CVE-2023-49487

JFinalCMS v5.0.0 was discovered to contain a cross-site scripting XSS vulnerability in the navigation management department...

PT-2023-31239 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinalCMS version 5.0.0 Description: A cross-site scripting XSS issue was found in the model management department. This type of issue allows attackers to inject malicious scripts into content from otherwise trusted websites. Recommendations:...

CVE-2023-48825

Availability Booking Calendar 5.0 is vulnerable to Multiple HTML Injection issues via SMS API Key or Default Country Code...

Availability Booking Calendar Security Breach

PHPJabbers Availability Booking Calendar is a booking system. A security vulnerability exists in Availability Booking Calendar version 5.0, which stems from a lack of rate limiting in pjActionAJaxSend, which allows an attacker to exhaust system resources...

PT-2023-30969 · Unknown · Availability Booking Calendar

Name of the Vulnerable Software and Affected Versions: Availability Booking Calendar version 5.0 Description: The issue concerns Multiple HTML Injection problems. These issues can be exploited via the SMS API Key or the Default Country Code. Recommendations: For Availability Booking Calendar...

GHSA-R7W2-J96V-VW8M Cross-Site Request Forgery in JFinalCMS via /admin/slide/update

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/slide/update...

CVE-2023-49448

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via admin/nav/delete...

JFinalCMS Security Vulnerability

JFinalCMS is a content management system by heyewei individual developer. A security vulnerability exists in JFinalCMS v5.0.0, which originates from a cross-site request forgery vulnerability in the /admin/nav/delete component...

PT-2023-31230 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinalCMS version 5.0.0 Description: A Cross-Site Request Forgery CSRF issue was discovered in JFinalCMS. The vulnerability can be exploited via the "/admin/nav/save" API endpoint. Recommendations: For JFinalCMS version 5.0.0, as a temporary...

PT-2023-31189 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinalCMS version 5.0.0 Description: A Cross-Site Request Forgery CSRF issue was discovered in JFinalCMS. The vulnerability can be exploited via the "/admin/friend link/update" API endpoint. Recommendations: For JFinalCMS version 5.0.0, as a...

PT-2023-31187 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinalCMS version 5.0.0 Description: A Cross-Site Request Forgery CSRF issue was discovered in JFinalCMS. The issue is related to the /admin/slide/delete API endpoint. This allows for unauthorized actions to be performed on the application...

JFinalCMS Security Vulnerability

JFinalCMS is a content management system by heyewei individual developer. A security vulnerability exists in JFinalCMS v5.0.0, which originates from a cross-site request forgery vulnerability in the /admin/tag/delete component...

PT-2023-31191 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinalCMS version 5.0.0 Description: A Cross-Site Request Forgery CSRF issue was discovered in JFinalCMS. The vulnerability can be exploited via the /admin/tag/update API endpoint. Recommendations: For JFinalCMS version 5.0.0, consider...

RakRak Document Plus vulnerable to path traversal

Overview RakRak Document Plus provided by Sumitomo Electric Information Systems Co., Ltd. contains a path traversal vulnerability CWE-22. Asato Masamu of GMO Cybersecurity by Ierae, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early...

CVE-2023-47464

Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via the upload API function...

CVE-2023-47463

Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via a crafted script to the glnassys authentication function...

PHPJabbers Availability Booking Calendar Security Vulnerability

PHPJabbers Availability Booking Calendar is a booking system. A security vulnerability exists in PHPJabbers Availability Booking Calendar version 5.0, which stems from an insufficient input validation of Unique, resulting in a CSV injection vulnerability. An attacker can exploit the vulnerability...

NEC Corporation CLUSTERPRO Code Issue Vulnerability

NEC Corporation CLUSTERPRO is a HA clustering software from Nippon Electric NEC Corporation. A code issue vulnerability exists in NEC Corporation CLUSTERPRO X Ver5.1 and earlier versions that stems from the presence of a file upload vulnerability. An attacker can exploit the vulnerability to uplo...

PrestaShop Security Breach

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides multiple payment methods, SMS alerts, and product image zoom and other features. A security vulnerability exists in PrestaShop Product Catalog CSV, Excel, XML Export PRO 5.0.0 and...

Vulnerability fixed in VMware Cloud Director Appliance

VMware has discovered a vulnerability in Cloud Director Appliance. A workaround for this has been published. The vulnerability occurs only when Cloud Director Appliance has received an upgrade to 10.5.0 from a lower version. Newly installed systems running on 10.5.0, or systems running on older...