WordPress Restrict Plugin <= 2.2.4 is vulnerable to Cross Site Scripting (XSS)

Software Restrict Type Plugin Vulnerable versions = 2.2.4 Fixed in 2.2.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-41861 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID c9e5571465c1 Credits thiennv Required privile...

PT-2023-4995

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.0.1873 Description The issue is related to a heap-based buffer overflow in the vim regsub both function of the Vim text editor, which can be exploited to impact the confidentiality, integrity, and availability of...

PT-2023-26517 · Unknown · Vi Web Client

Name of the Vulnerable Software and Affected Versions: VI Web Client versions prior to 7.9.6 Description: The issue allows a remote unauthenticated attacker to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted URL. This can lead to users being redirected t...

PT-2023-29491 · Mestav · Mestav Software E-Commerce

Name of the Vulnerable Software and Affected Versions: Mestav Software E-commerce Software versions before 20230901 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2023-25549 · Audimexee · Audimexee

Name of the Vulnerable Software and Affected Versions: Audimexee version 14.1.7 Description: The issue is a SQL injection vulnerability that can be exploited via the p table name parameter. This allows an attacker to inject malicious SQL code, potentially leading to unauthorized access or...

PT-2023-27198 · Vcita · Vcita Online Booking & Scheduling Calendar

Name of the Vulnerable Software and Affected Versions: vCita.Com Online Booking & Scheduling Calendar for WordPress by vcita plugin versions = 4.3.2 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into...

PT-2023-27723 · Hzeller · Timg

Name of the Vulnerable Software and Affected Versions: hzeller timg versions 1.5.1 and earlier Description: The issue allows a remote attacker to cause a denial of service. It is related to a buffer overflow vulnerability. The vulnerability can be exploited via the address 0x61200000045c...

PT-2023-24630 · Unknown · Shopconstruct

Name of the Vulnerable Software and Affected Versions: ShopConstruct plugin versions 1.1.2 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability affects the ShopConstruct plugin...

PT-2023-28081 · Synology · Synology Router Manager

Name of the Vulnerable Software and Affected Versions: Synology Router Manager SRM versions prior to 1.3.1-9346-6 Description: The issue is related to a Path Traversal vulnerability in the cgi component, allowing remote attackers to read specific files via unspecified vectors. Recommendations: Fo...

PT-2023-28019 · Grupposcai · Grupposcai Realgimm

Name of the Vulnerable Software and Affected Versions: GruppoSCAI RealGimm version 1.1.37p38 Description: Multiple reflected cross-site scripting XSS vulnerabilities in the ErroreNonGestito.aspx component allow attackers to execute arbitrary Javascript in the context of a victim user's browser vi...

PT-2023-19869 · Premio · Premio Chaty Plugin

Name of the Vulnerable Software and Affected Versions: Premio Chaty plugin versions 3.0.9 and earlier Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing them to steal...

PT-2023-19563 · WordPress · Davidsword Mobile Call Now & Map Buttons

Name of the Vulnerable Software and Affected Versions: Davidsword Mobile Call Now & Map Buttons plugin versions 1.5.0 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability affects th...

PT-2023-27970 · Tenda · Tenda Ac7 +1

Name of the Vulnerable Software and Affected Versions: Tenda AC7 version V15.03.06.44 Tenda AC9 version V15.03.06.42 multi Description: A stack overflow issue was discovered, which occurs via the ssid parameter at the "/goform/fast setting wifi set" API endpoint. Recommendations: For Tenda AC7...

PT-2023-27980 · Tenda · Tenda Ac7 +2

Name of the Vulnerable Software and Affected Versions: Tenda AC7 version 1.0 V15.03.06.44 Tenda AC9 version 3.0 V15.03.06.42 multi Tenda AC5 version US AC5V1.0RTL V15.03.06.28 Description: A stack overflow issue was discovered via the time parameter at the "/goform/PowerSaveSet" API endpoint. Thi...

PT-2023-26714 · Qdrant · Qdrant

Name of the Vulnerable Software and Affected Versions: qdrant version 1.3.2 Description: A Buffer Overflow issue allows a remote attacker to cause a denial of service via the chucnked vectors.rs component. This issue affects qdrant, enabling an attacker to disrupt service. Recommendations: For...

PT-2023-27623 · Phpjabbers · Phpjabbers Document Creator

Name of the Vulnerable Software and Affected Versions: PHPJabbers Document Creator version 1.0 Description: The issue is related to user enumeration, which occurs during the password recovery process. A difference in messages could allow an attacker to determine if a user is valid or not, enablin...

PT-2023-9131 · Synology · Video Station

Name of the Vulnerable Software and Affected Versions: Video Station versions prior to 5.7.2 Description: An OS command injection issue has been reported, potentially allowing users to execute commands via a network. The vulnerability is related to the failure to neutralize special elements used ...

PT-2023-27617 · Phpjabbers · Phpjabbers Make An Offer Widget

Name of the Vulnerable Software and Affected Versions: PHPJabbers Make an Offer Widget version 1.0 Description: There is a Cross Site Scripting XSS issue in the action parameter of the "index.php" file. This allows for potential malicious script execution. Recommendations: For PHPJabbers Make an...

PT-2023-27616 · Phpjabbers · Phpjabbers Fundraising Script

Name of the Vulnerable Software and Affected Versions: PHPJabbers Fundraising Script version 1.0 Description: The issue is related to Cross Site Scripting XSS via the action parameter of "index.php". This allows for potential malicious script execution. The estimated number of potentially affecte...

PT-2023-5312 · Ansible · Ansible

Name of the Vulnerable Software and Affected Versions: ansible semaphore version 2.8.90 Description: The issue in ansible semaphore allows a remote attacker to execute arbitrary code via a crafted payload to the extra variables parameter. This is related to incorrect code generation management in...