Buffer Overflow vulnerability in hzeller timg v.1.5.2 and before allows a remote attacker to cause a denial of service via the 0x61200000045c address.

**I use afl++ fuzzing this program**

    export CC=/usr/bin/clang
    export CXX=/usr/bin/clang++
    cmake -B build && cmake --build build
    ➜  src ./timg --version
    timg 1.5.1+  <https://timg.sh/>
    Copyright (c) 2016..2023 Henner Zeller. This program is free software; license GPL 2.0.
    
    Image decoding GraphicsMagick 1.3.38 (2022-03-26)
    Turbo JPEG
    QOI Image reader
    STB image loading fallback
    Video decoding libav 58.76.100
    Half, quarter, iterm2, and kitty encoding timg builtin.
    Libsixel version 1.8.6
    

then build afl++ run this poc

    =================================================================
    ==2368346==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61200000045c at pc 0x00000051d18e bp 0x7fff288903e0 sp 0x7fff288903d8
    WRITE of size 4 at 0x61200000045c thread T0
        #0 0x51d18d in void timg::StoreBacking<2>(timg::rgba_t*, timg::rgba_t const*, timg::rgba_t const*) /home/xxx/timg-1.5.1/src/unicode-block-canvas.cc:145:20
        #1 0x51d18d in char* timg::UnicodeBlockCanvas::AppendDoubleRow<2, 24>(char*, int, int, timg::rgba_t const*, timg::rgba_t const*, bool, int*) /home/xxx/timg-1.5.1/src/unicode-block-canvas.cc:305:9
        #2 0x518011 in timg::UnicodeBlockCanvas::Send(int, int, timg::Framebuffer const&, timg::SeqType, timg::Duration) /home/xxx/timg-1.5.1/src/unicode-block-canvas.cc:374:23
        #3 0x5126c6 in timg::(anonymous namespace)::SingleColumnRenderer::render_cb(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&)::'lambda'(int, int, timg::Framebuffer const&, timg::SeqType, timg::Duration const&)::operator()(int, int, timg::Framebuffer const&, timg::SeqType, timg::Duration const&) const /home/xxx/timg-1.5.1/src/renderer.cc:50:22
        #4 0x5126c6 in void std::__invoke_impl<void, timg::(anonymous namespace)::SingleColumnRenderer::render_cb(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&)::'lambda'(int, int, timg::Framebuffer const&, timg::SeqType, timg::Duration const&)&, int, int, timg::Framebuffer const&, timg::SeqType, timg::Duration>(std::__invoke_other, timg::(anonymous namespace)::SingleColumnRenderer::render_cb(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&)::'lambda'(int, int, timg::Framebuffer const&, timg::SeqType, timg::Duration const&)&, int&&, int&&, timg::Framebuffer const&, timg::SeqType&&, timg::Duration&&) /usr/lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:61:14
        #5 0x5126c6 in std::enable_if<__and_<std::is_void<void>, std::__is_invocable<timg::(anonymous namespace)::SingleColumnRenderer::render_cb(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&)::'lambda'(int, int, timg::Framebuffer const&, timg::SeqType, timg::Duration const&)&, int, int, timg::Framebuffer const&, timg::SeqType, timg::Duration> >::value, void>::type std::__invoke_r<void, timg::(anonymous namespace)::SingleColumnRenderer::render_cb(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&)::'lambda'(int, int, timg::Framebuffer const&, timg::SeqType, timg::Duration const&)&, int, int, timg::Framebuffer const&, timg::SeqType, timg::Duration>(timg::(anonymous namespace)::SingleColumnRenderer::render_cb(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&)::'lambda'(int, int, timg::Framebuffer const&, timg::SeqType, timg::Duration const&)&, int&&, int&&, timg::Framebuffer const&, timg::SeqType&&, timg::Duration&&) /usr/lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:154:7
        #6 0x5126c6 in std::_Function_handler<void (int, int, timg::Framebuffer const&, timg::SeqType, timg::Duration), timg::(anonymous namespace)::SingleColumnRenderer::render_cb(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&)::'lambda'(int, int, timg::Framebuffer const&, timg::SeqType, timg::Duration const&)>::_M_invoke(std::_Any_data const&, int&&, int&&, timg::Framebuffer const&, timg::SeqType&&, timg::Duration&&) /usr/lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/std_function.h:290:9
        #7 0x5730d7 in std::function<void (int, int, timg::Framebuffer const&, timg::SeqType, timg::Duration)>::operator()(int, int, timg::Framebuffer const&, timg::SeqType, timg::Duration) const /usr/lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/std_function.h:590:9
        #8 0x5730d7 in timg::STBImageSource::SendFrames(timg::Duration const&, int, int const volatile&, std::function<void (int, int, timg::Framebuffer const&, timg::SeqType, timg::Duration)> const&) /home/xxx/timg-1.5.1/src/stb-image-source.cc:163:13
        #9 0x4e10eb in PresentImages(std::vector<std::future<timg::ImageSource*>, std::allocator<std::future<timg::ImageSource*> > >*, timg::DisplayOptions const&, timg::PresentationOptions const&, timg::BufferedWriteSequencer*, bool*) /home/xxx/timg-1.5.1/src/timg.cc:373:17
        #10 0x4e10eb in main /home/xxx/timg-1.5.1/src/timg.cc:960:5
        #11 0x7fa43c829d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
        #12 0x7fa43c829e3f in __libc_start_main csu/../csu/libc-start.c:392:3
        #13 0x426ee4 in _start (/home/xxx/timg-1.5.1/afl/src/timg+0x426ee4)
    
