CVE-2023-45347

CVE-2023-45347 affects Online Food Ordering System v1.0. The vulnerability is due to unauthenticated SQL Injection in the *_verified parameter of routers/user-router.php where input is not validated before reaching the database. Multiple Red Hat and NVD records confirm the issue; exploitation sta...

PT-2023-29509 · Unknown · Online Food Ordering System

Name of the Vulnerable Software and Affected Versions: Online Food Ordering System version 1.0 Description: The issue concerns multiple Unauthenticated SQL Injection vulnerabilities. Specifically, the status parameter of the "routers/edit-orders.php" resource does not validate the characters...

PT-2023-29510 · Unknown · Online Food Ordering System

Name of the Vulnerable Software and Affected Versions: Online Food Ordering System version 1.0 Description: The issue concerns multiple Unauthenticated SQL Injection vulnerabilities. The id parameter of the "routers/edit-orders.php" resource does not validate the input, making it vulnerable to SQ...

CVE-2023-46081

Unauth. Stored Cross-Site Scripting XSS vulnerability in Lavacode Lava Directory Manager plugin = 1.1.34 versions...

CVE-2023-46076

Unauth. Reflected Cross-Site Scripting XSS vulnerability in RedNao WooCommerce PDF Invoice Builder, Create invoices, packing slips and more plugin = 1.2.102 versions...

NextGen Mirth Connect Security Breach

NextGen Mirth Connect is a healthcare integration engine from NextGen USA. A security vulnerability exists in versions of NextGen Mirth Connect prior to 4.4.1 that stems from vulnerability to unauthenticated remote code execution attacks...

PT-2023-28957 · Unknown · Online Art Gallery

Name of the Vulnerable Software and Affected Versions: Online Art Gallery version 1.0 Description: The issue concerns multiple Unauthenticated SQL Injection vulnerabilities. Specifically, the fnm parameter of the header.php resource does not validate the characters received, and they are sent...

CVE-2023-45637

Unauth. Reflected Cross-Site Scripting XSS vulnerability in EventPrime EventPrime – Events Calendar, Bookings and Tickets plugin = 3.1.5 versions...

CVE-2023-45007

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Fotomoto plugin = 1.2.8 versions...

Oracle Communications Security Vulnerability

Oracle Communications is a product of Oracle Corporation USA. provides integrated communications and cloud solutions for service providers and enterprises to accelerate their digital transformation. A security vulnerability exists in Oracle Communications' Oracle Enterprise Session Border...

CVE-2023-4620 Booking Calendar < 9.7.3.1 - Unauthenticated Stored XSS

The Booking Calendar WordPress plugin before 9.7.3.1 does not sanitize and escape some of its booking from data, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators...

Plixer Scrutinizer Authorization Issues Vulnerability

Plixer Scrutinizer is a network monitoring and analysis appliance from Plixer that collects, interprets, and puts in context the data from every digital exchange and transaction to provide insightful network intelligence and security reports. A security vulnerability exists in Plixer Scrutinizer...

Tinycontrol LAN Controller v3 (LK3) 1.58a - Remote Denial Of Service

Exploit Title: Tinycontrol LAN Controller v3 LK3 1.58a - Remote Denial Of Service Exploit Author: LiquidWorm Vendor: Tinycontrol Product web page: https://www.tinycontrol.pl Affected version: this with a calendar when - then. The device provides a user interface in the form of a web page. The...

CVE-2023-3656

cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by an unauthenticated remote code execution vulnerability. This vulnerability can be triggered by an HTTP endpoint exposed to the network...

CVE-2023-3655 Unauthenticated Remote Database Exfiltration

cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by a dangerous methods, that allows to leak the database system settings, user accounts,.... This vulnerability can be triggered by an HTTP endpoint exposed to the...

CVE-2023-41868

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Ram Ratan Maurya, Codestag StagTools plugin = 2.3.7 versions...

PT-2023-28133 · Xtemos · Xtemos Woodmart

Name of the Vulnerable Software and Affected Versions: Xtemos WoodMart plugin versions prior to 7.2.4 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing the...

PT-2023-28130 · Codestag · Codestag Stagtools

Name of the Vulnerable Software and Affected Versions: Codestag StagTools plugin versions = 2.3.7 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing them to steal user...

Metasploit Weekly Wrap-Up

Improved Ticket Forging Metasploit’s admin/kerberos/forgeticket module has been updated to work with Server 2022. In Windows Server 2022, Microsoft started requiring additional new PAC elements to be present - the PAC requestor and PAC attributes. The newly forged tickets will have the necessary...

Apache Airflow 1.10.10 Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache Airflow 1.10.10 - Example DAG Remote Code Execution', 'Description' = %q This module exploits an unauthenticated command injection...