Authorization

Wade Graphic Design FANTSY has a vulnerability of insufficient authorization check. An unauthenticated remote user can exploit this vulnerability by modifying URL parameters to gain administrator privileges to perform arbitrary system operation or disrupt service...

Wade Graphic Design FANTSY 安全漏洞

Wade Graphic Design FANTSY is a digital art application from Wade Graphic Design. A security vulnerability exists in Wade Graphic Design FANTSY version v2.1.8, which originates from an insufficient authorization checking vulnerability that allows a remote, unauthenticated user to gain administrat...

CVE-2023-28698

CVE-2023-28698 affects Wade Graphic Design FANTSY (variant referenced in CNNVD as v2.1.8). The root cause is an insufficient authorization check that allows an unauthenticated remote user to modify URL parameters to gain administrator privileges and perform arbitrary system operations or disrupt ...

Security Bulletin: IBM Maximo Asset Management is vulnerable to Use of Sensitive Information in the Query String (CVE-2023-32334)

Summary IBM Maximo Asset Management is vulnerable to Use of Sensitive Information in the Query String. Vulnerability Details CVEID:CVE-2023-32334 DESCRIPTION: IBM Maximo Asset Management stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized partie...

CVE-2023-2256

The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.7 does not sanitize and escape some URL parameters, leading to Reflected Cross-Site Scripting...

CVE-2023-2256

The CVE-2023-2256 entry covers the WordPress plugin Product Addons & Fields for WooCommerce (PPOM) prior to version 32.0.7. The connected documents confirm a Reflected Cross-Site Scripting vulnerability caused by insufficient sanitization/escaping of URL parameters in the admin panel, enabling ar...

CVE-2023-2256

The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.7 does not sanitize and escape some URL parameters, leading to Reflected Cross-Site Scripting...

CVE-2023-2256: Improper Neutralization of Input During Web Page Generation

The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.7 does not sanitize and escape some URL parameters, leading to Reflected Cross-Site Scripting...

CVE-2023-31460

A vulnerability in the Connect Mobility Router component of MiVoice Connect versions 9.6.2208.101 and earlier could allow an authenticated attacker with internal network access to conduct a command injection attack due to insufficient restriction on URL parameters...

Command injection

A vulnerability in the Connect Mobility Router component of MiVoice Connect versions 9.6.2208.101 and earlier could allow an authenticated attacker with internal network access to conduct a command injection attack due to insufficient restriction on URL parameters...

CVE-2023-31460

CVE-2023-31460 affects Mitel MiVoice Connect’s Connect Mobility Router component (versions ≤ 9.6.2208.101). The root cause is insufficient restriction of URL parameters, enabling an authenticated attacker with internal network access to perform a command injection. Affected products expose high i...

CVE-2023-31460: Improper Neutralization of Special Elements used in a Command

A vulnerability in the Connect Mobility Router component of MiVoice Connect versions 9.6.2208.101 and earlier could allow an authenticated attacker with internal network access to conduct a command injection attack due to insufficient restriction on URL parameters...

CVE-2023-31460

A vulnerability in the Connect Mobility Router component of MiVoice Connect versions 9.6.2208.101 and earlier could allow an authenticated attacker with internal network access to conduct a command injection attack due to insufficient restriction on URL parameters...

CVE-2023-31460

A vulnerability in the Connect Mobility Router component of MiVoice Connect versions 9.6.2208.101 and earlier could allow an authenticated attacker with internal network access to conduct a command injection attack due to insufficient restriction on URL parameters...

CVE-2023-32068

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 14.10.4 it's possible to exploit well known parameters in XWiki URLs to perform redirection to untrusted site. This vulnerability was partially fixed in the past for XWiki...

Product Addons & Fields for WooCommerce < 32.0.7 - Reflected Cross-Site Scripting

The plugin does not sanitize and escape some URL parameters, leading to Reflected Cross-Site Scripting. PoC Ensure WooCommerce is installed. Visit the following path, while logged in as an Admin: /wp-admin/admin.php?page=ppomid=5meta=edit&"=1...

WP Inventory Manager < 2.1.0.13 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. 1. Go to WP Inventory Inventory Items and create a new Inventory Item. 2. Create a page and add the wpinventory shortcode. 3. View the new page on the frontend,...

CVE-2022-47509

The SolarWinds Platform was susceptible to the Incorrect Input Neutralization Vulnerability. This vulnerability allows a remote adversary with a valid SolarWinds Platform account to append URL parameters to inject HTML...

CVE-2022-47509: Improper Neutralization of Input During Web Page Generation

The SolarWinds Platform was susceptible to the Incorrect Input Neutralization Vulnerability. This vulnerability allows a remote adversary with a valid SolarWinds Platform account to append URL parameters to inject HTML...

Download Manager Pro < 6.3.0 - Unauthenticated Sensitive Information Disclosure

The plugin leaks master key information without the need for a password, allowing attackers to download arbitrary password-protected package files. - Create a password protected package containing one or more files. - Navigate to the download page of the package e.g. /download/package1 - Inspect...