PT-2025-38046

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.2.0-rc1+ 4 Description A flaw was discovered in the Linux kernel's NTFS3 implementation within the ni create attr list function. The function previously used WARN ON for error handling, which only printed a sta...

Cross-site Request Forgery (CSRF)

github.com/usememos/memos is vulnerable to cross site request forgery. The vulnerability exists in the NewServer function in server.go, which allows an attacker to manipulate the actions of authenticated users by tricking them into clicking on a malicious link or visiting a malicious website whil...

CVE-2022-4153: Undefined Security Weakness

The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the upload POST parameter before concatenating it to an SQL query in get-data-create-upload-v10.php. This may allow malicious users with at least author privilege to leak...

CVE-2022-45892

In Planet eStream before 6.72.10.07, multiple Stored Cross-Site Scripting XSS vulnerabilities exist: Disclaimer, Search Function, Comments, Batch editing tool, Content Creation, Related Media, Create new user, and Change Username...

CVE-2022-45892: Improper Neutralization of Input During Web Page Generation

In Planet eStream before 6.72.10.07, multiple Stored Cross-Site Scripting XSS vulnerabilities exist: Disclaimer, Search Function, Comments, Batch editing tool, Content Creation, Related Media, Create new user, and Change Username...

OpenImageIO Project OpenImageIO IFFOutput wild write vulnerability

Talos Vulnerability Report TALOS-2022-1656 OpenImageIO Project OpenImageIO IFFOutput wild write vulnerability December 22, 2022 CVE Number CVE-2022-43601,CVE-2022-43600,CVE-2022-43599,CVE-2022-43602 SUMMARY Multiple code execution vulnerabilities exist in the IFFOutput::close functionality of...

PT-2025-38434

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The panfrost gem create with handle function previously returned a buffer object BO with only a reference from the handle. User space could potentially guess and release this handle,...

CVE-2022-4597

A vulnerability, which was classified as problematic, was found in Shoplazza LifeStyle 1.1. Affected is an unknown function of the file /admin/api/admin/v2products of the component Create Product Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely...

CVE-2022-4597

A vulnerability, which was classified as problematic, was found in Shoplazza LifeStyle 1.1. Affected is an unknown function of the file /admin/api/admin/v2products of the component Create Product Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely...

CVE-2022-4597 Shoplazza LifeStyle Create Product v2_products cross site scripting

A vulnerability, which was classified as problematic, was found in Shoplazza LifeStyle 1.1. Affected is an unknown function of the file /admin/api/admin/v2products of the component Create Product Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely...

CVE-2022-4597: Improper Neutralization

A vulnerability, which was classified as problematic, was found in Shoplazza LifeStyle 1.1. Affected is an unknown function of the file /admin/api/admin/v2products of the component Create Product Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely...

CVE-2022-20537

In createDialog of WifiScanModeActivity.java, there is a possible way for a Guest user to enable location-sensitive settings due to a missing permission check. This could lead to local escalation of privilege from the Guest user with no additional execution privileges needed. User interaction is...

GHSA-GQGQ-784Q-V9XP FeehiCMS Cross Site Scripting vulnerability

Cross Site Scripting XSS vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the title field of the create article page...

CVE-2022-40001

Cross Site Scripting XSS vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the title field of the create article page...

CVE-2022-40001

Cross Site Scripting XSS vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the title field of the create article page...

Shoplazza 1.1 Cross Site Scripting

Exploit Title: Shoplazza 1.1 - Stored Cross Site Scripting Exploit Author: Andrey Stoykov Software Link: https://github.com/Shoplazza/LifeStyle Version: 1.1 Tested on: Ubuntu 20.04 Stored XSS 1: To reproduce do the following: 1. Login as normal user account 2. Browse "Blog Posts" - "Manage Blogs"...

YOP Poll Plugin XSS

The vulnerability of the “Create poll” module in the YOP Poll plugin of the WordPress content management system is related to the lack of protection for website structure when processing parameters such as “Vote Button Label”, “Show Results Link”, and “Display Back to vote Link”. Exploiting this...

TYPO3 security vulnerabilities

TYPO3 is a free and open source content management system framework CMS/CMF from the Swiss TYPO3 Association. A security vulnerability exists in TYPO3 fpnewsletter, which stems from the fact that data about its subscribers can be obtained via the createAction operation...

PT-2022-28058 · Typo3 · Fp Newsletter

Name of the Vulnerable Software and Affected Versions: fp newsletter extension versions 1.0 through 1.1.0 fp newsletter extension version 1.2.0 fp newsletter extension versions 2.0 through 2.1.1 fp newsletter extension versions 2.2.1 through 2.4.0 fp newsletter extension versions 3.0 through 3.2....

PT-2022-5896

Name of the Vulnerable Software and Affected Versions xrdp versions prior to 0.9.21 Description The issue is related to a buffer overflow in the xrdp login wnd create function of the xrdp server, which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol RDP. This...