    0x61200000045c is located 0 bytes to the right of 284-byte region [0x612000000340,0x61200000045c)
    allocated by thread T0 here:
        #0 0x4a40c3 in __interceptor_realloc (/home/xxx/timg-1.5.1/afl/src/timg+0x4a40c3)
        #1 0x5179a8 in timg::UnicodeBlockCanvas::RequestBuffers(int, int) /home/xxx/timg-1.5.1/src/unicode-block-canvas.cc:424:42
        #2 0x5179a8 in timg::UnicodeBlockCanvas::Send(int, int, timg::Framebuffer const&, timg::SeqType, timg::Duration) /home/xxx/timg-1.5.1/src/unicode-block-canvas.cc:322:26
        #3 0x5126c6 in timg::(anonymous namespace)::SingleColumnRenderer::render_cb(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&)::'lambda'(int, int, timg::Framebuffer const&, timg::SeqType, timg::Duration const&)::operator()(int, int, timg::Framebuffer const&, timg::SeqType, timg::Duration const&) const /home/xxx/timg-1.5.1/src/renderer.cc:50:22
        #4 0x5126c6 in void std::__invoke_impl<void, timg::(anonymous namespace)::SingleColumnRenderer::render_cb(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&)::'lambda'(int, int, timg::Framebuffer const&, timg::SeqType, timg::Duration const&)&, int, int, timg::Framebuffer const&, timg::SeqType, timg::Duration>(std::__invoke_other, timg::(anonymous namespace)::SingleColumnRenderer::render_cb(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&)::'lambda'(int, int, timg::Framebuffer const&, timg::SeqType, timg::Duration const&)&, int&&, int&&, timg::Framebuffer const&, timg::SeqType&&, timg::Duration&&) /usr/lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:61:14
        #5 0x5126c6 in std::enable_if<__and_<std::is_void<void>, std::__is_invocable<timg::(anonymous namespace)::SingleColumnRenderer::render_cb(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&)::'lambda'(int, int, timg::Framebuffer const&, timg::SeqType, timg::Duration const&)&, int, int, timg::Framebuffer const&, timg::SeqType, timg::Duration> >::value, void>::type std::__invoke_r<void, timg::(anonymous namespace)::SingleColumnRenderer::render_cb(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&)::'lambda'(int, int, timg::Framebuffer const&, timg::SeqType, timg::Duration const&)&, int, int, timg::Framebuffer const&, timg::SeqType, timg::Duration>(timg::(anonymous namespace)::SingleColumnRenderer::render_cb(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&)::'lambda'(int, int, timg::Framebuffer const&, timg::SeqType, timg::Duration const&)&, int&&, int&&, timg::Framebuffer const&, timg::SeqType&&, timg::Duration&&) /usr/lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:154:7
        #6 0x5126c6 in std::_Function_handler<void (int, int, timg::Framebuffer const&, timg::SeqType, timg::Duration), timg::(anonymous namespace)::SingleColumnRenderer::render_cb(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&)::'lambda'(int, int, timg::Framebuffer const&, timg::SeqType, timg::Duration const&)>::_M_invoke(std::_Any_data const&, int&&, int&&, timg::Framebuffer const&, timg::SeqType&&, timg::Duration&&) /usr/lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/std_function.h:290:9
