1335 matches found
Input validation
The Enable Media Replace WordPress plugin before 4.1.3 unserializes user input via the Remove Background feature, which could allow Author+ users to perform PHP Object Injection when a suitable gadget is present on the blog...
CVE-2023-4643
CVE-2023-4643 affects the WordPress Enable Media Replace plugin prior to version 4.1.3. The vulnerability stems from the plugin unserializing user input via the Remove Background feature, which enables PHP Object Injection if a suitable gadget is present on the blog. Multiple sources (NVD/NVD-der...
PT-2023-30025 · WordPress · Enable Media Replace
Name of the Vulnerable Software and Affected Versions: Enable Media Replace WordPress plugin versions prior to 4.1.3 Description: The issue allows Author+ users to perform PHP Object Injection when a suitable gadget is present on the blog, due to the unserialize of user input via the Remove...
WordPress plugin Enable Media Replace Code Issue Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in the...
PT-2023-5608 · D Link · D-Link Dar-8000 +1
Name of the Vulnerable Software and Affected Versions: D-Link DAR-7000 versions up to 20151231 D-Link DAR-8000 versions up to 20151231 Description: The issue is related to an unrestricted file upload vulnerability in the /useratte/web.php file of the D-Link DAR-7000 and DAR-8000 routers. This...
PT-2023-5603 · D Link · D-Link Dar-8000 +1
Name of the Vulnerable Software and Affected Versions: D-Link DAR-7000 versions up to 20151231 D-Link DAR-8000 versions up to 20151231 Description: The issue is related to an unrestricted file upload vulnerability in the /sysmanage/updatelib.php file of the D-Link DAR-7000 and DAR-8000 router...
Enable Media Replace < 4.1.3 - Author+ PHP Object Injection
Description The plugin unserializes user input via the Remove Background feature, which could allow Author+ users to perform PHP Object Injection when a suitable gadget is present on the blog PoC Step 1: Add the following code to the end of the file located at...
The vulnerability of the PDFDoc::replacePageDict function (PDFDoc.cc) in the Poppler PDF rendering library allows a attacker to trigger a service failure.
The vulnerability of the PDFDoc::replacePageDict function in the Poppler PDF rendering library is related to the insufficient use of the assert function. Exploiting this vulnerability could allow an attacker to cause service failures...
PT-2023-5718 · D Link · D-Link Dar-8000 +1
Name of the Vulnerable Software and Affected Versions: D-Link DAR-7000 and DAR-8000 up to 20151231 Description: A critical vulnerability was found in the /sysmanage/updateos.php file, allowing for unrestricted upload due to the manipulation of the file upload argument. This can be exploited...
CVE-2023-40984
A reflected cross-site scripting XSS vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scripts via injecting a crafted payload into the Replace in Results file...
CVE-2023-40984
A reflected cross-site scripting XSS vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scripts via injecting a crafted payload into the Replace in Results file...
WordPress Enable Media Replace Plugin < 4.1.3 is vulnerable to PHP Object Injection
Software Enable Media Replace Type Plugin Vulnerable versions 4.1.3 Fixed in 4.1.3 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE N/A Patch priority Low CVSS severity Low 6.6 Developer ShortPixel PSID 5d377501ce8e Credits Unknown Required privilege Editor Published 15 Septembe...
CVE-2023-40984
A reflected cross-site scripting XSS vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scripts via injecting a crafted payload into the Replace in Results file...
CVE-2023-40984
A reflected cross-site scripting XSS vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scripts via injecting a crafted payload into the Replace in Results file...
CVE-2023-40984
A reflected cross-site scripting XSS vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scripts via injecting a crafted payload into the Replace in Results file...
Medium: poppler
Issue Overview: An issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::replacePageDict in PDFDoc.cc lacks a stream check before saving an embedded file. CVE-2022-38349 Affected Packages: poppler Issue Correction: Run...
CVE-2023-41163
A Reflected Cross-site scripting XSS vulnerability in the file manager tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the replace in results field while replacing the results under the tools drop down...
PT-2023-27839 · Usermin · Usermin
Name of the Vulnerable Software and Affected Versions: Usermin version 2.000 Description: A Reflected Cross-site scripting XSS issue in the file manager tab allows remote attackers to inject arbitrary web script or HTML via the replace in results field while replacing the results under the tools...
Denial of Service (DoS)
Overview Affected versions of this package are vulnerable to Denial of Service DoS when the PDFDoc::replacePageDict function processes data missing a necessary stream check while saving an embedded file. The attacker can cause an assertion failure in Object.h, rendering the service unavailable...