PT-2022-26286 · WordPress · Chained Quiz

Name of the Vulnerable Software and Affected Versions: Chained Quiz plugin for WordPress versions up to, and including, 1.3.2.3 Description: The issue arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts in pages via t...

PT-2022-26304 · WordPress · Chained Quiz

Name of the Vulnerable Software and Affected Versions: Chained Quiz plugin for WordPress versions up to, and including, 1.3.2.4 Description: The issue is related to Cross-Site Request Forgery due to missing nonce validation on the manage function. This allows unauthenticated attackers to delete...

PT-2022-27196 · Tenda · Tenda I21

Name of the Vulnerable Software and Affected Versions: Tenda i21 version 1.0.0.144656 Description: The issue is a stack overflow vulnerability. It can be exploited via the /goform/setSysPwd API endpoint. Recommendations: For Tenda i21 version 1.0.0.144656, as a temporary workaround, consider...

PT-2022-27583 · Tenda · Tenda Ac6V1.0

Name of the Vulnerable Software and Affected Versions: Tenda AC6V1.0 version 15.03.05.19 Description: The issue is related to a Buffer Overflow that can be triggered via the formSetMacFilterCfg. Recommendations: For Tenda AC6V1.0 version 15.03.05.19, consider restricting access to the...

PT-2022-27584 · Tenda · Tenda Ac6V1.0

Name of the Vulnerable Software and Affected Versions: Tenda AC6V1.0 version 15.03.05.19 Description: A buffer overflow issue was discovered via the deviceId parameter in the addWifiMacFilter function. This issue can be exploited, potentially leading to unintended consequences. Recommendations: F...

PT-2022-23805 · Sophos · Sophos Firewall

Name of the Vulnerable Software and Affected Versions: Sophos Firewall versions prior to 19.5 GA Description: A stored XSS vulnerability allows admin to super-admin privilege escalation in the Webadmin import group wizard. Recommendations: For Sophos Firewall versions prior to 19.5 GA, update to...

PT-2022-10836 · Ibm · Ibm Api Connect

Name of the Vulnerable Software and Affected Versions: IBM API Connect versions 10.0.0.0 through 10.0.5.0 IBM API Connect versions 10.0.1.0 through 10.0.1.7 IBM API Connect versions 2018.4.1.0 through 2018.4.1.19 Description: The issue is caused by improper validation of input by the HOST headers...

PT-2022-27172 · Unknown · Sanitization Management System

Name of the Vulnerable Software and Affected Versions: Sanitization Management System version 1.0 Description: The issue is related to SQL Injection. It can be exploited via the "/php-sms/admin/orders/assign team.php?id=" endpoint. The id variable is vulnerable to this type of attack...

PT-2022-27173 · Unknown · Sanitization Management System

Name of the Vulnerable Software and Affected Versions: Sanitization Management System version 1.0 Description: The issue concerns a SQL Injection vulnerability. It can be exploited via the "/php-sms/admin/quotes/manage remark.php?id=" endpoint. The estimated number of potentially affected devices...

PT-2022-27123

Name of the Vulnerable Software and Affected Versions Simple Inventory Management System version 1.0 Description The issue concerns SQL Injection via the /ims/login.php endpoint. This allows for potential unauthorized access to database information. Recommendations For Simple Inventory Management...

PT-2022-27087 · Russound · Russound Xsourceplayer 777D

Name of the Vulnerable Software and Affected Versions: Russound XSourcePlayer 777D version 06.08.03 Description: The issue is related to a remote code execution vulnerability via the scriptRunner.cgi component. Recommendations: For Russound XSourcePlayer 777D version 06.08.03, consider disabling...

PT-2022-24627 · WordPress · Wp-Affiliate-Platform

Name of the Vulnerable Software and Affected Versions: WP Affiliate Platform plugin for WordPress versions up to, and including, 6.3.9 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated attackers...

Access Restriction Bypass

kubeview is vulnerable to access restriction bypass. The vulnerability exists in default function of api.js, because api/scrape/kube-system does not require authentication which allows an attacker to bypass the restrictions and retrieve certificate files that can be used to authenticate as...

PT-2022-19861 · WordPress · Salat Times

Name of the Vulnerable Software and Affected Versions: Salat Times WordPress plugin versions prior to 3.2.2 Description: The issue allows high-privilege users, such as admins, to perform Cross-Site Scripting attacks. This is possible because the plugin does not properly sanitize and escape its...

PT-2022-27211 · Unknown · Purchase Order Management System

Name of the Vulnerable Software and Affected Versions: Purchase Order Management System version 1.0 Description: The issue concerns a file upload vulnerability. It can be exploited via the /purchase order/admin/?page=system info API endpoint. Recommendations: For Purchase Order Management System...

PT-2022-27212 · Unknown · Online Tours & Travels Management System

Name of the Vulnerable Software and Affected Versions: Online Tours & Travels Management System version 1.0 Description: The issue concerns an arbitrary file upload vulnerability. This vulnerability can be exploited via the /tour/admin/file.php API endpoint. Recommendations: For Online Tours &...

PT-2022-27386 · Wbce Cms · Wbce Cms

Name of the Vulnerable Software and Affected Versions: WBCE CMS version 1.5.4 Description: A cross-site scripting XSS issue in the /admin/pages/sections save.php file allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name Section field. This can lea...

PT-2022-27431 · Unknown · Jeecg-Boot

Name of the Vulnerable Software and Affected Versions: Jeecg-boot version 3.4.3 Description: A SQL injection issue was found in Jeecg-boot via the component /sys/dict/queryTableData. This allows for potential SQL injection attacks. Recommendations: For Jeecg-boot version 3.4.3, as a temporary...

PT-2022-26042 · Frappe · Frappe

Name of the Vulnerable Software and Affected Versions: Frappe version 14.10.0 Description: The issue allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not correctly validate the information injected by the user in the import file...

PT-2022-27121 · Jizhicms · Jizhicms

Name of the Vulnerable Software and Affected Versions: Jizhicms version 2.3.3 Description: A SQL injection issue was found in the /Member/memberedit.html component. This allows for potential exploitation via SQL injection attacks. Recommendations: For Jizhicms version 2.3.3, consider restricting...