PT-2023-23234 · Wpforms +1 · Wpforms +2

Name of the Vulnerable Software and Affected Versions: Database for Contact Form 7, WPforms, Elementor forms versions 1.3.0 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQ...

PT-2023-8572 · N Able · N-Able Passportal Extension

Name of the Vulnerable Software and Affected Versions: N-able PassPortal extension versions prior to 3.29.2 for Chrome Description: The issue is related to insufficient protection of registration data, which may allow an attacker to gain unauthorized access to protected information. The N-able...

PT-2023-28590 · Unknown · Bigbluebutton

Name of the Vulnerable Software and Affected Versions: BigBlueButton versions prior to 2.6.0-beta.1 Description: BigBlueButton is an open-source virtual classroom. It has a path traversal vulnerability that allows an attacker with a valid starting folder path to traverse and read other files...

PT-2023-7847 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.18 and earlier Description: The issue is related to a stored Cross-Site Scripting XSS vulnerability that could be exploited by a low-privileged attacker to inject malicious scripts into vulnerable form...

PT-2023-9858 · Almosteffortless · Almosteffortless Secure-Files Plugin

Name of the Vulnerable Software and Affected Versions: almosteffortless secure-files Plugin versions 1.1 and earlier Description: A critical issue was found in the almosteffortless secure-files Plugin for WordPress. The sf downloads function in the secure-files.php file is affected, where...

PT-2023-7967 · Majordomo · Majordomo

Name of the Vulnerable Software and Affected Versions: MajorDoMo version before 0662e5e Description: The issue is related to the thumb.php module in MajorDoMo, which allows command execution via shell metacharacters. This can be exploited by a remote attacker to execute arbitrary commands. The...

PT-2023-30050 · Cacti +2 · Cacti +2

Name of the Vulnerable Software and Affected Versions: Cacti version 1.2.25 Description: The issue allows a remote attacker to obtain sensitive information via the form actions function in the managers.php file. Recommendations: For Cacti version 1.2.25, consider disabling the form actions functi...

PT-2023-13505 · Mr2600 · Mr2600

Name of the Vulnerable Software and Affected Versions: MR2600 router versions 1.0.18 and earlier Description: A vulnerability has been identified that could allow an attacker within range of the wireless network to successfully brute force the WPS pin, potentially allowing them unauthorized acces...

PT-2023-32332 · Unknown · Phpgurukul Online Railway Catering System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Railway Catering System version 1.0 Description: A critical issue was found in the Login component of the PHPGurukul Online Railway Catering System. The manipulation of the username argument leads to SQL injection. This issu...

PT-2023-23624 · WordPress · Totalpress.Org Custom Post Types

Name of the Vulnerable Software and Affected Versions: TotalPress.Org Custom post types, Custom Fields & more plugin versions 4.0.12 and earlier Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin+ privileges...

PT-2023-32334 · Unknown · Codeastro Pos System

Name of the Vulnerable Software and Affected Versions: CodeAstro POS System version 1.0 Description: A critical issue affects some unknown functionality of the file /setting of the component Logo Handler, leading to unrestricted upload. The attack can be launched remotely. Recommendations: For...

PT-2023-28984 · Basercms · Basercms

Name of the Vulnerable Software and Affected Versions: baserCMS versions 4.6.0 through 4.7.6 Description: The issue is related to a Code Injection vulnerability in the mail form of baserCMS, a website development framework. This vulnerability allows malicious code to be executed in the Mail Form...

GHSA-JQ6C-R9XF-QXJM dtale vulnerable to Remote Code Execution through the Custom Filter Input

Impact Users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. Patches Users should upgrade to version 3.7.0 where the "Custom Filter" input is turned off by default. You can find out more information on how to turn it back ...

PT-2023-30011 · Totolink · Totolink X6000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X6000R version 9.4.0cu.652 B20230116 Description: A command execution issue was found in the sub 4155DC function, allowing for potential exploitation. Recommendations: For TOTOLINK X6000R version 9.4.0cu.652 B20230116, consider...

PT-2023-8914 · Grafana +1 · Grafana Worldmap Panel Plugin +1

Name of the Vulnerable Software and Affected Versions: Grafana WorldMap panel plugin versions prior to 1.0.4 Description: The issue is related to a DOM XSS vulnerability in the WorldMap panel plugin of the Grafana platform, which is caused by improper neutralization of input during webpage...

PT-2023-29880 · WordPress · Realmag777 Wolf – Wordpress Posts Bulk Editor/Manager Professional

Name of the Vulnerable Software and Affected Versions: realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin versions 1.0.7.1 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to...

PT-2023-29572 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: zzzCMS version 2.1.9 Description: The issue allows a remote attacker to execute arbitrary code via a crafted file to the down url function in the zzz.php file. This enables the attacker to potentially gain control over the system...

PT-2023-32940

Name of the Vulnerable Software and Affected Versions encoded id-rails versions before 1.0.0.beta2 Description The issue is an uncontrolled resource consumption vulnerability. A remote and unauthenticated attacker might cause a denial of service condition by sending an HTTP request with an...

PT-2023-29680 · Unknown · Wokamoto Simple Tweet

Name of the Vulnerable Software and Affected Versions: Wokamoto Simple Tweet plugin versions = 1.4.0.2 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability allows an attacker to inject maliciou...

PT-2023-29982 · Tenda · Tenda W18E

Name of the Vulnerable Software and Affected Versions: Tenda W18E version 16.01.0.81576 Description: The issue is related to a stack overflow vulnerability. It occurs via the portMirrorMirroredPorts parameter in the formSetNetCheckTools function. Recommendations: For Tenda W18E version...