CVE-2022-1577 Database Backup for WordPress < 2.5.2 - Arbitrary Schedule Settings Update via CSRF

The Database Backup for WordPress plugin before 2.5.2 does not have CSRF check in place when updating the schedule backup settings, which could allow an attacker to make a logged in admin change them via a CSRF attack. This could lead to cases where attackers can send backup notification emails t...

Magento 2 Community Edition Cross-site Scripting Vulnerability

A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can result in unintended deletion of the store design schedule...

Database Backup for WordPress < 2.5.2 - Arbitrary Schedule Settings Update via CSRF

The plugin does not have CSRF check in place when updating the schedule backup settings, which could allow an attacker to make a logged in admin change them via a CSRF attack. This could lead to cases where attackers can send backup notification emails to themselves, which contain more details. O...

Database Backup for WordPress < 2.5.2 - Arbitrary Schedule Settings Update via CSRF

The plugin does not have CSRF check in place when updating the schedule backup settings, which could allow an attacker to make a logged in admin change them via a CSRF attack. This could lead to cases where attackers can send backup notification emails to themselves, which contain more details. O...

CVE-2022-28018

Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\scheduleedit.php...

CVE-2022-28013

Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\scheduleemployeeedit.php...

CVE-2022-28013

Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\scheduleemployeeedit.php...

CVE-2022-28011

Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\scheduledelete.php...

CVE-2022-28011

Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\scheduledelete.php...

CVE-2022-28011

Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\scheduledelete.php...

CVE-2022-28018

Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\scheduleedit.php...

CVE-2022-28013

Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\scheduleemployeeedit.php...

Sql injection

Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\scheduleemployeeedit.php...

Sql injection

Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\scheduleedit.php...

Attendance and Payroll System SQL注入漏洞

Attendance and Payroll System is a PHP/MySQLi source code attendance and payroll system by oretnom23 individual developers. version v1.0 of Attendance and Payroll System is vulnerable to SQL injection, which originates from the component adminschedule edit.php lacks validation of external input S...

Attendance and Payroll System SQL注入漏洞

Attendance and Payroll System is a PHP/MySQLi source code attendance and payroll system by oretnom23 individual developers. version v1.0 of Attendance and Payroll System is vulnerable to SQL injection, which originates from the component adminschedule delete.php lacks validation of external input...

Attendance and Payroll System SQL注入漏洞

Attendance and Payroll System is a PHP/MySQLi source code attendance and payroll system from oretnom23 individual developers. v1.0 of Attendance and Payroll System is vulnerable to SQL injection, which originates from the component adminschedule employeeedit.php lacks validation of external input...

Linear vesting logic is incorrect for subsequent withdrawals

Lines of code Vulnerability details Impact After attempting a withdrawal, StakedCitadelVester.sol vest is called, creating a 21 day vesting schedule for the user to claim their withdrawed amount. This logic works perfectly for the first withdrawal, but will be incorrect for every subsequent...

Existing user’s locked JPEG could be overwritten by new user, causing permanent loss of JPEG funds

Lines of code Vulnerability details Details & Impact A user’s JPEG lock schedule can be overwritten by another user’s if he the other user submits and finalizes a proposal to change the same NFT index’s value. The existing user will be unable to withdraw his locked JPEGs, resulting in permanent...

CVE-2022-0364

The Modern Events Calendar Lite WordPress plugin before 6.4.0 does not sanitize and escape some of the Hourly Schedule parameters which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks...