CVE-2023-7002: Improper Neutralization of Special Elements used in an OS Command

The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 1.3.9 via the 'url' parameter. This vulnerability allows authenticated attackers, with administrator-level permissions and above, to execute arbitrary commands on the host operati...

PT-2023-32835

Name of the Vulnerable Software and Affected Versions Backup Migration plugin for WordPress versions up to, and including, 1.3.9 Description The issue allows authenticated attackers with administrator-level permissions and above to execute arbitrary commands on the host operating system via the u...

XSS/CSRF Remote Code Execution in XWiki.ConfigurableClass

Impact There is a reflected XSS or also direct remote code execution vulnerability in the code for displaying configurable admin sections. The code that can be passed through a URL parameter is only executed when the user who is visiting the crafted URL has edit right on at least one configuratio...

Remote code execution

XWiki Platform is a generic wiki platform. Starting in 2.3 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, there is a reflected XSS or also direct remote code execution vulnerability in the code for displaying configurable admin sections. The code that can be passed through a URL parameter...

CVE-2023-48379

Softnext Mail SQR Expert is an email management platform, it has inadequate filtering for a specific URL parameter within a specific function. An unauthenticated remote attacker can perform Blind SSRF attack to discover internal network topology base on URL error response...

Server side request forgery (ssrf)

Softnext Mail SQR Expert is an email management platform, it has inadequate filtering for a specific URL parameter within a specific function. An unauthenticated remote attacker can perform Blind SSRF attack to discover internal network topology base on URL error response...

CVE-2023-48379 Softnext Mail SQR Expert - Blind Server-Side Request Forgey (SSRF)

Softnext Mail SQR Expert is an email management platform, it has inadequate filtering for a specific URL parameter within a specific function. An unauthenticated remote attacker can perform Blind SSRF attack to discover internal network topology base on URL error response...

PT-2023-8224

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 2.3 through 14.10.14 XWiki Platform versions 14.10.15 through 15.5.1 XWiki Platform versions 15.5.2 through 15.7-rc-1 Description The issue concerns a reflected XSS or direct remote code execution vulnerability in the...

PT-2023-30805 · Softnext · Softnext Mail Sqr Expert

Name of the Vulnerable Software and Affected Versions: Softnext Mail SQR Expert affected versions not specified Description: The issue is related to inadequate filtering for a specific URL parameter within a specific function in Softnext Mail SQR Expert, an email management platform. This allows ...

Burst Statistics (Free < 1.5.0, Pro < 1.5.1) - Unauthenticated SQL Injection

Description The plugins do not properly sanitise and escape the url parameter before using it in a SQL statement, leading to an SQL injection exploitable by any authenticated users, such as subscribers PoC curl 'https://example.com/burst-statistics-endpoint.php' \ -H 'content-type:...

CVE-2023-46974

Cross Site Scripting vulnerability in Best Courier Management System v.1.000 allows a remote attacker to execute arbitrary code via a crafted payload to the page parameter in the URL...

CVE-2023-5761

The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'url' parameter in versions 1.4.0 to 1.4.6.1 free and versions 1.4.0 to 1.5.0 pro due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2023-5761

The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'url' parameter in versions 1.4.0 to 1.4.6.1 free and versions 1.4.0 to 1.5.0 pro due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2023-46974

Cross Site Scripting vulnerability in Best Courier Management System v.1.000 allows a remote attacker to execute arbitrary code via a crafted payload to the page parameter in the URL...

CVE-2023-46974

The CVE concerns Best Courier Management System v1.000, where a Cross‑Site Scripting flaw in the page URL parameter allows remote code execution due to inadequate input filtering/escaping. Descriptions across CNVD/NVD/CVE references consistently identify the vulnerable component as the web input ...

CVE-2023-5761: Improper Neutralization of Special Elements used in an SQL Command

The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'url' parameter in versions 1.4.0 to 1.4.6.1 free and versions 1.4.0 to 1.5.0 pro due to insufficient escaping on the user supplied parameter and lack of sufficient...

PT-2023-32309 · WordPress · Burst Statistics – Privacy-Friendly Analytics

Name of the Vulnerable Software and Affected Versions: Burst Statistics – Privacy-Friendly Analytics for WordPress plugin for WordPress versions 1.4.0 to 1.4.6.1 free and versions 1.4.0 to 1.5.0 pro Description: The issue is related to SQL Injection via the url parameter due to insufficient...

TOTOLINK X6000R url Parameter Command Execution Vulnerability

TOTOLINK X6000R is a wireless router from China Gion Electronics that supports WiFi 6 technology with high concurrent connections and dual-band transmission. TOTOLINK X6000R suffers from a command execution vulnerability that stems from the url parameter of the sub4119A0 function failing to...

CVE-2023-49078 Cross-Site Scripting vulnerability in raptor-web 0.4.4

raptor-web is a CMS for game server communities that can be used to host information and keep track of players. In version 0.4.4 of raptor-web, it is possible to craft a malicious URL that will result in a reflected cross-site scripting vulnerability. A user controlled URL parameter is loaded int...

CVE-2023-49078 Cross-Site Scripting vulnerability in raptor-web 0.4.4

raptor-web is a CMS for game server communities that can be used to host information and keep track of players. In version 0.4.4 of raptor-web, it is possible to craft a malicious URL that will result in a reflected cross-site scripting vulnerability. A user controlled URL parameter is loaded int...