CVE-2023-29236

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Cththemes Outdoor theme = 3.9.6 versions...

Cross site scripting

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Cththemes Outdoor theme = 3.9.6 versions...

CVE-2023-29236 WordPress Outdoor Theme <= 3.9.6 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Cththemes Outdoor theme = 3.9.6 versions...

CVE-2023-29236 WordPress Outdoor Theme <= 3.9.6 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Cththemes Outdoor theme = 3.9.6 versions...

CVE-2023-29236

CVE-2023-29236 is an unauthenticated reflected XSS in the Cththemes Outdoor WordPress theme, affected versions up to 3.9.6. Publicly documented details confirm the vulnerability and that a fix exists: update to version 3.9.7 or newer. Multiple sources (Wordfence, NVD, Red Hat advisory, Patchstack...

CVE-2023-29236: Improper Neutralization of Input During Web Page Generation

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Cththemes Outdoor theme = 3.9.6 versions...

Outdoor < 3.9.7 - Reflected XSS

The theme does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

WordPress Outdoor Theme <= 3.9.6 is vulnerable to Cross Site Scripting (XSS)

Software Outdoor Type Theme Vulnerable versions = 3.9.6 Fixed in 3.9.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-29236 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID badb7b865758 Credits RE-ALTER Required privilege...

CVE-2022-28495: Improper Neutralization of Special Elements used in an OS Command

TOTOLink outdoor CPE CP900 V6.3c.566B20171026 is discovered to contain a command injection vulnerability in the setWebWlanIdx function via the webWlanIdx parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-28495

The CVE-2022-28495 vulnerability affects TOTOLink outdoor CPE CP900, version 6.3c.566_B20171026, where the setWebWlanIdx function is exploitable via the webWlanIdx parameter to achieve command injection. This can allow an attacker to execute arbitrary commands, over a network attack vector with n...

CVE-2022-28496

TOTOLink outdoor CPE CP900 V6.3c.566B20171026 discovered to contain a command injection vulnerability in the setPasswordCfg function via the adminuser and adminpassparameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

Command injection

TOTOLink outdoor CPE CP900 V6.3c.566B20171026 discovered to contain a command injection vulnerability in the setPasswordCfg function via the adminuser and adminpassparameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-28491

TOTOLink outdoor CPE CP900 V6.3c.566B20171026 contains a command injection vulnerability in the NTPSyncWithHost function via the hostname parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-28494

TOTOLink outdoor CPE CP900 V6.3c.566B20171026 is discovered to contain a command injection vulnerability in the setUpgradeFW function via the filename parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-28494

TOTOLink outdoor CPE CP900 V6.3c.566B20171026 is discovered to contain a command injection vulnerability in the setUpgradeFW function via the filename parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

Command injection

TOTOLink outdoor CPE CP900 V6.3c.566B20171026 is discovered to contain a command injection vulnerability in the setUpgradeFW function via the filename parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

PT-2023-12946 · Totolink · Totolink Outdoor Cpe Cp900

Name of the Vulnerable Software and Affected Versions: TOTOLink outdoor CPE CP900 version 6.3c.566 B20171026 Description: A command injection issue exists in the setUpgradeFW function via the filename parameter, allowing attackers to execute arbitrary commands through a crafted request...

CVE-2022-28497: Improper Neutralization of Special Elements used in a Command

TOTOLink outdoor CPE CP900 V6.3c.566B20171026 is discovered to contain a command injection vulnerability in the mtdwritebootloader function via the filename parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-28491

The CVE-2022-28491 issue affects TOTOLink outdoor CPE CP900 (V6.3c.566_B20171026). It is a command injection vulnerability in the NTPSyncWithHost function via the host_name parameter, allowing an attacker to execute arbitrary commands through a crafted request. CVSS 3.1 base score is 9.8 (CRITICA...

CVE-2022-28496: Improper Neutralization of Special Elements used in a Command

TOTOLink outdoor CPE CP900 V6.3c.566B20171026 discovered to contain a command injection vulnerability in the setPasswordCfg function via the adminuser and adminpassparameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...