Rezultati pretraživanja za 'Od datuma: 03.11.2024.'
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-90988 | 5.3 | The Request a Quote WordPress plugin through 2.5.6 does not perform an authorization check on one of its unauthenticated AJAX handlers, allowing unauthenticated users to read the contact records of quote-request submissions, including records the si | 2026-10-02 18:00:34 | 2026-10-02 06:16:42 |
| CVE-2026-85016 | 6.8 | The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter processor, allowing users with Contributor access (who do not hold unfilte | 2026-10-02 18:00:34 | 2026-10-02 06:16:41 |
| CVE-2026-85004 | 4.3 | The Popup Maker WordPress plugin through 1.4.5 does not perform a capability check on one of its account-connection actions, only verifying a nonce, allowing authenticated users with minimal privileges such as Subscribers to overwrite a site-wide Po | 2026-10-02 18:00:34 | 2026-10-02 06:16:41 |
| CVE-2026-81740 | 5.3 | The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its secret key has not been configured, which is its state immediately after activation, allowing unauth | 2026-10-02 18:00:34 | 2026-10-02 06:16:41 |
| CVE-2026-13718 | 6.8 | The Tabs Responsive WordPress plugin through 2.5 does not sanitize the content of WooCommerce product tabs before storing and rendering it, allowing a shop manager to store JavaScript that executes when any user, including an administrator, views th | 2026-10-02 18:00:34 | 2026-10-02 06:16:40 |
| CVE-2026-103761 | 7.5 | Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePeerNotify that allows unauthenticated attackers to grow process memory without limit. Attackers can repeatedly send notify frames up | 2026-10-02 18:00:34 | 2026-10-01 23:16:46 |
| CVE-2026-103760 | 5.9 | Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated remote attackers to block the handshake daemon by never reading replies. Attackers can send a Metadata request to the handshake RPC p | 2026-10-02 18:00:34 | 2026-10-01 23:16:46 |
| CVE-2026-101890 | 5.4 | The Prime Mover plugin for WordPress before 2.2.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary JavaScript by injecting an unescaped site_title value in a package's footprint.json file. Attackers can | 2026-10-02 18:00:34 | 2026-10-01 17:17:17 |
| CVE-2026-101889 | 6.5 | The Prime Mover plugin for WordPress before 2.2.1 contains a path traversal vulnerability that allows authenticated administrators to delete arbitrary directories by importing a crafted WPRIME/TAR package with manipulated tar_root_folder values in wp | 2026-10-02 18:00:34 | 2026-10-01 17:17:17 |
| CVE-2026-101888 | 7.2 | The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators to write arbitrary files outside the intended extraction directory during migration ZIP import. Attackers can | 2026-10-02 18:00:34 | 2026-10-01 17:17:17 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/12739
Zapisa po stranici: