CVE-2023-1498 code-projects Responsive Hotel Site Newsletter Log messages.php sql injection

A vulnerability classified as critical has been found in code-projects Responsive Hotel Site 1.0. Affected is an unknown function of the file messages.php of the component Newsletter Log Handler. The manipulation of the argument title leads to sql injection. It is possible to launch the attack...

CVE-2023-1498

The CVE-2023-1498 issue affects code-projects Responsive Hotel Site 1.0, specifically the Newsletter Log Handler’s file messages.php. The vulnerability arises from manipulation of the title argument, leading to SQL injection. It can be exploited remotely, and public exploits have been disclosed. ...

PT-2023-17034 · Unknown · Code-Projects Responsive Hotel Site

Name of the Vulnerable Software and Affected Versions: code-projects Responsive Hotel Site version 1.0 Description: A critical vulnerability has been found in the Newsletter Log Handler component of the code-projects Responsive Hotel Site. The issue is related to the manipulation of the title...

newsletter-anmeldung.com Cross Site Scripting vulnerability OBB-3219530

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Threat Source newsletter (March 9, 2023) — Stop freaking out about ChatGPT

Welcome to this weeks edition of the Threat Source newsletter. There is no shortage of hyperbolic headlines about ChatGPT out there, everything from how it and other AI tools like it are here to replace all our jobs, make college essays a thing of the past and change the face of cybersecurity as ...

CVE-2023-0543

The Arigato Autoresponder and Newsletter WordPress plugin before 2.1.7.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2023-0543

CVE-2023-0543 affects the WordPress plugin Arigato Autoresponder and Newsletter, prior to version 2.1.7.2. Root cause: insufficient sanitization/escaping of settings allowing Stored XSS by high-privilege admins, even when unfiltered_html is disallowed. Documented impact: Stored XSS with admin+ pr...

WordPress Plugin Arigato Autoresponder and Newsletter 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF in OptinlyHQ Optinly – Exit Intent, Newsletter Popups, Gamification & Opt-in Forms plugin = 1.0.15 versions...

WordPress Arigato Autoresponder and Newsletter Plugin <= 2.7.1 is vulnerable to Cross Site Scripting (XSS)

Software Arigato Autoresponder and Newsletter Type Plugin Vulnerable versions = 2.7.1 Fixed in 2.7.1.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-25031 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 587f7c05becf Credits...

Arigato Autoresponder and Newsletter < 2.7.1.1 - Unauthenticated Stored XSS

The plugin does not sanitise and escape some parameters, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks...

Threat Source newsletter (Feb. 2, 2023): I bid you all adieu

Welcome to this weeks edition of the Threat Source newsletter. If you havent noticed yet weve had a few guest writers on this newsletter over the last few months. Alas my time covering the newsletter has ended and I leave you with one final edition. Have no fear, William Largent will be rounding...

WordPress Arigato Autoresponder and Newsletter Plugin <= 2.7.1.1 is vulnerable to Cross Site Scripting (XSS)

Software Arigato Autoresponder and Newsletter Type Plugin Vulnerable versions = 2.7.1.1 Fixed in 2.7.1.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-25061 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID d6cfa2bc3409 Credit...

WordPress Arigato Autoresponder and Newsletter Plugin < 2.7.1.2 is vulnerable to Cross Site Scripting (XSS)

Software Arigato Autoresponder and Newsletter Type Plugin Vulnerable versions 2.7.1.2 Fixed in 2.7.1.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0543 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID e5225dad6b06 Credits...

Arigato Autoresponder and Newsletter < 2.1.7.2 - Admin+ Stored XSS

The plugin does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC 1. Go to the Mailing list option and register a new user with the value...

Arigato Autoresponder and Newsletter < 2.1.7.2 - Admin+ Stored XSS

The plugin does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. 1. Go to the Mailing list option and register a new user with the value "autofoc...

Improper Validation

Shopware is vulnerable to Improper Validation. The vulnerability exists because the library does not properly validate the double opt-in setting in the newsletter route, allowing an attacker to skip the complete double opt-in process...

GHSA-46H7-VJ7X-FXG2 Shopware has Improper Input Validation issue in newsletter subscription

Impact The newsletter double opt-in validation was not checked properly, and it was possible to skip the complete double opt in process. Patches The problem has been fixed with 6.4.18.1 Workarounds For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a...

Shopware has Improper Input Validation issue in newsletter subscription

Impact The newsletter double opt-in validation was not checked properly, and it was possible to skip the complete double opt in process. Patches The problem has been fixed with 6.4.18.1 Workarounds For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a...

Shopware vulnerable to Improper Input Validation of Clearance sale in cart

Impact It is possible to put the same line item multiple one in the cart using API, the Cart Validators checked the line item's individuality and the user was able to skip the clearance sale in cart Patches The problem has been fixed with 6.4.18.1 Workarounds For older versions of 6.1, 6.2, and...