CVE-2023-1977

The Booking Manager WordPress plugin before 2.0.29 does not validate URLs input in it's admin panel or in shortcodes for showing events from a remote .ics file, allowing an attacker with privileges as low as Subscriber to perform SSRF attacks on the sites internal network...

CVE-2023-1977

The Booking Manager WordPress plugin before 2.0.29 does not validate URLs input in it's admin panel or in shortcodes for showing events from a remote .ics file, allowing an attacker with privileges as low as Subscriber to perform SSRF attacks on the sites internal network...

Server side request forgery (ssrf)

The Booking Manager WordPress plugin before 2.0.29 does not validate URLs input in it's admin panel or in shortcodes for showing events from a remote .ics file, allowing an attacker with privileges as low as Subscriber to perform SSRF attacks on the sites internal network...

CVE-2023-2122

The CVE-2023-2122 entry concerns the Image Optimizer by 10web WordPress plugin (versions up to 1.0.26). It is vulnerable to a reflected XSS via the iowd_tabs_active parameter, which is sanitized/escaped insufficiently before rendering in the plugin admin panel. Impact is that an attacker could lu...

PT-2023-17385 · WordPress · Booking Manager

Name of the Vulnerable Software and Affected Versions: The Booking Manager WordPress plugin versions prior to 2.0.29 Description: The issue concerns a lack of validation for URLs input in the admin panel or in shortcodes for showing events from a remote .ics file. This allows an attacker with...

Phishing with hacked sites

Phishers want their fake pages to cost minimum effort but generate as much income as possible, so they eagerly use various tools and techniques to evade detection, and save time and money. Examples include automation with phishing kits or Telegram bots. Another tactic, popular with scammers big a...

panel-deco.jp Cross Site Scripting vulnerability OBB-3576897

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-39805

iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the where parameter at admincp.php...

CVE-2023-39965

1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, authenticated attackers can download arbitrary files through the API interface. This code has unauthorized access. Attackers can freely download the file content on the target system. This may caus...

CVE-2023-39966 1Panel arbitrary file write vulnerability exists in the background

1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, an arbitrary file write vulnerability could lead to direct control of the server. In the api/v1/file.go file, there is a function called SaveContentthat,It recieves JSON data sent by users in the...

CVE-2023-39965 1Panel Unauthorized access in Backend

1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, authenticated attackers can download arbitrary files through the API interface. This code has unauthorized access. Attackers can freely download the file content on the target system. This may caus...

CVE-2023-39964 1Panel O&M management panel has a background arbitrary file reading vulnerability

1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, arbitrary file reads allow an attacker to read arbitrary important configuration files on the server. In the api/v1/file.go file, there is a function called LoadFromFile, which directly reads the...

CVE-2023-39964

Summary: CVE-2023-39964 affects 1Panel O&M panel. In version 1.4.3, the function LoadFromFile in api/v1/file.go reads a server file directly from the unfiltered path parameter, enabling arbitrary file reads of important configuration files. The issue is a background file read vulnerability exploi...

1Panel Security Vulnerability

1Panel is an open source Linux server O&M panel for the Chinese 1panel community. A security vulnerability exists in 1Panel version 1.4.3. An attacker can exploit the vulnerability to download arbitrary files through the API interface...

PT-2023-27177 · 1Panel · 1Panel

Name of the Vulnerable Software and Affected Versions: 1Panel versions 1.4.3 Description: 1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, authenticated attackers can download arbitrary files through the API interface, specifically the "POST...

1Panel Security Vulnerability

1Panel is an open source Linux server operations and management panel for the Chinese 1panel community. A security vulnerability exists in 1Panel version 1.4.3, which stems from a lack of parameter filtering...

DigaSell Digital Store PHP Script 1.0.0 SQL Injection

==================================================================================================================================== | Title : DigaSell - Digital store PHP Script V1.0.0 Blind Sql Injection Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser :...

PT-2023-27176 · 1Panel · 1Panel

Name of the Vulnerable Software and Affected Versions: 1Panel version 1.4.3 Description: 1Panel is an open source Linux server operation and maintenance management panel. In the api/v1/file.go file, there is a function called LoadFromFile, which directly reads the file by obtaining the requested...

DMIS:CRI LMS 2.0 SQL Injection

==================================================================================================================================== | Title : DMIS:CRI LMS V2.0 SQL Injection Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 67.0.164-bit | ...

CVE-2023-37855

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges is able to gain limited read-access to the device-filesystem within the embedded Qt browser...