        #7 0x5730d7 in std::function<void (int, int, timg::Framebuffer const&, timg::SeqType, timg::Duration)>::operator()(int, int, timg::Framebuffer const&, timg::SeqType, timg::Duration) const /usr/lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/std_function.h:590:9
        #8 0x5730d7 in timg::STBImageSource::SendFrames(timg::Duration const&, int, int const volatile&, std::function<void (int, int, timg::Framebuffer const&, timg::SeqType, timg::Duration)> const&) /home/xxx/timg-1.5.1/src/stb-image-source.cc:163:13
        #9 0x4e10eb in PresentImages(std::vector<std::future<timg::ImageSource*>, std::allocator<std::future<timg::ImageSource*> > >*, timg::DisplayOptions const&, timg::PresentationOptions const&, timg::BufferedWriteSequencer*, bool*) /home/xxx/timg-1.5.1/src/timg.cc:373:17
        #10 0x4e10eb in main /home/xxx/timg-1.5.1/src/timg.cc:960:5
        #11 0x7fa43c829d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    
    SUMMARY: AddressSanitizer: heap-buffer-overflow /home/xxx/timg-1.5.1/src/unicode-block-canvas.cc:145:20 in void timg::StoreBacking<2>(timg::rgba_t*, timg::rgba_t const*, timg::rgba_t const*)
    Shadow bytes around the buggy address:
      0x0c247fff8030: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
      0x0c247fff8040: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      0x0c247fff8050: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa
      0x0c247fff8060: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
      0x0c247fff8070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    =>0x0c247fff8080: 00 00 00 00 00 00 00 00 00 00 00[04]fa fa fa fa
      0x0c247fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c247fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c247fff80b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c247fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c247fff80d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
    Shadow byte legend (one shadow byte represents 8 application bytes):
      Addressable:           00
      Partially addressable: 01 02 03 04 05 06 07 
      Heap left redzone:       fa
      Freed heap region:       fd
      Stack left redzone:      f1
      Stack mid redzone:       f2
      Stack right redzone:     f3
      Stack after return:      f5
      Stack use after scope:   f8
      Global redzone:          f9
      Global init order:       f6
      Poisoned by user:        f7
      Container overflow:      fc
      Array cookie:            ac
      Intra object redzone:    bb
      ASan internal:           fe
      Left alloca redzone:     ca
      Right alloca redzone:    cb
    ==2368346==ABORTING

