Weekly Vulnerabilities Reports > December 30, 2024 to January 5, 2025

A vulnerability has been found in Codezips Gym Management System 1.0 and classified as critical.

A vulnerability was found in Codezips Blood Bank Management System 1.0 and classified as critical.

A vulnerability was found in wangl1989 mysiteforme 1.0.

A vulnerability was found in wangl1989 mysiteforme 1.0.

A vulnerability classified as critical was found in code-projects Online Shoe Store 1.0.

Cross-Site Request Forgery (CSRF) vulnerability in CridioStudio ListingPro allows Authentication Bypass.This issue affects ListingPro: from n/a through 2.9.4.

Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes MasterStudy LMS allows Cross Site Request Forgery.This issue affects MasterStudy LMS: from n/a through 3.2.1.

Cross-Site Request Forgery (CSRF) vulnerability in CreativeThemes Blocksy allows Cross Site Request Forgery.This issue affects Blocksy: from n/a through 2.0.22.

Missing Authorization vulnerability in Sonaar Music MP3 Audio Player for Music, Radio & Podcast by Sonaar allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through 5.8.

A vulnerability was found in PHPGurukul Land Record System 1.0 and classified as critical.

A vulnerability has been found in PHPGurukul Land Record System 1.0 and classified as critical.

Missing Authorization vulnerability in Leap13 Premium Addons for Elementor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Premium Addons for Elementor: from n/a through 4.10.56.

Local privilege escalation due to DLL hijacking vulnerability.

Local privilege escalation due to DLL hijacking vulnerability.

Panda Security Dome Link Following Local Privilege Escalation Vulnerability.

Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.

Ashlar-Vellum Cobalt AR File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability.

Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.

Ashlar-Vellum Cobalt CO File Parsing Type Confusion Remote Code Execution Vulnerability.

Ashlar-Vellum Cobalt XE File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.

Ashlar-Vellum Cobalt XE File Parsing Type Confusion Remote Code Execution Vulnerability.

Ashlar-Vellum Graphite VC6 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability.

Ashlar-Vellum Graphite VC6 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability.

A vulnerability, which was classified as problematic, was found in code-projects Chat System 1.0.

A vulnerability was found in SourceCodester Online Eyewear Shop 1.0 and classified as critical.

A vulnerability classified as critical has been found in code-projects Job Recruitment 1.0.

In WhatsUp Gold versions released before 2024.0.2, an unauthenticated attacker can configure LDAP settings.

A vulnerability was found in code-projects Chat System 1.0 and classified as critical.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AF themes WP Post Author allows SQL Injection.This issue affects WP Post Author: from n/a through 3.8.2.

The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to SQL Injection via the 'project_id' parameter of the /wp-json/pm/v2/projects/2/task-lists REST API endpoint in all versions up to, and including, 2.6.16 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.

A vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0 and classified as critical.

A vulnerability has been found in code-projects Point of Sales and Inventory Management System 1.0 and classified as critical.

A vulnerability, which was classified as critical, was found in code-projects Point of Sales and Inventory Management System 1.0.

A vulnerability, which was classified as critical, has been found in code-projects Point of Sales and Inventory Management System 1.0.

A vulnerability classified as critical was found in code-projects Point of Sales and Inventory Management System 1.0.

A vulnerability classified as critical has been found in code-projects Point of Sales and Inventory Management System 1.0.

A vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0.

A vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0.

In WhatsUp Gold versions released before 2024.0.2, an authenticated user can use a specially crafted HTTP request that can lead to information disclosure.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Themify Themify Builder allows PHP Local File Inclusion.This issue affects Themify Builder: from n/a through 7.6.3.

A vulnerability was found in code-projects Online Shop 1.0.

Stored cross-site scripting (XSS) vulnerability due to missing origin validation in postMessage.

A vulnerability was found in PHPGurukul Land Record System 1.0.

A vulnerability, which was classified as problematic, has been found in code-projects Chat System 1.0.

A vulnerability was found in IObit Protected Folder up to 13.6.0.5 and classified as problematic.

A vulnerability was found in IObit Protected Folder up to 13.6.0.5.

A vulnerability has been found in IOBit Protected Folder up to 1.3.0 and classified as problematic.

In the Linux kernel, the following vulnerability has been resolved: media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE I expect that the hardware will have limited this to 16, but just in case it hasn't, check for this corner case.

A vulnerability classified as problematic was found in osuuu LightPicture up to 1.2.2.

A vulnerability classified as problematic has been found in Emlog Pro up to 2.4.3.

A vulnerability was found in wangl1989 mysiteforme 1.0.

A vulnerability has been found in Emlog Pro 2.4.3 and classified as problematic.

A vulnerability classified as problematic was found in Emlog Pro up to 2.4.3.

The WP Multi Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping.

The Taskbuilder – WordPress Project & Task Management plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wppm_tasks shortcode in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping on user supplied attributes.

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.

Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP.This issue affects GiveWP: from n/a through 2.25.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeLooks Enter Addons allows Stored XSS.This issue affects Enter Addons: from n/a through 2.1.9.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in moveaddons Move Addons for Elementor allows Stored XSS.This issue affects Move Addons for Elementor: from n/a through 1.3.6.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through 6.0.7.

A vulnerability classified as problematic has been found in PHPGurukul Land Record System 1.0.

A vulnerability was found in PHPGurukul Land Record System 1.0.

A vulnerability was found in PHPGurukul Land Record System 1.0.

A vulnerability, which was classified as problematic, was found in PHPGurukul Land Record System 1.0.

A vulnerability classified as problematic was found in PHPGurukul Land Record System 1.0.

A vulnerability, which was classified as problematic, has been found in PHPGurukul Land Record System 1.0.

A vulnerability classified as problematic was found in Antabot White-Jotter up to 0.2.2.

A vulnerability was found in ZeroWdd studentmanager 1.0.

A vulnerability has been found in code-projects Local Storage Todo App 1.0 and classified as problematic.

A vulnerability classified as problematic has been found in Antabot White-Jotter up to 0.2.2.

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.4 due to missing validation on a user controlled key.

Missing Authorization vulnerability in 10Web 10Web Map Builder for Google Maps allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 10Web Map Builder for Google Maps: from n/a through 1.0.73.

Missing Authorization vulnerability in 10Web 10WebAnalytics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 10WebAnalytics: from n/a through 1.2.12.

Missing Authorization vulnerability in CusRev Customer Reviews for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Customer Reviews for WooCommerce: from n/a through 5.36.0.

Missing Authorization vulnerability in weDevs WP ERP allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP ERP: from n/a through 1.12.6.