825 matches found
PT-2023-20073 · WordPress · Ian Sadovy Wordpress Tables Plugin
Name of the Vulnerable Software and Affected Versions: Ian Sadovy WordPress Tables plugin versions = 1.3.9 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website without proper authentication,...
WP Job Portal < 2.0.6 - Unauthenticated SQLi
Description The plugin does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users PoC Setup as admin: Create a dummy company and a job if there are none Attack as unauthenticated: time curl -X POST --data...
PT-2023-20084 · WordPress · Mahlamusa Who Hit The Page – Hit Counter
Name of the Vulnerable Software and Affected Versions: Mahlamusa Who Hit The Page – Hit Counter plugin versions = 1.4.14.3 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially...
PT-2023-23901 · I Thirteen Web Solution · I Thirteen Web Solution Video Gallery Plugin
Name of the Vulnerable Software and Affected Versions: I Thirteen Web Solution Video Gallery plugin versions 1.0.10 and earlier Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potential...
PT-2023-23849 · WordPress · Gloriafood Restaurant Menu – Food Ordering System – Table Reservation
Name of the Vulnerable Software and Affected Versions: GloriaFood Restaurant Menu – Food Ordering System – Table Reservation plugin versions prior to 2.3.7 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attack...
PT-2023-20706 · Paul Kehrer · Updraft
Name of the Vulnerable Software and Affected Versions: Paul Kehrer Updraft plugin versions = 0.6.1 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing them to steal use...
PT-2023-21909 · WordPress · Balasaheb Bhise Advanced Youtube Channel Pagination
Name of the Vulnerable Software and Affected Versions: Balasaheb Bhise Advanced Youtube Channel Pagination plugin version 1.0 and earlier Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This vulnerability allows for the injection of malicious...
CVE-2022-27861
Unauth. Open Redirect vulnerability in Arscode Ninja Popups plugin = 4.7.5 versions...
CVE-2023-24409 WordPress WP Responsive Tabs horizontal vertical and accordion Tabs Plugin <= 1.1.15 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting XSS vulnerability in I Thirteen Web Solution WP Responsive Tabs horizontal vertical and accordion Tabs plugin = 1.1.15 versions...
PT-2023-19570 · I Thirteen Web Solution · Wp Responsive Tabs
Name of the Vulnerable Software and Affected Versions: I Thirteen Web Solution WP Responsive Tabs horizontal vertical and accordion Tabs plugin versions prior to 1.1.15 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker ca...
PT-2023-21110 · Unknown · Everest News
Name of the Vulnerable Software and Affected Versions: Everest News theme versions prior to 1.1.0 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker could potentially inject malicious scripts into a website using the Evere...
CVE-2023-38392
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Hiroaki Miyashita Custom Field Template plugin = 2.5.9 versions...
CVE-2023-37979
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Saturday Drive Ninja Forms Contact Form plugin = 3.6.25 versions...
Vulnerability fixed in Ivanti Endpoint Manager Mobile (EPMM, formerly MobileIron Core).
Ivanti has fixed a vulnerability in Endpoint Manager Mobile EPMM, formerly MobileIron Core. The vulnerability allows an unauthenticated remote malicious person to access gain access to sensitive data or potentially take control of the EPMM system. The vulnerability is being actively exploited on ...
CVE-2023-3709
The Royal Elementor Addons plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 1.3.70 due to the plugin adding the API key to the source code of any page running the MailChimp block. This makes it possible for unauthenticated attackers to...
CVE-2023-3041 Autochat <= 1.1.7- Unauthenticated Stored XSS
The Autochat Automatic Conversation WordPress plugin through 1.1.7 does not sanitise and escape user input before outputting it back on the page, leading to a cross-site Scripting attack...
CVE-2023-3113
An unauthenticated XML external entity injection XXE vulnerability exists in LXCA's Common Information Model CIM server that could result in read-only access to specific files...
Lenovo XClarity Administrator 代码问题漏洞
Lenovo XClarity Administrator LXCA is a centralized resource management solution from Lenovo, China. The product provides agentless hardware management for servers, storage, network switches, and more. A security vulnerability exists in Lenovo XClarity Administrator LXCA that originates from an...
PT-2023-25513 · Webkul · Webkul Qloapps
Name of the Vulnerable Software and Affected Versions: Webkul QloApps version 1.6.0 Description: An unauthenticated Cross-Site Scripting XSS issue allows an attacker to obtain a user's session cookie and then impersonate that user via the configure parameter in a GET request. Recommendations: For...