zzzCMS Code Issues Vulnerabilities

ZZZCMS is a content management system CMS. A security vulnerability exists in zzzCMS version v.2.1.9, which originates from a vulnerability that allows remote attackers to execute arbitrary code via the downurl function in the zzzz.php file...

CVE-2023-44476

Cross-Site Request Forgery CSRF vulnerability in Andres Felipe Perea V. CopyRightPro plugin = 2.1 versions...

PT-2023-31786 · WordPress · Easy Registration Forms

Name of the Vulnerable Software and Affected Versions: Easy Registration Forms for WordPress versions up to, and including, 2.1.1 Description: The issue allows authenticated attackers with subscriber-level capabilities or above to retrieve arbitrary sensitive user meta via the erforms user meta...

WordPress Plugin Feeds for YouTube Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...

Apache Superset 安全漏洞

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. Apache Superset version 2.1.0 and prior versions have an authorization issue vulnerability that stems from incorrect authorization checks in SQLLab. An attacker can exploit the vulnerability to...

CVE-2023-34175

Unauth. Reflected Cross-Site Scripting XSS vulnerability in GrandSlambert Login Configurator plugin = 2.1 versions...

open-mpi hwloc 代码问题漏洞

open-mpi hwloc is an open source tool library for obtaining hardware topology information and resource allocation in multi-core computer systems. A security vulnerability exists in open-mpi hwloc version 2.1.0, which originated from allowing an attacker to cause a denial of service DoS via the...

CVE-2023-33373

Connected IO v2.1.0 and prior keeps passwords and credentials in clear-text format, allowing attackers to exfiltrate the credentials and use them to impersonate the devices...

CVE-2023-34369

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in GrandSlambert Login Configurator plugin = 2.1 versions...

WordPress plugin Login Configurator 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

Icewarp Icearp 跨站脚本漏洞

Icewarp Icearp is an email, messaging and collaboration service for small, medium and enterprise-level businesses from the Czech company Icewarp. A cross-site scripting vulnerability exists in Icewarp Icearp version 10.2.1, which stems from the presence of a cross-site scripting XSS vulnerability...

CVE-2023-37973

Cross-Site Request Forgery CSRF vulnerability in David Pokorny Replace Word plugin = 2.1 versions...

PT-2023-25731 · Bylancer · Bylancer Quickvcard

Name of the Vulnerable Software and Affected Versions: Bylancer QuickVCard version 2.1 Description: A critical issue affects the processing of the file /blog of the component GET Parameter Handler. The manipulation of the argument s leads to sql injection. The attack may be initiated remotely. Th...

Bylancer QuickVCard SQL注入漏洞

Bylancer QuickVCard is a Digital Business Card SaaS PHP script from Bylancer. A SQL injection vulnerability exists in Bylancer QuickVCard version 2.1, which stems from some unknown handling of the file /blog in the component GET Parameter Handler, which leads to an sql injection via the parameter...

CVE-2023-36375

Cross Site Scripting vulnerability in Hostel Management System v2.1 allows an attacker to execute arbitrary code via a crafted payload to the Guardian name, Guardian relation, complimentary address, city, permanent address, and city parameters in the Book Hostel & Room Details page...

CVE-2023-3045

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Tise Technology Parking Web Report allows SQL Injection. This issue affects Parking Web Report: before 2.1...

PT-2023-25744 · Unknown · Hospital Management System

Name of the Vulnerable Software and Affected Versions: Hostel Management System version 2.1 Description: The issue allows an attacker to execute arbitrary code via a crafted payload to the search booking field. This is a Cross-Site Scripting XSS issue. Recommendations: For Hostel Management Syste...

DuxCMS 路径遍历漏洞

DuxCMS is an open source content management system. A security vulnerability exists in DuxCMS version 2.1, which stems from a directory traversal vulnerability that allows an attacker to delete arbitrary files via /admin/AdminBackup/del...

CVE-2023-0588

The Catalyst Connect Zoho CRM Client Portal WordPress plugin before 2.1.0 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admin...

PT-2023-25339 · Virtualsquare · Picotcp

Name of the Vulnerable Software and Affected Versions: VirtualSquare picoTCP aka PicoTCP-NG versions 2.1 and earlier Description: The issue arises from the failure to check the transport layer length in a frame before performing port filtering. This can lead to potential security risks...