CVE-2023-40968: Detected Crash: AddressSanitizer: heap-buffer-overflow · Issue #115 · hzeller/timg

An authorization/sensitive information disclosure vulnerability was identified in GitHub Enterprise Server that allowed a fork to retain read access to an upstream repository after its visibility was changed to private. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.10.0 and was fixed in versions 3.9.4, 3.8.9, 3.7.16 and 3.6.18. This vulnerability was reported via the GitHub Bug Bounty program.


CVE-2023-23763: Release notes - GitHub Enterprise Server 3.6 Docs

A cross-site scripting (XSS) vulnerability in General Solutions Steiner GmbH CASE 3 Taskmanagement V 3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the fieldname parameter.

CASE 2 Vers. 3.0 unterstützt in Katastrophenfällen das Krisenmanagement dabei, innerhalb kürzester Zeit eine Vielzahl an Informationen digital zu erfassen, zu bündeln und zu filtern. Je nach Erfordernissen können diese Daten abgerufen, mit zusätzlichen Informationen ergänzt und für berechtigte Personengruppen und beispielsweise die Öffentlichkeit aufbereitet werden.

Die Benutzeroberfläche ermöglicht darüber hinaus die Kommunikation innerhalb des Krisenstabes und den dazugehörigen Abteilungen wie beispielsweise dem Call Center Team. Gleichzeitig können Tasks und Arbeitsanweisungen mithilfe des Task Managements zugewiesen und Arbeitsschritte und Vorkommnisse im Logbuch dokumentiert werden.

Mit der Callcenter-Funktionalität erfassen und katalogisieren die Mitarbeiter alle Anrufe und ordnen diese den betroffenen Passagieren zu. Im Mittelpunkt steht dabei die Betreuung der Angehörigen: Von der Organisation der Anreise und Unterkunft bis hin zur Betreuung vor Ort werden sämtliche Daten erfasst und entsprechend aufbereitet.

**Einfache Kommunikation**

Das umfassende System bietet den Einsatzorganisationen und Einsatzleitern eine hoch entwickelte Plattform für die gesamte interne und externe Kommunikation. Einfach in der Anwendung und Administration ist die Software-Lösung ein All-in-one-Tool einerseits für den lückenlosen Austausch mit Mitarbeitern und andererseits, um die Presse, Öffentlichkeit und Angehörige zeitnah zu informieren.

**Visualisierung und Dokumentation**

Sämtliche Daten sind für Berechtigte laufend abrufbar und editierbar, die Visualisierung der Einsatzlage erfolgt somit in Echtzeit. In der wichtigen Aufbereitungsphase greifen die Systembenutzer auf eine umfangreiche Dokumentation zurück, die auch einer rechtlichen Prüfung standhält.

**Digitales Krisenmanagement**

Bei Großereignissen fallen innerhalb kurzer Zeit eine Vielzahl von Informationen an, die digital erfasst, gebündelt und gefiltert werden. Mit CASE 2 erfolgt die Datenerfassung am Ort des Geschehens mit einer webfähigen und plattformunabhängigen Lösung.

**Schnittstellen**

CASE2 Airline bietet einen integrierten Satz von standardisierten Schnittstellen. Datenaustausch ist per XML oder CSV Dateien möglich.

**Reportingfunktionalität**

Aus der Fülle von Daten lassen sich aussagekräftige Reports generieren, die als Entscheidungsgrundlage für den Einsatzleiter dienen können. So erhält der Leiter beispielsweise eine Übersicht aller Anrufer aus einem Bundesland, die einen Angehörigen vermissen und noch auf einen Rückruf warten.

**Echtzeit Lageübersicht**

Die betroffenen Organisationen haben den großen Vorteil, dass die Informationen aller Mitarbeiter automatisch und in Echtzeit erfolgt. Durch die gezielte Bündelung von Daten aus den verschiedensten Quellen ist Contwise CASE2 Airline auch im Bereich der Opferidentifizierung ein enorm wichtiges Hilfsmittel.

**Dublettenschablone**

Dadurch, dass Personendaten oftmals simultan eintreffen, kann es vorkommen, dass Opfer oder Angehörige in Listen doppelt geführt werden. Deshalb wurde in CASE2 Airline ein leistungsfähiger Algorithmus zur Dublettensuche integriert, mit dem es möglich ist, Namen anhand ihrer phonetischen Ähnlichkeit zu erkennen.

**Flexibilität & Erweiterbarkeit**

Da jeder Einsatz anders verläuft und andere Kriterien ausschlaggebend sind, wurde in CASE2 Airline ein flexibler Erweiterungsmechanismus eingebaut. Während des Einsatzfalles können Felder ergänzt und Formulare angepasst werden.

**Zeitzonen optimiert**

Systemzeit ist die UTC. Jeder Mitarbeiter kann jedoch für seinen Zugang seine eigene Zeitzone festlegen. Sämtliche Eingaben des Mitarbeiters werden im Hintergrund in die UTC umgewandelt. So müssen Zeitzonen beim Arbeiten mit CASE2 Airline nicht weiter beachtet werden.

