Security Advisories

IDURAR ERP/CRM NoSQL injection SQL injection vulnerability via the component /api/login.

FluentForms <= 4.3.22 Stored XSS via Custom HTML fields The plugin does not properly sanitize and escape the srcdoc attribute in iframes in it's custom HTML field type, allowing a logged in user with

AnyWhere Elementor <= 1.2.7 – Freemius API Key Disclosure The plugin discloses a Freemius Secret Key which could be used by an attacker to purchase the pro subscription using test credit card numbers

Elementor Website Builder <= 3.10.0 – Admin+ SQLi The plugin does not properly sanitize and escape the Replace URL parameter in the Tools module before using it in a SQL statement, leading to a SQL

WPCode <= 2.0.6 – Contributor+ WPCode.com Library Connection Modification The plugin does not have adequate privilege checks in place for several AJAX actions, only checking the nonce.

Siri(iPhone 8 and later) – Meeting/Event Disclosure on Locked iPhone A privacy risk in Siri is where an attacker with physical access to a locked iPhone can view all the scheduled events and

WP ALL Export Pro < 1.7.9 – Authenticated Code Injection The plugin does not limit some functionality during exports only to users with the Administrator role, allowing any logged in user which has

Import all XML, CSV & TXT into WordPress < 6.5.8 – Missing Authorisation The plugin does not have authorisation in some places, which could allow any authenticated users to access some of the plugin

SQL injection in School Management System 1.0 allows remote attackers to modify or delete data, causing persistent changes to the application's content or behavior by using malicious SQL queries.