Haudayroi - Bluerock

Name of the Vulnerable Software and Affected Versions: dFactory Download Attachments versions n/a through 1.3.1 Description: The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability, which allows exploiting incorrectly configured access control security levels. This vulnerability can be exploited in the Download Attachments feature. Recommendations: For versions n/a through 1.3.1, update to a version that contains a fix for this issue, as the current version allows exploiting incorrectly configured access control security levels. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** cmsMinds Pay with Contact Form 7 versions 1.0.0 through 1.0.4 **Description** The issue is a Cross-Site Request Forgery (CSRF) vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This is a type of attack where an attacker tricks a user into performing an unintended action on a web application that the user is authenticated to. **Recommendations** For versions 1.0.0 through 1.0.4, update to a version that includes a fix for this issue, as no specific mitigation measures are provided for these versions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WP Corner Quick Event Calendar versions 1.4.9 and earlier **Description** The issue is a Cross-Site Request Forgery (CSRF) vulnerability, which allows an attacker to perform unauthorized actions on a user's account. **Recommendations** For WP Corner Quick Event Calendar versions 1.4.9 and earlier, update to a version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** WP Live Chat + Chatbots Plugin for WordPress – Chaport versions 1.1.5 and earlier **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS attacks. The estimated number of potentially affected devices and details about real-world incidents are not provided. **Recommendations** For versions 1.1.5 and earlier, update to a version later than 1.1.5 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Simple calendar for Elementor versions 1.6.5 and earlier **Description** The issue is a Cross-Site Request Forgery (CSRF) vulnerability, which allows for Cross Site Request Forgery. **Recommendations** For versions 1.6.5 and earlier, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TrueBooker versions 1.0.7 and earlier **Description** A Cross-Site Request Forgery (CSRF) issue affects the software, allowing unauthorized actions to be performed on behalf of a user. **Recommendations** For versions 1.0.7 and earlier, update to a version that includes a fix for this issue, as no specific mitigation measures are provided for these versions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.