812 matches found
PT-2023-30124 · WordPress · Flowfact Wp Connector
Name of the Vulnerable Software and Affected Versions: FLOWFACT WP Connector plugin versions = 2.1.7 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing them to steal...
Sql injection
Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the auth/auth.php resource does not validate the characters received and they are sent unfiltered to the database...
Ivanti Avalanche security breach
Ivanti Avalanche is an enterprise mobile device management system from Ivanti, USA. The system is primarily used to manage devices such as smartphones, tablets, and barcode scanners. A security vulnerability exists in Ivanti Avalanche that stems from a lack of authentication local privilege...
CVE-2023-45325
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'address' parameter of the routers/add-users.php resource does not validate the characters received and they are sent unfiltered to the database...
CVE-2023-45347
CVE-2023-45347 affects Online Food Ordering System v1.0. The vulnerability is due to unauthenticated SQL Injection in the *_verified parameter of routers/user-router.php where input is not validated before reaching the database. Multiple Red Hat and NVD records confirm the issue; exploitation sta...
PT-2023-29509 · Unknown · Online Food Ordering System
Name of the Vulnerable Software and Affected Versions: Online Food Ordering System version 1.0 Description: The issue concerns multiple Unauthenticated SQL Injection vulnerabilities. Specifically, the status parameter of the "routers/edit-orders.php" resource does not validate the characters...
PT-2023-29510 · Unknown · Online Food Ordering System
Name of the Vulnerable Software and Affected Versions: Online Food Ordering System version 1.0 Description: The issue concerns multiple Unauthenticated SQL Injection vulnerabilities. The id parameter of the "routers/edit-orders.php" resource does not validate the input, making it vulnerable to SQ...
CVE-2023-46081
Unauth. Stored Cross-Site Scripting XSS vulnerability in Lavacode Lava Directory Manager plugin = 1.1.34 versions...
CVE-2023-46076
Unauth. Reflected Cross-Site Scripting XSS vulnerability in RedNao WooCommerce PDF Invoice Builder, Create invoices, packing slips and more plugin = 1.2.102 versions...
NextGen Mirth Connect Security Breach
NextGen Mirth Connect is a healthcare integration engine from NextGen USA. A security vulnerability exists in versions of NextGen Mirth Connect prior to 4.4.1 that stems from vulnerability to unauthenticated remote code execution attacks...
PT-2023-28957 · Unknown · Online Art Gallery
Name of the Vulnerable Software and Affected Versions: Online Art Gallery version 1.0 Description: The issue concerns multiple Unauthenticated SQL Injection vulnerabilities. Specifically, the fnm parameter of the header.php resource does not validate the characters received, and they are sent...
CVE-2023-45637
Unauth. Reflected Cross-Site Scripting XSS vulnerability in EventPrime EventPrime – Events Calendar, Bookings and Tickets plugin = 3.1.5 versions...
CVE-2023-45007
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Fotomoto plugin = 1.2.8 versions...
Oracle Communications Security Vulnerability
Oracle Communications is a product of Oracle Corporation USA. provides integrated communications and cloud solutions for service providers and enterprises to accelerate their digital transformation. A security vulnerability exists in Oracle Communications' Oracle Enterprise Session Border...
CVE-2023-4620 Booking Calendar < 9.7.3.1 - Unauthenticated Stored XSS
The Booking Calendar WordPress plugin before 9.7.3.1 does not sanitize and escape some of its booking from data, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators...
Plixer Scrutinizer Authorization Issues Vulnerability
Plixer Scrutinizer is a network monitoring and analysis appliance from Plixer that collects, interprets, and puts in context the data from every digital exchange and transaction to provide insightful network intelligence and security reports. A security vulnerability exists in Plixer Scrutinizer...
Tinycontrol LAN Controller v3 (LK3) 1.58a - Remote Denial Of Service
Exploit Title: Tinycontrol LAN Controller v3 LK3 1.58a - Remote Denial Of Service Exploit Author: LiquidWorm Vendor: Tinycontrol Product web page: https://www.tinycontrol.pl Affected version: this with a calendar when - then. The device provides a user interface in the form of a web page. The...
CVE-2023-3656
cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by an unauthenticated remote code execution vulnerability. This vulnerability can be triggered by an HTTP endpoint exposed to the network...
CVE-2023-3655 Unauthenticated Remote Database Exfiltration
cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by a dangerous methods, that allows to leak the database system settings, user accounts,.... This vulnerability can be triggered by an HTTP endpoint exposed to the...