PT-2022-22604 · Unknown · Shopro Mall System

Name of the Vulnerable Software and Affected Versions: Shopro Mall System version 1.3.8 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the value parameter. Recommendations: For Shopro Mall System version 1.3.8, consider restricting acce...

Shopro Mall System SQL注入漏洞

XPTECH Shopro Mall System is a mall management system from China's XPTECH company. A security vulnerability exists in Shopro Mall System v1.3.8, which originates from the discovery of a SQL injection vulnerability via the value parameter...

CVE-2022-0598

The Login with phone number WordPress plugin before 1.3.8 does not sanitise and escape plugin settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2022-13293 · WordPress · Login With Phone Number

Name of the Vulnerable Software and Affected Versions: Login with phone number WordPress plugin versions prior to 1.3.8 Description: The issue allows high privilege users to perform Cross-Site Scripting attacks due to the plugin's failure to sanitise and escape its settings, even when the...

CVE-2022-1532

Themify WordPress plugin before 1.3.8 does not sanitise and escape the page parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting...

CVE-2022-1218

CVE-2022-1218 affects the WordPress Domain Replace plugin (versions up to 1.3.8). The vulnerability is a reflected Cross-Site Scripting caused by failing to sanitise/escape a parameter before outputting it in an admin-page attribute. Impact is reflected-XSS access via crafted input; PoCs exist in...

Mangboard commerce package 输入验证错误漏洞

Mangboard commerce package is an e-commerce website plugin from the Korean company Mangboard. A security vulnerability exists in Mangboard commerce package prior to version 1.3.8, which stems from improper input validation. A remote attacker can exploit the vulnerability to manipulate the total...

GHSA-W94P-6MHW-4QXW Improper Access Control in Elasticsearch

The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script...

Domain Replace <= 1.3.8 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape a parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting PoC https://example.com/wp-admin/admin.php?page=dr-convert=%3Csvg%2Fonload%3Dalert%28%2Fxss%2F%29%3E...

Domain Replace <= 1.3.8 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape a parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting https://example.com/wp-admin/admin.php?page=dr-convert&msg=%3Csvg%2Fonload%3Dalert%28%2Fxss%2F%29%3E...

CVE-2022-25615

Cross-Site Request Forgery CSRF in StylemixThemes eRoom – Zoom Meetings & Webinar WordPress plugin = 1.3.8 allows cache deletion...

CVE-2022-25615

Cross-Site Request Forgery CSRF in StylemixThemes eRoom – Zoom Meetings & Webinar WordPress plugin = 1.3.8 allows cache deletion...

CVE-2022-1023

The Podcast Importer SecondLine WordPress plugin before 1.3.8 does not sanitise and properly escape some imported data, which could allow SQL injection attacks to be performed by imported a malicious podcast file...

CVE-2021-42705

PLC Editor Versions 1.3.8 and prior is vulnerable to a stack-based buffer overflow while processing project files, which may allow an attacker to execute arbitrary code...

Stack overflow

PLC Editor Versions 1.3.8 and prior is vulnerable to a stack-based buffer overflow while processing project files, which may allow an attacker to execute arbitrary code...

WECON PLC Editor Out-of-Bounds Writing Vulnerability

WECON PLC Editor is a PLC programming software.An out-of-bounds write vulnerability exists in WECON PLC Editor 1.3.8 and earlier versions. An attacker can exploit this vulnerability to execute arbitrary code...

CVE-2021-42707

PLC Editor Versions 1.3.8 and prior is vulnerable to an out-of-bounds write while processing project files, which may allow an attacker to execute arbitrary code...

WECON Technologies PLC Editor 安全漏洞

WECON PLC Editor is a PLC programming software.WECON PLC Editor 1.3.8 and earlier versions are vulnerable to a stack buffer overflow. An attacker can exploit this vulnerability to execute arbitrary code...

Wecon Plc Editor 缓冲区错误漏洞

WECON PLC Editor is a PLC programming software.An out-of-bounds write vulnerability exists in WECON PLC Editor 1.3.8 and earlier versions. An attacker can exploit this vulnerability to execute arbitrary code...

CVE-2021-36845

Multiple Authenticated Stored Cross-Site Scripting XSS vulnerabilities in YITH Maintenance Mode WordPress plugin versions = 1.3.8, there are 46 vulnerable parameters that were missed by the vendor while patching the 1.3.7 version to 1.3.8. Vulnerable parameters: 1 - "Newsletter" tab,...