CVE-2023-37826: Contwise Case2 - Startseite

A cross-site scripting (XSS) vulnerability in General Solutions Steiner GmbH CASE 3 Taskmanagement V 3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter.

*   *   Actions
        
        Automate any workflow
        
    *   Packages
        
        Host and manage packages
        
    *   Security
        
        Find and fix vulnerabilities
        
    *   Codespaces
        
        Instant dev environments
        
    *   Copilot
        
        Write better code with AI
        
    *   Code review
        
        Manage code changes
        
    *   Issues
        
        Plan and track work
        
    *   Discussions
        
        Collaborate outside of code
        
    

*   *   GitHub Sponsors
        
        Fund open source developers
        
    
    *   The ReadME Project
        
        GitHub community articles
        
    
*   Pricing

**Search code, repositories, users, issues, pull requests...**

**Provide feedback**

**Saved searches****Use saved searches to filter your results more quickly**

Sign up

CVE-2023-37830: CVEs/CVE-2023-37830 at main · Popeye-ITSec/CVEs

A cross site scripting (XSS) vulnerability in the Markdown Editor component of Typora v1.6.7 allows attackers to execute arbitrary code via uploading a crafted Markdown file.

**Vulnerability Overview**

There is an XSS vulnerability because the editor mishandled when parsing the embed tag in html. The html tag is <embed src="https://c0olw.github.io/pic/1.html">

**Vulnerability Reproduction**

1.  Download the lastest version of Typora from https://typora.io/.
    
    The version when I downloaded was 1.6.7.
    
2.  Use Typora to open or edit a markdown file.
    
    For example, I created a file called “xss test.md” with typora.
    

1.  Enter <embed src="https://c0olw.github.io/pic/1.html"> to let Typora parse the html tags, resulting in the execution of malicious Javascript.
    
    When just entering the embed tag:
    
    After Typora parses the embed tag:
    

版权声明: 本博客所有文章除特别声明外，均采用 CC BY-NC-SA 4.0 许可协议。转载请注明来自 凉风's Blog！

CVE-2023-39703: Typora XSS Vulnerability

A cross-site scripting (XSS) vulnerability in General Solutions Steiner GmbH CASE 3 Taskmanagement V 3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the notification.message parameter.

CVE-2023-37829: CVEs/CVE-2023-37829 at main · Popeye-ITSec/CVEs

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Dharmesh Patel Post List With Featured Image plugin <= 1.2 versions.

**Solution**

 No fix

No patched version is available. No reply from the vendor.

LEE SE HYOUNG (hackintoanetwork) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Post List With Featured Image Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**No other known vulnerabilities for this plugin**Report

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-37997: WordPress Post List With Featured Image plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability - Patchstack

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Artem Abramovich Art Decoration Shortcode plugin <= 1.5.6 versions.

**Solution**

 No fix

No patched version is available. No reply from the vendor.

Found this useful? Thank yuyudhn for reporting this vulnerability. Buy a coffee ☕

yuyudhn discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Art Decoration Shortcode Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**No other known vulnerabilities for this plugin**Report

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-37994: WordPress Art Decoration Shortcode plugin <= 1.5.6 - Cross Site Scripting (XSS) - Patchstack

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Chop-Chop Coming Soon Chop Chop plugin <= 2.2.4 versions.

**Solution**

 No fix

No patched version is available. No reply from the vendor.

Phd discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Coming Soon Chop Chop Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**No other known vulnerabilities for this plugin**Report

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-37893: WordPress Coming Soon Chop Chop plugin <= 2.2.4 - Reflected Cross Site Scripting (XSS) vulnerability - Patchstack

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in ShopConstruct plugin <= 1.1.2 versions.

**Solution**

 No fix

No patched version is available.

Abu Hurayra discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress ShopConstruct – Product Catalog, Shopping Cart and eCommerce solution for Store Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**No other known vulnerabilities for this plugin**Report

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more