GHSA-38F9-4VHQ-9CR8 Zen Cart vulnerable to authenticated remote code execution

Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element within the modules edit page and inserting a command...

CVE-2022-1816

A vulnerability, which was classified as problematic, has been found in Zoo Management System 1.0. Affected by this issue is /zoo/admin/publichtml/viewaccounts?type=zookeeper of the content module. The manipulation of the argument adminname with the input alert1 leads to an authenticated cross si...

CVE-2022-29424 WordPress Image Hover Effects Ultimate plugin <= 9.7.1 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

Authenticated admin or higher user role Reflected Cross-Site Scripting XSS vulnerability in Biplob Adhikari's Image Hover Effects Ultimate plugin = 9.7.1 at WordPress...

PT-2022-19623 · WordPress · Opal Hotel Room Booking

Name of the Vulnerable Software and Affected Versions: Opal Hotel Room Booking plugin versions prior to 1.2.8 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with contributor or higher user role can inject malicious...

CVE-2022-23672

A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager versions: 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability...

CVE-2022-23673

A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager versions: 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability...

CVE-2022-29449

Authenticated contributor or higher user role Stored Cross-Site Scripting XSS vulnerability in Opal Hotel Room Booking plugin = 1.2.7 at WordPress...

CVE-2022-23667

A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager versions: 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability...

CVE-2022-23666

A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager versions: 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability...

CVE-2022-23661

A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager versions: 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability...

CVE-2021-42651

A Server Side Template Injection SSTI vulnerability in Pentest-Collaboration-Framework v1.0.8 allows an authenticated remote attacker to execute arbitrary code through /project/PROJECTNAME/reports/...

PT-2022-19172 · F5 · Big-Ip Afm

Name of the Vulnerable Software and Affected Versions: F5 BIG-IP AFM versions prior to 16.1.2.2 F5 BIG-IP AFM versions prior to 15.1.5.1 F5 BIG-IP AFM versions prior to 14.1.4.6 F5 BIG-IP AFM versions prior to 13.1.5 Description: An authenticated attacker with high privileges can upload a...

CVE-2022-29942

Talend Administration Center has a vulnerability that allows an authenticated user to use the Service Registry 'Add' functionality to perform SSRF HTTP GET requests on URLs in the internal network. The issue is fixed for versions 8.0.x in TPS-5189, versions 7.3.x in TPS-5175, and versions 7.2.x i...

Sql injection

Authenticated SQL Injection SQLi vulnerability in Mufeng's Hermit ????? plugin = 3.1.6 on WordPress allows attackers with Subscriber or higher user roles to execute SQLi attack via &ids...

CVE-2022-29419 WordPress 3xSocializer plugin <= 0.98.22 - Authenticated SQL Injection (SQLi) vulnerability

SQL Injection SQLi vulnerability in Don Crowther's 3xSocializer plugin = 0.98.22 at WordPress possible for users with a low role like a subscriber or higher...

CVE-2022-29418 WordPress Night Mode plugin <= 1.0.0 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability

Authenticated admin user role Persistent Cross-Site Scripting XSS in Mark Daniels Night Mode plugin = 1.0.0 on WordPress via vulnerable parameters: &ntmodepagesettingenable-me, &ntmodepagesettingbg-color, &ntmodepagesettingtxt-color, &ntmodepagesettinganccolor...

CVE-2022-27908

Zoho ManageEngine OpManager before 125588 and before 125603 is vulnerable to authenticated SQL Injection in the Inventory Reports module...

CVE-2022-28364

Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability XSS in the /goform/rlmswitchrprocess file parameter via GET. Authentication is required...

CVE-2021-36826

Authenticated subscriber or higher user role if allowed to access projects Stored Cross-Site Scripting XSS vulnerability in weDevs WP Project Manager plugin = 2.4.13 versions...

CVE-2022-25618 WordPress wpDataTables plugin <= 2.1.27 - Stored Cross-Site Scripting (XSS) vulnerability

Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability in wpDataTables WordPress plugin versions = 2.1.27...