request to 'codebase/dir.php?type=filenew'
An issue was discovered in rConfig through version 3.9.4, where the web interface is vulnerable to SQL injection through the "searchColumn" parameter in "commands.inc.php". This vulnerability could allow attackers to manipulate the database and access sensitive information. Disclaimer The content provided here