CVE-2023-48089: Undefined Security Weakness

xxl-job-admin 2.4.0 is vulnerable to Remote Code Execution RCE via /xxl-job-admin/jobcode/save...

PT-2023-32158

Name of the Vulnerable Software and Affected Versions ImageMapper plugin for WordPress versions up to, and including, 1.2.6 Description The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the imgmap save area title function. This allows unauthenticat...

distributed computing platforms and Unauthorized Access

The vulnerability of distributed computing platforms and the PowerJob task scheduling system is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to the user/save interface...

CVE-2023-38965

Lost and Found Information System 1.0 allows account takeover via username and password to a /classes/Users.php?f=save URI...

CVE-2023-38965: Authorization Bypass Through User-Controlled Key

Lost and Found Information System 1.0 allows account takeover via username and password to a /classes/Users.php?f=save URI...

CVE-2023-5916

A vulnerability classified as critical has been found in Lissy93 Dashy 2.1.1. This affects an unknown part of the file /config-manager/save of the component Configuration Handler. The manipulation of the argument config leads to improper access controls. It is possible to initiate the attack...

PT-2023-32415 · Unknown · Lissy93 Dashy

Name of the Vulnerable Software and Affected Versions: Lissy93 Dashy version 2.1.1 Description: A critical vulnerability has been found in Lissy93 Dashy, affecting an unknown part of the file /config-manager/save of the component Configuration Handler. The manipulation of the argument config lead...

PT-2023-7406 · Solarwinds · Solarwinds Network Configuration Manager

Name of the Vulnerable Software and Affected Versions: SolarWinds Network Configuration Manager affected versions not specified Description: The issue is related to a Directory Traversal Remote Code Execution vulnerability in the SaveResultsToFile method of the Network Configuration Manager. This...

CVE-2023-45670

Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, the "config/save" and "config/set" endpoints of Frigate do not implement any CSRF protection. This makes it possible for a request sourced from another site to update the configuration of the Frigate server e.g. via...

Frigate Cross-Site Request Forgery Vulnerability

Frigate is a complete local NVR designed for home assistants with AI object detection from the individual developer Blake Blackshear. A cross-site request forgery vulnerability exists in Frigate versions prior to 0.13.0 Beta 3, which stems from a cross-site request forgery CSRF vulnerability in t...

CVE-2023-45670: Cross-Site Request Forgery (CSRF)

Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, the config/save and config/set endpoints of Frigate do not implement any CSRF protection. This makes it possible for a request sourced from another site to update the configuration of the Frigate server e.g. via...

CVE-2023-40135

In applyCustomDescription of SaveUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-5814

A vulnerability was found in SourceCodester Task Reminder System 1.0. It has been classified as critical. This affects an unknown part of the file /classes/Master.php?f=savereminder. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The...

Task Reminder System SQL Injection Vulnerability

Task Reminder System is a task reminder system by Carlo Montero Personal Developer. A security vulnerability exists in Task Reminder System version 1.0, which stems from a parameter id in the file /classes/Master.php?f=savereminder that can lead to SQL injection...

PT-2023-32348 · Unknown · Sourcecodester Task Reminder System

Name of the Vulnerable Software and Affected Versions: SourceCodester Task Reminder System version 1.0 Description: A critical issue has been found, affecting an unknown part of the file /classes/Master.php?f=save reminder. The manipulation of the id argument leads to SQL injection. This issue ca...

CVE-2020-36751

The Coupon Creator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1. This is due to missing or incorrect nonce validation on the savemeta function. This makes it possible for unauthenticated attackers to save meta fields via a forged request...

CVE-2020-36758

The RSS Aggregator by Feedzy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.2. This is due to missing or incorrect nonce validation on the savefeedzyposttypemeta function. This makes it possible for unauthenticated attackers to update post...

CVE-2020-36753

The Hueman theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.6.3. This is due to missing or incorrect nonce validation on the savemetabox function. This makes it possible for unauthenticated attackers to save metabox data via a forged request...

WordPress Plugin Paid Memberships Pro Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

PT-2023-11894 · WordPress · Paid Memberships Pro

Name of the Vulnerable Software and Affected Versions: Paid Memberships Pro plugin for WordPress versions up to, and including, 2.4.2 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the pmpro page save function. This allows...