EventPrime < 3.1.6 - Reflected XSS

Description The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

MGASA-2023-0291 Updated ruby-RedCloth packages fix a security vulnerability

A Regular Expression Denial of Service ReDoS issue was discovered in the sanitizehtml function of redcloth gem v4.0.0. This vulnerability allows attackers to cause a Denial of Service DoS via supplying a crafted payload. CVE-2023-31606...

CVE-2022-4290

The CVE-2022-4290 entry concerns the WordPress plugin Cyr to Lat. It is affected up to version 3.5; the root cause is insufficient escaping and lack of proper SQL query preparation in ctl_sanitize_title, enabling authenticated users to append malicious SQL and potentially read sensitive data. A p...

WordPress Plugin Cyr to Lat SQL Injection Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

WP Customer Reviews < 3.6.7 - Admin+ Stored XSS

Description The plugin does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-45727

Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthenticated attacker to conduct XML External Entity XXE attacks. By processing a specially crafted request containing...

Proself Code Issue Vulnerability

Proself is an application from Proself, Inc. A security vulnerability exists in some Proself products. An attacker could exploit the vulnerability to perform an XML External Entity XXE attack, which could read arbitrary files containing account information on the server. The following products an...

PT-2023-29659 · Proself · Proself Mail Sanitize Edition +2

Name of the Vulnerable Software and Affected Versions: Proself Enterprise/Standard Edition versions 5.62 and earlier Proself Gateway Edition versions 1.65 and earlier Proself Mail Sanitize Edition versions 1.08 and earlier Description: The issue allows a remote unauthenticated attacker to conduct...

Siemens SICAM A8000 Devices Improper Limitation of a Pathname to a Restricted Directory (CVE-2023-42796)

A vulnerability has been identified in CP-8031 MASTER MODULE All versions CPCI85 V05.11, CP-8050 MASTER MODULE All versions CPCI85 V05.11. The web server of affected devices fails to properly sanitize user input for the /sicweb-ajax/tmproot/ endpoint. This could allow an authenticated remote...

CVE-2023-43799

Altair is a GraphQL Client. Prior to version 5.2.5, the Altair GraphQL Client Desktop Application does not sanitize external URLs before passing them to the underlying system. Moreover, Altair GraphQL Client also does not isolate the context of the renderer process. This affects versions of the...

Font Awesome Integration <= 5.0 - Contributor+ Stored Cross-Site Scripting

Description The plugin does not sufficiently sanitize and escape user-supplied attributes in the 'fawesome' shortcode, which can lead to the injection of arbitrary web scripts on pages accessed by users...

93digital Typing Effect < 1.3.7 - Contributor+ Stored XSS

Description The plugin does not properly sanitize user input, leading to a potential Cross-Site Scripting XSS vulnerability...

Cross site scripting

The DoLogin Security WordPress plugin before 3.7 does not properly sanitize IP addresses coming from the X-Forwarded-For header, which can be used by attackers to conduct Stored XSS attacks via WordPress' login form...

Command injection

systeminformation is a System Information Library for Node.JS. Versions 5.0.0 through 5.21.6 have a SSID Command Injection Vulnerability. The problem was fixed with a parameter check in version 5.21.7. As a workaround, check or sanitize parameter strings that are passed to wifiConnections,...

systeminformation SSID Command Injection Vulnerability

Impact SSID Command Injection Vulnerability Patches Problem was fixed with a parameter check. Please upgrade to version = 5.21.7, Version 4 was not affected Workarounds If you cannot upgrade, be sure to check or sanitize parameter strings that are passed to wifiConnections, wifiNetworks string on...

Exploit for Classic Buffer Overflow in Jerryscript

CVE-2023-36109 a poc for cve-2023-36109 request repo g...

GHSA-6F9P-G466-F8V8 blamer vulnerable to Arbitrary Argument Injection via the blameByFile() API

Versions of the blamer package before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile API. The library does not sanitize for user input or validate the given file path conforms to a specific schema, nor does it properly pass command-line flags to the git binary using the...

Improper input validation leads to arbitrary file deletion

Description The /process endpoint of the python API in collector/api.py exposes an endpoint waiting for a POST request with a parameter named filename : py @api.route"/process", methods="POST" def processfile: content = request.json targetfilename = content.get"filename" printf"Processing...

CVE-2023-39150

ConEmu before commit 230724 does not sanitize title responses correctly for control characters, potentially leading to arbitrary code execution. This is related to an incomplete fix for CVE-2022-46387...

WordPress ReviewX Plugin < 1.6.9 SQLi Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wpdeveloper:reviewx"; ifdescription...