SofaWiki 3.9.2 Cross Site Scripting

Exploit Title: SofaWiki 3.9.2 - Stored XSS Authenticated Date: 10/17/2024 Exploit Author: Chokri Hammedi Vendor Homepage: https://www.sofawiki.com Software Link: https://www.sofawiki.com/site/files/snapshot.zip Version: 3.9.2 Tested on: Windows XP Summary: A stored XSS exists in SofaWiki's Open...

Wordpress XMLRPC Denial of Service

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Wordpress XMLRPC DoS', 'Description' = %q Wordpress XMLRPC parsing is vulnerable to a XML based denial of service. This vulnerability affects...

WordPress plugin Wpsoul Greenshift Query and Meta Addon SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A SQL injection vulnerability exists in...

WordPress Greenshift Query and Meta Addon Plugin < 3.9.2 is vulnerable to SQL Injection

Software Greenshift Query and Meta Addon Type Plugin Vulnerable versions 3.9.2 Fixed in 3.9.2 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-43942 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 13adc6d175b5 Credits Dave Jong Patchstack Required...

Security Bulletin: Information disclosure in persistent watchers handling

Summary Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching a persistent watcher addWatch command to a parent which the attacker has already access to. ZooKeeper server doesn't do ACL check...

PT-2024-28395 · Bas Ip · Bas-Ip Cr-02Bd

Name of the Vulnerable Software and Affected Versions: BAS-IP CR-02BD versions prior to firmware v3.9.2 Description: The issue allows authenticated attackers to read SIP account passwords via a crafted GET request. Recommendations: For BAS-IP CR-02BD versions prior to firmware v3.9.2, update to...

CVE-2024-30517

Missing Authorization vulnerability in Sliced Invoices.This issue affects Sliced Invoices: from n/a through 3.9.2...

CVE-2024-30517

CVE-2024-30517 is a Missing/Broken Authorization vulnerability in the WordPress plugin Sliced Invoices, affecting versions up to and including 3.9.2. The root cause is missing authorization checks that can enable unauthorized access to invoices or related data. Multiple connected sources corrobor...

CVE-2024-30517 WordPress Sliced Invoices plugin <= 3.9.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Sliced Invoices.This issue affects Sliced Invoices: from n/a through 3.9.2...

PT-2024-23444 · Unknown · Sliced Invoices

Name of the Vulnerable Software and Affected Versions: Sliced Invoices versions 3.9.2 and earlier Description: A Missing Authorization issue affects Sliced Invoices, allowing unauthorized access. The estimated number of potentially affected devices worldwide is not specified. There is no...

WordPress plugin Sliced Invoices Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

aiohttp < 3.9.2 Multiple Vulnerabilities - Linux

aiohttp is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:aio-libsproject:aiohttp";...

SofaWiki 3.9.2 - Remote Command Execution (RCE) (Authenticated)

Exploit Title: SofaWiki 3.9.2 - Remote Command Execution RCE Authenticated Discovered by: Ahmet Ümit BAYRAM Discovered Date: 18.04.2024 Vendor Homepage: https://www.sofawiki.com Software Link: https://www.sofawiki.com/site/files/snapshot.zip Tested Version: v3.9.2 latest Tested on: MacOS import...

0data (=1.0.0), 1.1.1-version (=1.0.0) +8620 more potentially affected by CVE-2024-21507 via mysql2 (>=0.11.8 <=3.9.2)

mysql2 NPM version =0.11.8, =0.0.27, =1.0.0, =0.0.4, =0.0.1, =0.0.2, =1.0.0, =0.0.1-alpha.5, =0.0.1-alpha.6 - @142vip/egg-grpc-client =0.0.1-alpha.4 and more Source cves: CVE-2024-21507 Source advisory: OSV:GHSA-MQR2-W7WJ-JJGR...

CVE-2023-6047

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Algoritim E-commerce Software allows Reflected XSS. This issue affects E-commerce Software: before 3.9.2...

CVE-2023-6047

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Algoritim E-commerce Software allows Reflected XSS.This issue affects E-commerce Software: before 3.9.2...

Algoritimk E-commerce Software 跨站脚本漏洞

Algoritimk E-commerce Software is an e-commerce platform software from Algoritimk. A cross-site scripting vulnerability exists in Algoritimk E-commerce Software versions prior to 3.9.2, which stems from improper neutralization of user input...

PT-2024-14862

Name of the Vulnerable Software and Affected Versions Algoritim E-commerce Software versions prior to 3.9.2 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This means an attacker can injec...

WordPress Sliced Invoices Plugin <= 3.9.2 is vulnerable to Broken Access Control

Software Sliced Invoices Type Plugin Vulnerable versions = 3.9.2 Fixed in 3.9.3 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-30517 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID f6c77e858dd8 Credits Lucio Sá Required privilege...

GHSA-R978-9M6M-6GM6 Apache ZooKeeper vulnerable to information disclosure in persistent watchers handling

Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching a persistent watcher addWatch command to a parent which the attacker has already access to. ZooKeeper server doesn't do ACL check when th...