CVE-2024-3231
published 2024-05-17CVE-2024-3231: The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site…
PriorityP334medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EXPLOIT
EPSS
0.68%
47.9th percentile
The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ivanweb | popup4phone | <= 1.3.2 | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
vendor_redhat5.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-xq5f-88w9-ffw2: The Popup4Phone WordPress plugin through 1
ghsa_unreviewed·2024-05-17
CVE-2024-3231 [MEDIUM] CWE-79 GHSA-xq5f-88w9-ffw2: The Popup4Phone WordPress plugin through 1
The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins.
Red Hat
kernel: io_uring: fix error pbuf checking
vendor_redhat·2024-08-08·CVSS 5.5
CVE-2024-42254 [MEDIUM] kernel: io_uring: fix error pbuf checking
kernel: io_uring: fix error pbuf checking
In the Linux kernel, the following vulnerability has been resolved:
io_uring: fix error pbuf checking
Syz reports a problem, which boils down to NULL vs IS_ERR inconsistent
error handling in io_alloc_pbuf_ring().
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: 0010:__io_remove_buffers+0xac/0x700 io_uring/kbuf.c:341
Call Trace:
io_put_bl io_uring/kbuf.c:378 [inline]
io_destroy_buffers+0x14e/0x490 io_uring/kbuf.c:392
io_ring_ctx_free+0xa00/0x1070 io_uring/io_uring.c:2613
io_ring_exit_work+0x80f/0x8a0 io_uring/io_uring.c:2844
process_one_work kernel/workqueue.c:3231 [inline]
process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
worker_thread+0x86d/0xd40 kernel/workqueue.c:3390
kthread+0x2f0/0x390 kernel/kthread.c:3
No detection rules found.
Nuclei
Popup4Phone <= 1.3.2 - Unauthenticated Stored Cross-Site Scripting
nuclei·CVSS 6.1
CVE-2024-3231 [MEDIUM] Popup4Phone <= 1.3.2 - Unauthenticated Stored Cross-Site Scripting
Popup4Phone alert(document.domain)")'
condition: and
# digest: 490a0046304402201da3aab4393732fb6f4d2478a1410a4a851129e56e4e6e1d07516d3a230c26c30220219e995290171a78c657950d8011e771f6f96ed76f81c14445561825eb1ed580:922c64590222798bb761d5b6d8e72950
No writeups or analysis indexed.
2024-05-17
Published