CVE-2023-6886

A vulnerability was found in xnx3 wangmarket 6.1. It has been rated as critical. Affected by this issue is some unknown functionality of the component Role Management Page. The manipulation leads to code injection. The attack may be launched remotely. The exploit has been disclosed to the public...

CVE-2023-6886

A vulnerability was found in xnx3 wangmarket 6.1. It has been rated as critical. Affected by this issue is some unknown functionality of the component Role Management Page. The manipulation leads to code injection. The attack may be launched remotely. The exploit has been disclosed to the public...

Code injection

A vulnerability was found in xnx3 wangmarket 6.1. It has been rated as critical. Affected by this issue is some unknown functionality of the component Role Management Page. The manipulation leads to code injection. The attack may be launched remotely. The exploit has been disclosed to the public...

CVE-2023-6886

CVE-2023-6886 affects xnx3 wangmarket 6.1, specifically the Role Management Page. The issue enables code injection via an unspecified function, with remote attack potential and public disclosure of exploits. Multiple sources corroborate the description and classify the vulnerability as critical, ...

wangmarket Security Breach

wangmarket is a privatized deployment of your own SAAS cloud building system for xnx3 individual developers in China. A security vulnerability exists in xnx3 wangmarket version 6.1, which stems from the component Role Management Page that can lead to code injection...

PT-2023-32797 · Unknown · Xnx3 Wangmarket

Name of the Vulnerable Software and Affected Versions: xnx3 wangmarket version 6.1 Description: A critical issue affects some unknown functionality of the component Role Management Page, leading to code injection. The attack can be launched remotely. Recommendations: For xnx3 wangmarket version...

Default Admin Role will be empty after ownership transfer .

Lines of code Vulnerability details Impact After an ownership transfer of the protocol , the DEFAULTADMINROLE role will be empty.Protocol cannot function properly without DEFAULTADMINROLE cause this is the single most important role in the protocol . Functionalities that only DEFAULTADMINROLE can...

PT-2023-24026 · Nxlog · Nxlog Manager

Name of the Vulnerable Software and Affected Versions: NXLog Manager version 5.6.5633 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows an attacker to eliminate roles within the platform by sending a specifically crafted query to the server. This is due to the...

CVE-2023-4712

A vulnerability, which was classified as critical, was found in Xintian Smart Table Integrated Management System 5.6.9. This affects an unknown part of the file /SysManage/AddUpdateRole.aspx. The manipulation of the argument txtRoleName leads to sql injection. The exploit has been disclosed to th...

CVE-2023-1874

The WP Data Access plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.3.7. This is due to a lack of authorization checks on the multiplerolesupdate function. This makes it possible for authenticated attackers, with minimal permissions such as a...

CVE-2023-1874

The WP Data Access plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.3.7. This is due to a lack of authorization checks on the multiplerolesupdate function. This makes it possible for authenticated attackers, with minimal permissions such as a...

CVE-2023-1874

The WP Data Access plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.3.7. This is due to a lack of authorization checks on the multiplerolesupdate function. This makes it possible for authenticated attackers, with minimal permissions such as a...

Privilege Escalation Vulnerability Patched Promptly in WP Data Access WordPress Plugin

On April 5, 2023 the Wordfence Threat Intelligence team initiated the responsible disclosure process for a vulnerability we discovered in WP Data Access, a WordPress plugin that is installed on over 10,000 sites. This flaw makes it possible for an authenticated attacker to grant themselves...

WordPress WP Data Access 5.3.7 Privilege Escalation

The Wordfence team responsibly disclosed an authenticated Privilege Escalation vulnerability in the WP Data Access plugin. On April 5, 2023 the Wordfence Threat Intelligence team initiated the responsible disclosure process for a vulnerability we discovered in WP Data Access, a WordPress plugin...

WordPress WP Data Access 5.3.7 Privilege Escalation Vulnerability

The Wordfence team responsibly disclosed an authenticated Privilege Escalation vulnerability in the WP Data Access plugin. On April 5, 2023 the Wordfence Threat Intelligence team initiated the responsible disclosure process for a vulnerability we discovered in WP Data Access, a WordPress plugin...

PT-2023-17302 · WordPress · Wp Data Access

Name of the Vulnerable Software and Affected Versions: WP Data Access plugin for WordPress versions up to, and including, 5.3.7 Description: The issue is related to a lack of authorization checks on the multiple roles update function, allowing authenticated attackers with minimal permissions to...

SQL Injection

ezsystems/ezpublish-kernel is vulnerable to Privilege Escalation. The vulnerability exists due to improper privilege management in the admin role, which allows attackers to bypass the admin policy and assign any role to any user...

SUSE CVE-2012-4413

OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles...

Stored XSS in Roles

Description Stored cross-site scripting vulnerabilities arise when user input is stored and later embedded into the application's responses in an unsafe way. An attacker can use the vulnerability to inject malicious JavaScript code into the application, which will execute within the browser of an...

Potential mismanaging of the access and roles

Lines of code Vulnerability details Impact In initiateMigration method we are setting migratedTo to an address of the potential migration contract Later on, if completeMigration is called, it basically checks if the provided oldContract is equal to migratedTo when we enter the migrateReward metho...