CVE-2022-36532

Bolt CMS contains a vulnerability in version 5.1.12 and below that allows an authenticated user with the ROLEEDITOR privileges to upload and rename a malicious file to achieve remote code execution...

Threat Source newsletter (Sept. 15, 2022) — Teachers have to be IT admins now, too

By Jon Munshaw. Welcome to this week’s edition of the Threat Source newsletter. Public schools in the United States already rely on our teachers for so much — they have to be educators, occasional parental figures, nurses, safety officers, law enforcement and much more. Slowly, they’re having to...

CVE-2022-40626

An unauthenticated user can create a link with reflected Javascript code inside the backurl parameter and send it to other authenticated users in order to create a fake account with predefined login, password and role in Zabbix Frontend...

CVE-2022-38135

Broken Access Control vulnerability in Dean Oakley's Photospace Gallery plugin = 2.3.5 at WordPress allows users with subscriber or higher role to change plugin settings...

PT-2022-24229 · Dean Oakley · Photospace Gallery

Name of the Vulnerable Software and Affected Versions: Dean Oakley's Photospace Gallery plugin versions 2.3.5 and earlier Description: The issue allows users with a subscriber or higher role to change plugin settings due to a Broken Access Control vulnerability. This vulnerability affects the...

CVE-2022-37403

Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability in Nikhil Vaghela's Add User Role plugin = 0.0.1 at WordPress...

CVE-2022-37403

CVE-2022-37403 affects the WordPress Add User Role plugin (versions

CVE-2022-37403 WordPress Add User Role plugin <= 0.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability in Nikhil Vaghela's Add User Role plugin = 0.0.1 at WordPress...

CVE-2022-38286

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/role/list...

CVE-2022-38286

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/role/list...

Sql injection

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/role/list...

CVE-2022-38286

CVE-2022-38286 affects JFinal CMS 5.1.0 and is exploitable via the /system/role/list endpoint, enabling SQL injection. The provided sources consistently reference this endpoint vulnerability but do not publish a confirmed fixed version in the documents. CVSSv3.1 base score is 7.2 (High) with impa...

WordPress plugin Add User Role 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

JFinal SQL注入漏洞

JFinal is a Java-based WEB + ORM open source framework. JFinal CMS version 5.1.0 has a security vulnerability , the vulnerability stems from /system/role/list SQL injection vulnerability...

CVE-2022-31247 Rancher: Downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB)

An Improper Authorization vulnerability in SUSE Rancher, allows any user who has permissions to create/edit cluster role template bindings or project role template bindings such as cluster-owner, manage cluster members, project-owner and manage project members to gain owner permission in another...

Rancher Labs Rancher 安全漏洞

Rancher Labs Rancher is an open source enterprise container management platform from Rancher Labs, Inc. in the United States. A security vulnerability exists in Rancher for SUSE prior to version 2.6.7 and Rancher Labs Rancher prior to version 2.5.16, which stems from an improper authorization...

PT-2022-4713

Name of the Vulnerable Software and Affected Versions SUSE Rancher versions prior to 2.6.7 SUSE Rancher versions prior to 2.5.16 Description The issue is related to an Improper Authorization vulnerability in SUSE Rancher. It allows any user with permissions to create or edit cluster role template...

CVE-2022-2597

The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.19.0 does not have proper authorisation checks in some of its REST endpoints, allowing users with a role as low as contributor to call them and inject arbitrary CSS in arbitrary saved layouts...

CVE-2022-2597

The WordPress plugin Visual Portfolio, Photo Gallery & Post Grid (version before 2.19.0) has missing authorization checks on some REST endpoints. This allows users with a low-privilege role (as low as contributor) to call these endpoints and inject arbitrary CSS into saved layouts. Affected: Visu...

PT-2022-17620 · WordPress · The Visual Portfolio

Name of the Vulnerable Software and Affected Versions: The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin versions prior to 2.19.0 Description: The issue is related to improper authorization checks in some REST endpoints of the plugin, allowing users with a role as low as contributo...