1490 matches found
CVE-2023-45115 Online Examination System v1.0 - Multiple Authenticated SQL Injections (SQLi)
Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'ch' parameter of the /update.php?q=addqns resource does not validate the characters received and they are sent unfiltered to the database...
CVE-2023-49270
Hotel Management v1.0 is vulnerable to multiple authenticated Reflected Cross-Site Scripting vulnerabilities. The 'checkindate' parameter of the reservation.php resource is copied into the HTML document as plain text between tags. Any input is echoed unmodified in the application's response...
PT-2023-31466
Name of the Vulnerable Software and Affected Versions Student Information System version 1.0 Description The issue concerns multiple Authenticated SQL Injection vulnerabilities. Specifically, the id parameter of the "marks.php" resource does not validate the characters received, and they are sent...
CVE-2023-50466
An authenticated command injection vulnerability in Weintek cMT2078X easyweb Web Version v2.1.3, OS v20220215 allows attackers to execute arbitrary code or access sensitive information via injecting a crafted payload into the HMI Name parameter...
CVE-2023-47576
CVE-2023-47576 affects Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0. The issue enables authenticated command injection through the devices’ web interface. Root cause details are not provided in the connected documents, so the exact component/flow causing the vulnerability isn’t specified here. The...
CVE-2023-48642
Archer Platform 6.x before 6.13 P2 6.13.0.2 contains an authenticated HTML content injection vulnerability. A remote authenticated malicious Archer user could potentially exploit this to store malicious HTML code in a trusted application data store. When victim users access the data store through...
Pressference Exporter <= 1.0.3 - Authenticated (Administrator+) SQL Injection
Description The Pressference Exporter plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated...
Cross site scripting
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Codeboxr CBX Map for Google Map & OpenStreetMap plugin = 1.1.11 versions...
CVE-2023-45627
An authenticated Denial-of-Service DoS vulnerability exists in the CLI service. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected access point...
CVE-2023-45626
An authenticated vulnerability has been identified allowing an attacker to effectively establish highly privileged persistent arbitrary code execution across boot cycles...
CVE-2023-45626
CVE-2023-45626 is described in the initial record as an authenticated vulnerability that allows highly privileged, persistent arbitrary code execution across boot cycles. Connected documents confirm the description but do not provide concrete technical details such as affected product/vendor/vers...
Aruba Networks ArubaOS and InstantOS Security Vulnerabilities
Aruba Networks ArubaOS and Aruba Networks InstantOS are both products of Aruba Networks, Inc. Aruba Networks InstantOS is an Arch Linux-based distribution. A security vulnerability exists in Aruba Networks ArubaOS and InstantOS, which stems from the discovery of an authenticated vulnerability tha...
PT-2023-29607 · Hewlett Packard +1 · Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series; +2
Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: An authenticated Denial-of-Service DoS issue exists in the CLI service, allowing successful exploitation to interrupt the normal operation of the affected access point. Recommendations:...
CVE-2023-47690 WordPress Additional Order Filters for WooCommerce Plugin <= 1.10 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Anton Bond Additional Order Filters for WooCommerce plugin = 1.10 versions...
BIT-PROCESSMAKER-2020-13526
SQL injection vulnerability exists in the handling of sort parameters in ProcessMaker 3.4.11. A specially crafted HTTP request can cause an SQL injection. The reportTablesAjax and clientSetupAjax pages are vulnerable to SQL injection in the sort parameter.An attacker can make an authenticated HTT...
PT-2023-29671 · Buddyboss · Buddyboss Buddypress Global Search Plugin
Name of the Vulnerable Software and Affected Versions: BuddyBoss BuddyPress Global Search plugin versions 1.2.1 and earlier Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin or higher privileges can inject...
CVE-2023-45608
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Nicola Modugno Smart Cookie Kit plugin = 2.3.1 versions...
DEBIAN-CVE-2023-38000
Auth. Stored contributor+ Cross-Site Scripting XSS vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1.3, from 6.0 through 6.0.5, from 5.9 through 5.9.7 and Gutenberg plugin = 16.8.0 versions...
GRANDING UTime Master Security Vulnerability
GRANDING UTime Master is a powerful web-based time and attendance management software from GRANDING. A security vulnerability exists in GRANDING UTime Master v9.0.7-Build: Apr 4,2023 that stems from a vulnerability that allows an authenticated attacker to access sensitive information via a crafte...
