CVE-2023-23831

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Rating-Widget Rating-Widget: Star Review System plugin = 3.1.9 versions...

Barebones CMS v2.0.2 - Stored Cross-Site Scripting (Authenticated) Vulnerability

Exploit Title: Barebones CMS v2.0.2 - Stored Cross-Site Scripting XSS Authenticated Exploit Author: tmrswrr Vendor Homepage: https://barebonescms.com/ Software Link: https://github.com/cubiclesoft/barebones-cms/archive/master.zip Version: v2.0.2 Tested : https://demo.barebonescms.com/ ---...

PT-2023-18695 · Aruba · Aruba Instant +1

Name of the Vulnerable Software and Affected Versions: Aruba InstantOS affected versions not specified ArubaOS 10 affected versions not specified Description: Multiple authenticated command injection vulnerabilities exist in the command line interface of the affected software. Successful...

Aruba Networks InstantOS 命令注入漏洞

Aruba Networks InstantOS is an Arch Linux-based distribution from Aruba Networks, Inc. A security vulnerability exists in Aruba Networks InstantOS and ArubaOS 10, which stems from an authenticated command injection vulnerability in the command line interface that can be exploited by an attacker t...

Aruba Networks InstantOS 命令注入漏洞

Aruba Networks InstantOS is an Arch Linux-based distribution from Aruba Networks, Inc. A security vulnerability exists in Aruba Networks InstantOS and ArubaOS 10, which stems from an authenticated command injection vulnerability in the command line interface that can be exploited by an attacker t...

PT-2023-18698 · Aruba · Aruba Instant +1

Name of the Vulnerable Software and Affected Versions: Aruba InstantOS affected versions not specified ArubaOS 10 affected versions not specified Description: Multiple authenticated command injection vulnerabilities exist in the command line interface of the affected software. Successful...

CVE-2023-23827

Auth. contributor+ Cross-Site Scripting XSS vulnerability in Google Maps v3 Shortcode plugin = 1.2.1 versions...

PT-2023-19229 · Unknown · Twardes Sitemap Index Plugin

Name of the Vulnerable Software and Affected Versions: Twardes Sitemap Index plugin versions prior to 1.2.3 Description: The issue is related to an Authenticated admin+ Cross-Site Scripting XSS vulnerability. This means that an attacker who has admin access can inject malicious scripts into the...

PT-2023-14648 · Silkalns · Activello Theme

Name of the Vulnerable Software and Affected Versions: Silkalns Activello theme versions = 1.4.4 Description: The issue is related to an Authenticated Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker could potentially inject malicious scripts into the website, which...

CVE-2023-23815

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Alan Jackson Multi-column Tag Map plugin = 17.0.24 versions...

CVE-2023-26529

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in DupeOff.Com DupeOff plugin = 1.6 versions...

Command injection

The web configuration service of the affected device contains an authenticated command injection vulnerability. It can be used to execute system commands on the operating system OS from the device in the context of the user "root." If the attacker has credentials for the web service, then the...

PT-2023-18650 · WordPress · Wpsoul Greenshift

Name of the Vulnerable Software and Affected Versions: Wpsoul Greenshift – animation and page builder blocks plugin versions = 4.9.9 Description: The issue is related to an Authenticated Cross-Site Scripting XSS vulnerability. This means that an attacker who has authentication credentials for the...

PT-2023-18659 · Unknown · Oopspam Anti-Spam Plugin

Name of the Vulnerable Software and Affected Versions: OOPSpam Anti-Spam plugin versions 1.1.35 and earlier Description: The issue is related to an Authenticated admin+ Cross-Site Scripting vulnerability. There is no information provided about the estimated number of potentially affected devices...

CVE-2023-28659

The Waiting: One-click Countdowns WordPress Plugin, version = 0.6.2, is affected by an authenticated SQL injection vulnerability in the pbcdownmetaid parameter of the pbcsavedowns action...

Sql injection

The WP Popup Banners WordPress Plugin, version = 1.2.5, is affected by an authenticated SQL injection vulnerability in the 'value' parameter in the getpopupdata action...

CVE-2023-28659

The Waiting: One-click Countdowns WordPress Plugin, version = 0.6.2, is affected by an authenticated SQL injection vulnerability in the pbcdownmetaid parameter of the pbcsavedowns action...

CVE-2023-28661

The WP Popup Banners WordPress Plugin, version = 1.2.5, is affected by an authenticated SQL injection vulnerability in the 'value' parameter in the getpopupdata action...

CVE-2022-41785

Auth. contributor+ Stored Cross-Site Scripting vulnerability in Galleryape Gallery Images Ape plugin = 2.2.8 versions...

PT-2023-19156 · Unknown · Esstat17 Page Loading Effects

Name of the Vulnerable Software and Affected Versions: Esstat17 Page Loading Effects plugin versions prior to 2.0.0 Description: The issue is related to an Authenticated admin+ Cross-Site Scripting XSS vulnerability. This means that an attacker with administrative access could potentially inject...