CVE-2021-24346

The Stock in & out WordPress plugin through 1.0.4 has a search functionality, the lowest accessible level to it being contributor. The srch POST parameter is not validated, sanitised or escaped before using it in the echo statement, leading to a reflected XSS issue...

CVE-2021-34619

The WooCommerce Stock Manager WordPress plugin is vulnerable to Cross-Site Request Forgery leading to Arbitrary File Upload in versions up to, and including, 2.5.7 due to missing nonce and file validation in the /woocommerce-stock-manager/trunk/admin/views/import-export.php file...

Woocommerce Stock Manager < 2.6.0 - CSRF to Arbitrary File Upload

The plugin is vulnerable to CSRF leading to Arbitrary File Upload due to missing nonce and file validation in the /admin/views/import-export.php file. File will upload to: /wp-content/plugins/woocommerce-stock-manager/admin/views/upload/PoC.php history.pushState'', '', '/' function submitRequest...

Woocommerce Stock Manager < 2.6.0 - CSRF to Arbitrary File Upload

The plugin is vulnerable to CSRF leading to Arbitrary File Upload due to missing nonce and file validation in the /admin/views/import-export.php file. PoC File will upload to: /wp-content/plugins/woocommerce-stock-manager/admin/views/upload/PoC.php...

WordPress WooCommerce Stock Manager plugin <= 2.5.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to Arbitrary File Upload

Cross-Site Request Forgery CSRF vulnerability leading to Arbitrary File Upload discovered by Chloe Chamberland WordFence in WordPress WooCommerce Stock Manager plugin versions = 2.5.7. Solution Update the WordPress WooCommerce Stock Manager plugin to the latest available version at least 2.6.0...

CVE-2021-24346: Improper Neutralization of Input During Web Page Generation

The Stock in & out WordPress plugin through 1.0.4 has a search functionality, the lowest accessible level to it being contributor. The srch POST parameter is not validated, sanitised or escaped before using it in the echo statement, leading to a reflected XSS issue...

PT-2021-15882

Name of the Vulnerable Software and Affected Versions Stock in & out WordPress plugin versions 1.0.0 through 1.0.4 Description The issue concerns a reflected XSS problem due to the lack of validation, sanitization, or escaping of the srch POST parameter in the search functionality. This...

Stock in & out WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in Stock in & out WordPress that stems from not...

Command Execution Vulnerability in TOTOLINK T10 Router (CNVD-2021-43461)

TOTOLINK is a brand held by Gion Electronics Shenzhen Co., Ltd, founded in 1999, is a Hong Kong-listed high-tech foreign-funded enterprises stock code: HK.8287, one of the world's leading network equipment suppliers. A command execution vulnerability exists in the TOTOLINK T10 router, which can b...

Stock in & out <= 1.0.4 - Authenticated SQL Injection

The plugin lacks proper sanitization before passing variables to an SQL request, making it vulnerable to SQL Injection attacks. Users with a role of contributor or higher can exploit this vulnerability...

CVE-2021-32543

The CTS Web transaction system related to authentication management is implemented incorrectly. After login, remote attackers can manipulate cookies to access other accounts and trade in the stock market with spoofed identity...

Authentication flaw

The CTS Web transaction system related to authentication management is implemented incorrectly. After login, remote attackers can manipulate cookies to access other accounts and trade in the stock market with spoofed identity...

CVE-2021-32543 SysJust CTS Web - Broken Authentication

The CTS Web transaction system related to authentication management is implemented incorrectly. After login, remote attackers can manipulate cookies to access other accounts and trade in the stock market with spoofed identity...

CVE-2021-32543

The CVE-2021-32543 issue affects the CTS Web transaction system (authentication management) from Cascade Information Technology, Taiwan. The root cause is an incorrect authentication implementation that allows a post-login attacker to manipulate cookies, access other accounts, and trade in the st...

CVE-2021-32543

The CTS Web transaction system related to authentication management is implemented incorrectly. After login, remote attackers can manipulate cookies to access other accounts and trade in the stock market with spoofed identity...

嘉实资讯 CTS Web transaction system 授权问题漏洞

CTS Web transaction system is a CTS Web transaction system from Cascade Information Technology, Taiwan. An authorization issue vulnerability exists in the CTS Web transaction system, which stems from an incorrect implementation of authentication-related functionality in the transaction system. A...

Stock in & out <= 1.0.4 - Reflected Cross-Site Scripting (XSS)

The plugin has a search functionality, the lowest accessible level to it being contributor. The srch POST parameter is not validated, sanitised or escaped before using it in the echo statement, leading to a reflected XSS issue PoC POST /wp-admin/admin.php?page=stockin HTTP/1.1 Content-Length: 66...

WordPress Stock in & out plugin <= 1.0.4 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Shreya Pohekar Codevigilant Project in WordPress Stock in & out plugin versions = 1.0.4. Solution This plugin has been closed as of April 29, 2021 and is not available for download. This closure is temporary, pending a full review...

Stock in & out <= 1.0.4 - Reflected Cross-Site Scripting (XSS)

The plugin has a search functionality, the lowest accessible level to it being contributor. The srch POST parameter is not validated, sanitised or escaped before using it in the echo statement, leading to a reflected XSS issue POST /wp-admin/admin.php?page=stockin HTTP/1.1 Content-Length: 66...

Rust Buffer Overflow Vulnerability (CNVD-2021-28295)

Rust is a systems programming language characterized by fast operation, the ability to prevent segmentation errors, and thread-safety. A buffer overflow vulnerability exists in the standard stock in versions of Rust prior to 1.50.0. The vulnerability stems from readtoend not validating the return...