PT-2023-27636 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7.102 Description: The issue concerns a File Upload vulnerability. It is exploitable via the uploads/dede/module make.php endpoint. Recommendations: For DedeCMS version 5.7.102, consider restricting access to the...

PT-2023-31024 · Mintplex · Anything-Llm

Name of the Vulnerable Software and Affected Versions: mintplex-labs/anything-llm versions prior to 0.0.1 Description: The issue is related to SQL Injection in the GitHub repository mintplex-labs/anything-llm. Recommendations: For versions prior to 0.0.1, update to version 0.0.1 or later to resol...

PT-2023-27714 · Unknown · Schoolmate

Name of the Vulnerable Software and Affected Versions: Schoolmate version 1.3 Description: The issue concerns SQL Injection in the ValidateLogin.php file, specifically affecting the variable $username from the SESSION. Recommendations: For Schoolmate version 1.3, consider restricting access to th...

PT-2023-30859 · Ibos Oa · Ibos Oa

Name of the Vulnerable Software and Affected Versions: IBOS OA version 4.5.5 Description: A critical issue was found in IBOS OA, affecting an unknown part of the file ?r=dashboard/position/del. This issue leads to sql injection and can be initiated remotely. The exploit has been disclosed to the...

PT-2023-30853 · Sourcecodester · Sourcecodester Simple Membership System

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Membership System version 1.0 Description: A critical issue was found in the file club edit query.php, where the manipulation of the club id argument leads to SQL injection. This can be initiated remotely. The issue has...

PT-2023-27983 · Jeecg · Jeecg

Name of the Vulnerable Software and Affected Versions: Jeecg versions up to 3.5.3 Description: The issue is an arbitrary file read vulnerability. It can be exploited via the interface "/testConnection". Recommendations: For versions up to 3.5.3, as a temporary workaround, consider restricting...

PT-2023-27706 · Skyworth · Skyworth

Name of the Vulnerable Software and Affected Versions: Skyworth version 3.0 Description: The issue allows attackers to perform a directory traversal via mounting the Udisk to /mnt/. This is due to a problem in the directory /system/bin/blkid. Recommendations: For Skyworth version 3.0, consider...

PT-2023-27989 · Unknown · Dairy Farm Shop Management System Using Php/Mysql

Name of the Vulnerable Software and Affected Versions: Dairy Farm Shop Management System Using PHP and MySQL version 1.1 Description: The Dairy Farm Shop Management System Using PHP and MySQL contains multiple SQL injection vulnerabilities in the Login function. These vulnerabilities are exploite...

PT-2023-4877 · Jscape · Jscape Mft Server

Name of the Vulnerable Software and Affected Versions: JSCAPE MFT Server versions prior to 2023.1.9 Description: The issue is related to unsafe deserialization in the JSCAPE MFT Server, which allows an attacker to execute arbitrary Java code, including OS commands, via its management interface...

PT-2023-27243 · Solarwinds · Serv-U

Name of the Vulnerable Software and Affected Versions: Serv-U versions 15.4 through 15.4 Hotfix 1 Description: A vulnerability has been identified that allows an actor to bypass multi-factor/two-factor authentication if exploited. The actor must have administrator-level access to Serv-U to perfor...

PT-2023-26096 · Unknown · Crypto Currency Tracker

Name of the Vulnerable Software and Affected Versions: Crypto Currency Tracker CCT versions prior to 9.5 Description: The issue is related to incorrect access control in the User Registration page, allowing unauthenticated attackers to register as an Admin account via a crafted POST request...

PT-2023-8456 · FFmpeg · Ffmpeg

Name of the Vulnerable Software and Affected Versions: FFmpeg versions prior to 6.1 Description: The issue is related to an integer overflow vulnerability in the JPEG XL decoder of the FFmpeg multimedia library. This vulnerability can be exploited by a remote attacker to execute arbitrary code...

PT-2023-28176 · Jenkins · Jenkins Ivy Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Ivy Plugin versions 2.5 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to delete disabled modules. Recommendations: For Jenkins Ivy Plugin versions 2.5 and earlier, update to a version later...

PT-2023-21193

Name of the Vulnerable Software and Affected Versions Apache Superset versions up to and including 2.1.0 Description A non-admin authenticated user could incorrectly create resources using the import charts feature. Recommendations For Apache Superset versions up to and including 2.1.0, update to...

PT-2023-27507 · Unknown · Adenion Blog2Social

Name of the Vulnerable Software and Affected Versions: Adenion Blog2Social: Social Media Auto Post & Scheduler plugin versions = 7.2.0 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website,...

PT-2023-25549 · Audimexee · Audimexee

Name of the Vulnerable Software and Affected Versions: Audimexee version 14.1.7 Description: The issue is a SQL injection vulnerability that can be exploited via the p table name parameter. This allows an attacker to inject malicious SQL code, potentially leading to unauthorized access or...

PT-2023-27740 · Unknown · Adlered Bolo-Solo

Name of the Vulnerable Software and Affected Versions: adlered bolo-solo version 2.6 Description: The issue allows a remote attacker to execute arbitrary code via a crafted script to the authorization field in the header. This can be done by uploading a file with malicious content, potentially...

PT-2023-29491 · Mestav · Mestav Software E-Commerce

Name of the Vulnerable Software and Affected Versions: Mestav Software E-commerce Software versions before 20230901 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

WordPress Restrict Plugin <= 2.2.4 is vulnerable to Cross Site Scripting (XSS)

Software Restrict Type Plugin Vulnerable versions = 2.2.4 Fixed in 2.2.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-41861 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID c9e5571465c1 Credits thiennv Required privile...

PT-2023-26517 · Unknown · Vi Web Client

Name of the Vulnerable Software and Affected Versions: VI Web Client versions prior to 7.9.6 Description: The issue allows a remote unauthenticated attacker to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted URL. This can lead to users being redirected t...