CVE-2024-30248 Piccolo Admin's raw SVG loading may lead to complete data compromise from admin page

Piccolo Admin is an admin interface/content management system for Python, built on top of Piccolo. Piccolo's admin panel allows media files to be uploaded. As a default, SVG is an allowed file type for upload. An attacker can upload an SVG which when loaded can allow arbitrary access to the admin...

Piccolo 安全漏洞

Piccolo is a fast, user-friendly ORM and query builder from Piccolo Open Source. A security vulnerability exists in Piccolo Admin prior to version 1.3.2, which stems from the fact that Piccolo's admin panel allows uploading of media files, which can be exploited by an attacker to upload an SVG...

PT-2024-23295

Name of the Vulnerable Software and Affected Versions Piccolo Admin versions prior to 1.3.2 Description The issue concerns the Piccolo Admin interface, which allows media file uploads, including SVG files by default. An attacker can upload a malicious SVG file, which, when loaded, can provide...

PT-2024-23792 · Webdorado · Webdorado Spiderfaq

Name of the Vulnerable Software and Affected Versions: WebDorado SpiderFAQ versions 1.3.2 and earlier Description: The issue is related to improper neutralization of input during web page generation, which leads to a Cross-site Scripting XSS vulnerability. This allows for Reflected XSS attacks...

WordPress SpiderFAQ plugin <= 1.3.2 - Cross Site Scripting vulnerability

Cross Site Scripting vulnerability discovered by Dimas Maulana Patchstack Alliance in WordPress Plugin SpiderFAQ versions = 1.3.2...

CVE-2024-30224

Deserialization of Untrusted Data vulnerability in Wholesale Team WholesaleX.This issue affects WholesaleX: from n/a through 1.3.2...

CVE-2024-30224

Deserialization of Untrusted Data vulnerability in Wholesale Team WholesaleX.This issue affects WholesaleX: from n/a through 1.3.2...

CVE-2024-29906

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter MDTF allows Stored XSS.This issue affects WordPress Meta Data and Taxonomies Filter MDTF: from n/a through 1.3.2...

PT-2024-23269 · Unknown · Wholesalex

Name of the Vulnerable Software and Affected Versions: WholesaleX versions 1.3.2 and earlier Description: The issue is related to the deserialization of untrusted data. This can potentially lead to security risks, as deserializing untrusted data can allow an attacker to execute malicious code. No...

PT-2024-23156 · WordPress · Wordpress Meta Data/Taxonomies Filter

Name of the Vulnerable Software and Affected Versions: WordPress Meta Data and Taxonomies Filter MDTF versions 1.3.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This mean...

PT-2024-23127 · WordPress · Wordpress Meta Data/Taxonomies Filter

Name of the Vulnerable Software and Affected Versions: WordPress Meta Data and Taxonomies Filter MDTF versions 1.3.2 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an...

WordPress WholesaleX Plugin <= 1.3.1 is vulnerable to Broken Access Control

Software WholesaleX Type Plugin Vulnerable versions = 1.3.1 Fixed in 1.3.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-30234 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID d5e0c742e615 Credits Emili Castells Required...

PT-2024-22185 · Unknown · Wen Responsive Columns

Name of the Vulnerable Software and Affected Versions: WEN Responsive Columns versions 1.3.2 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can inject...

BACnet Stack Security Vulnerability

BACnet Stack is a BACnet open source protocol stack C library for embedded systems, Linux, MacOS, BSD and Windows. A security vulnerability exists in BACnet Stack versions prior to 1.3.2 that stems from the presence of buffer over-reads...

WordPress plugin Contact Form Entries Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A security vulnerability exists in the WordPress plugin...

Sql injection

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. The application allows users to create zip files from available files on the site. In the 1.x branch prior to version 1.3.2, parameter selectedIds is susceptible to SQL Injection. Any backend user with very basic...

CVE-2024-23341

TuiTse-TsuSin is a package for organizing the comparative corpus of Taiwanese Chinese characters and Roman characters, and extracting sentences of the Taiwanese Chinese characters and the Roman characters. Prior to version 1.3.2, when using tuitsehtml without quoting the input, there is a html...

Input validation

TuiTse-TsuSin is a package for organizing the comparative corpus of Taiwanese Chinese characters and Roman characters, and extracting sentences of the Taiwanese Chinese characters and the Roman characters. Prior to version 1.3.2, when using tuitsehtml without quoting the input, there is a html...

PYSEC-2024-22

TuiTse-TsuSin is a package for organizing the comparative corpus of Taiwanese Chinese characters and Roman characters, and extracting sentences of the Taiwanese Chinese characters and the Roman characters. Prior to version 1.3.2, when using tuitsehtml without quoting the input, there is a html...

CVE-2024-23341

CVE-2024-23341 affects the TuiTse-TsuSin package. Before version 1.3.2, using tuitse_html without quoting the input enables a HTML injection vulnerability. A patch was released in version 1.3.2. Workarounds include sanitizing Taigi input with HTML quotation. Mitigations/impact are described in mu...