PT-2023-18411 · Unknown · Openharmony

Name of the Vulnerable Software and Affected Versions: OpenHarmony versions prior to 3.1.5 Description: The kernel subsystem hmdfs has an arbitrary memory accessing issue, allowing network attackers to launch a remote attack and obtain kernel memory data of the target system. Recommendations: For...

PT-2023-15575 · Sipe S.R.L · Wi400

Name of the Vulnerable Software and Affected Versions: SIPE s.r.l WI400 versions 8 through 11 Description: A cross-site scripting XSS issue in the check login function allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the f parameter. This enables the...

PT-2023-14507 · Avalanche · Avalanche

Name of the Vulnerable Software and Affected Versions: Avalanche versions 6.3.x and below Description: An improper authentication issue exists, allowing an unauthenticated attacker to modify properties on a specific port. Recommendations: For Avalanche versions 6.3.x and below, update to a versio...

PT-2023-20045 · Totolink · Totolink A7100Ru

Name of the Vulnerable Software and Affected Versions: TOTOlink A7100RU version 7.4cu.2313 B20191024 Description: A command injection issue was discovered in the router, specifically via the ou parameter at the "/setting/delStaticDhcpRules" API endpoint. This allows for potential exploitation...

PT-2023-20868 · Unknown · Onekeyadmin

Name of the Vulnerable Software and Affected Versions: onekeyadmin version 1.3.9 Description: The issue is related to a stored cross-site scripting XSS vulnerability. This vulnerability can be exploited via the Title parameter under the Adding Categories module. Recommendations: For onekeyadmin...

PT-2023-19772 · Funadmin · Funadmin

Name of the Vulnerable Software and Affected Versions: Funadmin version 3.2.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/databases/database/list" API endpoint. Recommendations: For Funadmin version 3.2.0,...

PT-2023-16831 · Unknown · Answerdev/Answer

Name of the Vulnerable Software and Affected Versions: answerdev/answer versions prior to 1.0.6 Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs when an application stores user input without proper validation, allowing attackers to inject malicious scripts. Thi...

PT-2023-3361 · Tp Link · Tp-Link Tl-Wa7510N

Name of the Vulnerable Software and Affected Versions: TP-Link TL-WPA7510 EU version V2 190125 Description: The issue is related to a stack overflow via the operation parameter at the "/admin/locale" API endpoint. This can be exploited by a remote attacker to execute arbitrary commands. The...

PT-2023-2087 · Ecshop · Ecshop

Name of the Vulnerable Software and Affected Versions: ECshop versions up to 4.1.8 Description: A vulnerability was found in the New Product Handler component of ECshop, allowing for unrestricted file upload. This can be exploited remotely, potentially allowing an attacker to upload arbitrary...

PT-2023-19760 · Pmb · Pmb

Name of the Vulnerable Software and Affected Versions: PMB version 7.4.6 Description: A remote code execution RCE issue was discovered in PMB via the component /sauvegarde/restaure act.php. Recommendations: For PMB version 7.4.6, as a temporary workaround, consider restricting access to the...

PT-2023-15915 · Icplayer · Icplayer

Name of the Vulnerable Software and Affected Versions: icplayer versions up to 0.819 Description: A vulnerability was found in icplayer, affecting the function AddonText Selection create of the file addons/Text Selection/src/presenter.js. This issue leads to cross-site scripting and can be launch...

PT-2023-20493 · Dot-Lens · Dot-Lens

Name of the Vulnerable Software and Affected Versions: dot-lens versions all Description: The issue concerns Prototype Pollution via the set function in the index.js file. This affects all versions of the dot-lens package. There is no information provided about the estimated number of potentially...

PT-2023-16226 · WordPress · Scriptless Social Sharing

Name of the Vulnerable Software and Affected Versions: Scriptless Social Sharing WordPress plugin versions prior to 3.2.2 Description: The issue arises from the plugin's failure to validate and escape some of its block options before outputting them back in a page or post where the block is...

PT-2023-19757 · Pmb · Pmb

Name of the Vulnerable Software and Affected Versions: PMB version 7.4.6 Description: A reflected cross-site scripting XSS issue was found in PMB via the query parameter at "/admin/convert/export z3950 new.php". This allows for potential XSS attacks. Recommendations: For PMB version 7.4.6, consid...

PT-2023-15916 · Icplayer · Icplayer

Name of the Vulnerable Software and Affected Versions: icplayer versions up to 0.818 Description: A vulnerability was found in icplayer, affecting some unknown functionality of the file addons/Commons/src/tts-utils.js. The manipulation leads to cross site scripting. The attack may be launched...

PT-2023-9859 · WordPress · Subscribe To Comments Plugin

Name of the Vulnerable Software and Affected Versions: Subscribe to Comments Plugin versions up to 2.0.7 Description: A problematic vulnerability was found in the Subscribe to Comments Plugin, affecting an unknown part of the file subscribe-to-comments.php. The manipulation leads to cross site...

PT-2023-9206 · Frrouting +9 · Frrouting +9

Name of the Vulnerable Software and Affected Versions: FRRouting versions prior to 8.5 Description: The issue is related to the bgpd/bgp label.c file in FRRouting, which attempts to read beyond the end of the stream during labeled unicast parsing. This can be exploited by a remote attacker to cau...

PT-2023-12561 · Unknown · Library Automation System

Name of the Vulnerable Software and Affected Versions: Library Automation System versions prior to 19.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, which allows Stored XSS in the Library Automation System. This can lead to the execution of...

PT-2023-4572 · Mongodb · Mongodb Server +1

Name of the Vulnerable Software and Affected Versions: MongoDB Server versions 4.4 through 6.3 MongoDB Server versions 5.0.0 through 5.0.14 Description: The issue is related to incorrect client certificate validation when the MongoDB Server is configured to use TLS with specific configuration...

PT-2023-16763 · Unknown · Drag/Drop Multiple File Upload – Contact Form 7

Name of the Vulnerable Software and Affected Versions: Drag and Drop Multiple File Upload Contact Form 7 version 5.0.6.1 Description: A critical issue has been found, affecting an unknown function of the file admin-ajax.php. The manipulation of the upload name argument leads to relative path...