#php

K-LOANS version 1.4.5 suffers from an ignored default credential vulnerability.

The Leyka plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.30.3 via the 'leyka_ajax_get_env_and_options' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including Sberbank API key and password, PayPal Client Secret, and more keys and passwords.

The Login with phone number plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.8. This is due to missing nonce validation on the 'lwp_update_password_action' function. This makes it possible for unauthenticated attackers to change user password via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Cross Site Scripting vulnerability in WP Githuber MD plugin v.1.16.2 allows a remote attacker to execute arbitrary code via a crafted payload to the new article function.

Equipment Rental Script version 1.0 suffers from a remote SQL injection vulnerability.

Kolifa Download CMS version 1.2 suffers from an html injection vulnerability.

KALIMATAN GMS version 1.0.0 suffers from a cross site scripting vulnerability.

Kylin CMS version 1.3.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

Kaledo RD CMS version 1.0 suffers from a remote SQL injection vulnerability.

DedeCMS 5.7.102 has a File Upload vulnerability via uploads/dede/module_make.php.