PT-2024-30844 · Cozythemes · Cozythemes Fota Wp

Name of the Vulnerable Software and Affected Versions: CozyThemes Fota WP versions 1.4.1 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploitation of incorrectly configured access control security levels. Recommendations: For CozyThemes Fota...

WordPress plugin My Favorites 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

PT-2024-32524 · Unknown · Classic Widgets +1

Name of the Vulnerable Software and Affected Versions: WPGrim Classic Editor and Classic Widgets versions 1.4.1 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows attackers to...

WordPress plugin Classic Editor and Classic Widgets SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

PT-2024-33402 · Unknown · My Favorites

Name of the Vulnerable Software and Affected Versions: My Favorites versions n/a through 1.4.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS, where an attacker can inject malicio...

Malicious code in nuxtjs_dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis dcd288c0cffc74a3b962530a540a7cc62f2288445fd2f50c7aded40160d08871 The OpenSSF Package Analysis project identified 'nuxtjsdotenv' @ 1.4.1 npm as malicious. It is considered malicious because: - The package...

WordPress My Favorites plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by theviper17 Patchstack Alliance in WordPress Plugin My Favorites versions = 1.4.1...

CVE-2024-7099

netease-youdao/qanything version 1.4.1 contains a vulnerability where unsafe data obtained from user input is concatenated in SQL queries, leading to SQL injection. The affected functions include getknowledgebasename, fromstatustostatus, deletefiles, and getfilebystatus. An attacker can exploit...

CVE-2024-7099 SQL Injection in netease-youdao/qanything

netease-youdao/qanything version 1.4.1 contains a vulnerability where unsafe data obtained from user input is concatenated in SQL queries, leading to SQL injection. The affected functions include getknowledgebasename, fromstatustostatus, deletefiles, and getfilebystatus. An attacker can exploit...

CVE-2024-7099 SQL Injection in netease-youdao/qanything

netease-youdao/qanything version 1.4.1 contains a vulnerability where unsafe data obtained from user input is concatenated in SQL queries, leading to SQL injection. The affected functions include getknowledgebasename, fromstatustostatus, deletefiles, and getfilebystatus. An attacker can exploit...

CVE-2024-7099 SQL Injection in netease-youdao/qanything

netease-youdao/qanything version 1.4.1 contains a vulnerability where unsafe data obtained from user input is concatenated in SQL queries, leading to SQL injection. The affected functions include getknowledgebasename, fromstatustostatus, deletefiles, and getfilebystatus. An attacker can exploit...

CVE-2024-7099

The CVE-2024-7099 issue affects netease-youdao/qanything, vulnerable in version 1.4.1 where unsafe data from user input is concatenated into SQL queries. Functions such as get_knowledge_base_name, from_status_to_status, delete_files, and get_file_by_status are implicated, enabling an attacker to ...

NetEase QAnything SQL注入漏洞

NetEase QAnything is a local knowledgebase question and answer system from China's NetEase that is designed to support files or databases in any format, and can be installed and used offline. A SQL injection vulnerability exists in NetEase QAnything version 1.4.1, which originates from the abilit...

PT-2024-38074 · Netease Youdao · Qanything

Name of the Vulnerable Software and Affected Versions: netease-youdao/qanything version 1.4.1 Description: The issue concerns a SQL injection vulnerability where unsafe data obtained from user input is concatenated in SQL queries. This affects functions including get knowledge base name, from...

GHSA-PV7H-HG6M-82J8 Gouniverse GoLang CMS vulnerable to Cross-site Scripting

A vulnerability was found in Gouniverse GoLang CMS 1.4.0. It has been declared as problematic. This vulnerability affects the function PageRenderHtmlByAlias of the file FrontendHandler.go. The manipulation of the argument alias leads to cross site scripting. The attack can be initiated remotely...

CVE-2024-8572

A vulnerability was found in Gouniverse GoLang CMS 1.4.0. It has been declared as problematic. This vulnerability affects the function PageRenderHtmlByAlias of the file FrontendHandler.go. The manipulation of the argument alias leads to cross site scripting. The attack can be initiated remotely...

CVE-2024-8572 Gouniverse GoLang CMS FrontendHandler.go PageRenderHtmlByAlias cross site scripting

A vulnerability was found in Gouniverse GoLang CMS 1.4.0. It has been declared as problematic. This vulnerability affects the function PageRenderHtmlByAlias of the file FrontendHandler.go. The manipulation of the argument alias leads to cross site scripting. The attack can be initiated remotely...

PT-2024-39109 · Unknown · Gouniverse Golang Cms

Name of the Vulnerable Software and Affected Versions: Gouniverse GoLang CMS version 1.4.0 Description: A vulnerability was found in Gouniverse GoLang CMS, affecting the function PageRenderHtmlByAlias of the file FrontendHandler.go. The manipulation of the argument alias leads to cross-site...

CVE-2024-38793

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in PriceListo Best Restaurant Menu by PriceListo allows SQL Injection.This issue affects Best Restaurant Menu by PriceListo: from n/a through 1.4.1...

WordPress FotaWP theme <= 1.4.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Fariq Fadillah Gusti Insani Patchstack Alliance in WordPress Theme Fota WP versions = 1.4.1...