808 matches found
CVE-2022-36793 WordPress WP Shop plugin <= 3.9.6 - Unauthenticated Plugin Settings Change & Data Deletion vulnerabilities
Unauthenticated Plugin Settings Change & Data Deletion vulnerabilities in WP Shop plugin = 3.9.6 at WordPress...
PT-2022-24182 · Totalsoft · Totalsoft Event Calendar
Name of the Vulnerable Software and Affected Versions: Totalsoft Event Calendar – Calendar plugin versions 1.4.6 and earlier Description: The issue concerns an Unauthenticated Event Deletion vulnerability. Recommendations: For versions 1.4.6 and earlier, update to a version later than 1.4.6 to...
CVE-2022-35242
Unauthenticated plugin settings change vulnerability in 59sec THE Leads Management System: 59sec LITE plugin = 3.4.1 at WordPress...
PT-2022-19641 · 8 Degree Themes · 8 Degree Themes Notification Bar
Name of the Vulnerable Software and Affected Versions: 8 Degree Themes Notification Bar for WordPress plugin version 1.1.8 and earlier Description: The issue is an Unauthenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into the...
WordPress THE Leads Management System: 59sec LITE plugin <= 3.4.1 - Unauthenticated plugin settings change vulnerability
Unauthenticated plugin settings change vulnerability discovered by ptsfence Patchstack Alliance in WordPress THE Leads Management System: 59sec LITE plugin versions = 3.4.1. Solution Deactivate and delete. This plugin has been closed as of August 12, 2022 and is not available for download. This...
Airspan AirSpot 5410 代码问题漏洞
The Airspan AirSpot 5410 is an advanced LTE, CAT12, outdoor, multi-service product from Airspan USA. A security vulnerability exists in the Airspan AirSpot 5410 version 0.3.4.1-4 and prior versions, which originates from an unauthenticated attacker who can overwrite any file on the system or uplo...
CVE-2022-22280
Improper Neutralization of Special Elements used in an SQL Command leading to Unauthenticated SQL Injection vulnerability, impacting SonicWall GMS 9.3.1-SP2-Hotfix1, Analytics On-Prem 2.5.0.3-2520 and earlier versions...
CVE-2022-1277
Inavitas Solar Log product has an unauthenticated SQL Injection vulnerability...
CVE-2022-1277 SQL Injection in Inavitas Solar Log
Inavitas Solar Log product has an unauthenticated SQL Injection vulnerability...
Unauthenticated SQL Injection in SonicWall GMS and Analytics
Improper Neutralization of Special Elements used in an SQL Command leading to Unauthenticated SQL Injection vulnerability, impacting SonicWall GMS and Analytics On-Prem. CVE: CVE-2022-22280 Last updated: Oct. 13, 2022, 7:30 p.m...
UBUNTU-CVE-2022-21549
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 17.0.3.1; Oracle GraalVM Enterprise Edition: 21.3.2 and 22.1.0. Easily exploitable vulnerability allows unauthenticated...
CVE-2022-35405
Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. This also affects ManageEngine Access Manager Plus before 4303 with authentication...
CVE-2022-31126 Unauthenticated Remote Code Execution in Roxy-wi
Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remote, unauthenticated attacker to code execution by sending a specially crafted HTTP request to /app/options.py file. This affects Roxy-wi versions before...
CVE-2022-29415 WordPress Ravpage plugin <= 2.16 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability
Unauthenticated Reflected Cross-Site Scripting XSS vulnerability in Mati Skiba @ Rav Messer's Ravpage plugin = 2.16 at WordPress...
CVE-2022-21431
Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications component: Connection Manager. Supported versions that are affected are 12.0.0.4 and 12.0.0.5. Easily exploitable vulnerability allows unauthenticated attacker with network acce...
PT-2022-13747 · Sap · Sap Information System
Name of the Vulnerable Software and Affected Versions: SAP Information System version 1.0 Description: A critical issue was found, allowing an unauthenticated attacker to create a new admin account for the web application with a simple POST request to the "add admin.php" file, located at the "/SA...
CVE-2022-0784
The WordPress Title Experiments Free plugin (versions before 9.0.1) contains an unauthenticated SQL injection via the wpex_titles AJAX action due to inadequate sanitization/escaping of the id parameter. Affected software: WordPress Title Experiments Free plugin prior to 9.0.1. Attack surface: una...
Sql injection
An unauthenticated SQL Injection vulnerability exists in RosarioSIS before 7.6.1 via the votes parameter in ProgramFunctions/PortalPollsNotes.fnc.php...
WordPress SupportCandy plugin <= 2.2.4 - Unauthenticated Arbitrary Ticket Deletion vulnerability
Unauthenticated Arbitrary Ticket Deletion vulnerability discovered by Brandon Roldan in WordPress SupportCandy plugin versions = 2.2.4. Solution Update the WordPress SupportCandy plugin to the latest available version at least 2.2.5...