SendPress Newsletters <= 1.23.11.6 - Reflected XSS

Description The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

PrestaShop Security Breach

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides multiple payment methods, SMS alerts and product image scaling. A security vulnerability exists in PrestaShop Orders CSV, Excel Export PRO before v5.0, which originates from an SQL...

CVE-2023-48204

An issue in PublicCMS v.4.0.202302.e allows a remote attacker to obtain sensitive information via the appToken and Parameters parameter of the api/method/getHtml component...

Shortcodes Finder < 1.5.4 - Reflected XSS

Description The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

Products, Order & Customers Export for WooCommerce <= 2.0.10 - Reflected XSS

Description The plugin does not sanitise and escape various parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

PT-2023-30729 · Publiccms · Publiccms

Name of the Vulnerable Software and Affected Versions: PublicCMS version 4.0.202302.e Description: The issue allows a remote attacker to obtain sensitive information via the appToken and Parameters parameter of the "api/method/getHtml" component. Recommendations: For PublicCMS version 4.0.202302....

kernel: xfrm: NULL pointer dereference in xfrm_update_ae_params()

A flaw was found in the Linux kernel’s IP framework for transforming packets XFRM subsystem. This issue may allow a malicious user with CAPNETADMIN privileges to directly dereference a NULL pointer in xfrmupdateaeparams, leading to a possible kernel crash and denial of service...

Qi Addons For Elementor < 1.6.5 - Contributor+ Stored XSS

Description The plugin does not validate and escape some parameters, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

Inventory Management System Security Vulnerability

Inventory Management System is an inventory management system by the individual developers of stemword. A security vulnerability in Inventory Management System version 1.0 exists that allows local attackers to execute arbitrary code via the name, uname, and email parameters in the Registration.ph...

User Avatar < 1.4.12 - Reflected XSS

Description The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2023-46020

Cross Site Scripting XSS in updateprofile.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code via the 'rename', 'remail', 'rphone' and 'rcity' parameters...

Cross site scripting

Cross Site Scripting XSS in updateprofile.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code via the 'rename', 'remail', 'rphone' and 'rcity' parameters...

Tenda AX1806 schedStartTime parameter buffer overflow vulnerability

The Tenda AX1806 is a WiFi6 wireless router from Tenda, a Chinese company. A buffer overflow vulnerability exists in Tenda AX1806 version V1.0.0.1, which originates from obtaining src and v12 directly from the http request parameters schedStartTime and schedEndTime without checking their sizes. A...

Code-Projects Blood Bank Cross-Site Scripting Vulnerability

Code-Projects Blood Bank is a blood bank system from the Code-Projects project. A security vulnerability exists in Code-Projects Blood Bank version 1.0, which stems from a stored cross-site scripting XSS vulnerability in the rename and other parameters of the file updateprofile.php...

CVE-2023-47037 Apache Airflow missing fix for CVE-2023-40611 in 2.7.1 (DAG run broken access)

We failed to apply CVE-2023-40611 in 2.7.1 and this vulnerability was marked as fixed then. Apache Airflow, versions before 2.7.3, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have the...

Exploit for SQL Injection in Code-Projects Blood_Bank

CVE-2023-46014-Code-Projects-Blood-Bank-1.0-SQL-Injection-Vuln...

Apollo13 Framework Extensions < 1.9.1 - Contributor+ Stored XSS

Description The plugin does not validate and escape some parameters, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

Huawei EulerOS: Security Advisory for shim (EulerOS-SA-2023-3197)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for openssl (EulerOS-SA-2023-3190)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for compat-openssl10 (EulerOS-SA-2023-3117)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...