8152 matches found
CVE-2023-28773
CVE-2023-28773 affects WordPress’ Secondary Title plugin up to version 2.0.9.1, which is vulnerable to stored Cross-Site Scripting (XSS) when an authenticated Contributor interacts with the plugin. The issue is fixed in version 2.1.0. The Patchstack entry confirms vulnerable versions, the fixed r...
CVE-2023-28773 WordPress Secondary Title Plugin <= 2.0.9.1 is vulnerable to Cross Site Scripting (XSS)
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Kolja Nolte Secondary Title plugin = 2.0.9.1 versions...
WordPress plugin secondary-title cross-site scripting vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
PT-2023-26889 · Unknown · Dangerzone
Name of the Vulnerable Software and Affected Versions: Dangerzone versions prior to 0.4.2 Description: The issue affects the Dangerzone CLI, where output from the container is logged to the user's terminal. If the container is compromised, an attacker may spoof messages in the terminal or change...
PT-2023-21950
Name of the Vulnerable Software and Affected Versions Kolja Nolte Secondary Title plugin versions = 2.0.9.1 Description The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited by contributors or users with higher authentication levels. The...
CVE-2023-39342: Improper Neutralization of Escape, Meta, or Control Sequences
Dangerzone is software for converting potentially dangerous PDFs, office documents, or images to safe PDFs. The Dangerzone CLI dangerzone-cli command logs output from the container where the file sanitization takes place, to the user's terminal. Prior to version 0.4.2, if the container is...
CVE-2023-28773: Improper Neutralization of Input During Web Page Generation
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Kolja Nolte Secondary Title plugin = 2.0.9.1 versions...
Stored XSS in Page Title
Description At the latest version, the page title has been escaped and cannot trigger the XSS payload. However, by login to a user with other privileges, I see that It's still not escaped yet. Proof of Concept Step 1: Login as Admin, create a page in site1 with the title "test and see that the pa...
Omeka S Injection Vulnerability
Omeka S is an open source web content management system CMS from Omeka, Inc. that specializes in creating and managing digital exhibitions and online digital archives. It is a new version of the Omeka project, and unlike the traditional Omeka Classic, Omeka S emphasizes multi-user collaboration a...
Ozeki SMS Gateway 10.3.208 - Arbitrary File Read (Unauthenticated)
Exploit Title: Ozeki 10 SMS Gateway 10.3.208 - Arbitrary File Read Unauthenticated Date: 01.08.2023 Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: https://ozeki-sms-gateway.com Software Link: https://ozeki-sms-gateway.com/attachments/702/installwindows1689352737OzekiSMSGateway10.3.208.zip...
Uvdesk 1.1.3 Shell Upload
Exploit Title: Uvdesk v1.1.3 - File Upload Remote Code Execution RCE Authenticated Date: 28/07/2023 Exploit Author: Daniel Barros @cupc4k3d - Hakai Offensive Security Vendor Homepage: https://www.uvdesk.com Software Link: https://github.com/uvdesk/community-skeleton Version: 1.1.3 Example: python...
SQL injection in jeecg-boot
jeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData...
CVE-2023-38992
jeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData...
CVE-2023-38992
jeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData...
Sql injection
jeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData...
Jeecg-Boot SQL注入漏洞
Jeecg-Boot is a low-code platform based on a code generator from the JeecgBoot community. A security vulnerability exists in Jeecg-Boot version 3.5.1, which stems from a SQL injection vulnerability in the parameter title...
CVE-2023-38992: Improper Neutralization of Special Elements used in an SQL Command
jeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData...
PT-2023-26721 · Unknown · Jeecg-Boot
Name of the Vulnerable Software and Affected Versions: jeecg-boot version 3.5.1 Description: The issue is a SQL injection vulnerability. It occurs via the title parameter at the "/sys/dict/loadTreeData" API endpoint. Recommendations: For jeecg-boot version 3.5.1, consider restricting access to th...
