4535 matches found
CVE-2024-56924
CVE-2024-56924 취약점 설명 code astro Internet Banking System 버전 2.0.0에 CSRFCross-Site Request Forgery 취약점이 존재합니다. 이 취약점으로 인해 원격 공격자는 인증된 사용자예: 관리자의 동의 없이 해당 사용자를 대신하여 승인되지 않은 작업을 수행할 수 있습니다. 공격자는 악성 HTML 페이지를 제작하여 인증된 사용자예: 관리자를 속여 대상 시스템에서 민감한 계정 세부 정보예: 이름, 이메일를 수정하는 요청을 제출하도록 할 수 있습니다. 이 취약점은 계정 수...
CVE-2024-57373
LifestyleStore v1.0의 CSRF 취약점 📌 개요 이 저장소는 LifestyleStore v1.0 프로젝트에서 확인된 사이트 간 요청 위조CSRF 취약점을 문서화합니다. 이 결함으로 인해 공격자는 인증된 사용자를 대신하여 승인되지 않은 작업을 수행할 수 있으며, 데이터 무결성과 계정 보안에 위험을 초래합니다. 🛠️ 기술 세부 사항 유형 : CSRF 사이트 간 요청 위조 영향 : 데이터 수정이나 계정 탈취와 같은 승인되지 않은 작업 영향을 받는 버전 : LifestyleStore v1.0 심각도 : 높음 💡 작동 방식...
MAGMI - Cross-Site Request Forgery
MAGMI Magento Mass Importer is vulnerable to cross-site request forgery CSRF due to a lack of CSRF tokens. Remote code execution via phpcli command is also possible in the event that CSRF is leveraged against an existing admin session. id: CVE-2020-5776 info: name: MAGMI - Cross-Site Request...
WordPress Meta SEO <= 4.5.2 - Open Redirect
The WP Meta SEO WordPress plugin before 4.5.3 did not authorize several AJAX actions, which allowed low-privilege users to update certain data and resulted in an arbitrary redirect vulnerability. id: CVE-2023-0876 info: name: WordPress Meta SEO = 4.5.2 - Open Redirect author: Khalid6468 severity:...
IceWarp 11.4.6.0 - Cross-Site Scripting
IceWarp 11.4.6.0 was discovered to contain a cross-site scripting XSS vulnerability via the color parameter. id: CVE-2023-39600 info: name: IceWarp 11.4.6.0 - Cross-Site Scripting author: Imjust0 severity: medium description: | IceWarp 11.4.6.0 was discovered to contain a cross-site scripting XSS...
osTicket < v1.16.6 - Cross-Site Scripting
Cross-site Scripting XSS - Generic in GitHub repository osticket/osticket prior to v1.16.6. id: CVE-2023-1318 info: name: osTicket v1.16.6 - Cross-Site Scripting author: ritikchaddha severity: medium description: | Cross-site Scripting XSS - Generic in GitHub repository osticket/osticket prior to...
WordPress Plugin Flexible Custom Post Type < 0.1.7 - Cross-Site Scripting
A cross-site scripting vulnerability in edit-post.php in the Flexible Custom Post Type plugin before 0.1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter. id: CVE-2011-5106 info: name: WordPress Plugin Flexible Custom Post Type 0.1.7 - Cross-Site...
WordPress Integrator 1.32 - Cross-Site Scripting
A cross-site scripting vulnerability in wp-integrator.php in the WordPress Integrator module 1.32 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirectto parameter to wp-login.php. id: CVE-2012-5913 info: name: WordPress Integrator 1.32 - Cross-Site Scripti...
osTicket < 1.10.2 - Cross-Site Scripting
Cross-site scripting XSS vulnerability in /ajax.php/form/help-topic in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "message" parameter. id: CVE-2018-7192 info: name: osTicket 1.10.2 - Cross-Site Scripting author: ritikchaddha severity:...
WordPress Checklist <1.1.9 - Cross-Site Scripting
WordPress Checklist plugin before 1.1.9 contains a cross-site scripting vulnerability. The fill parameter is not correctly filtered in the checklist-icon.php file. id: CVE-2019-16525 info: name: WordPress Checklist 1.1.9 - Cross-Site Scripting author: daffainfo severity: medium description:...
osTicket < 1.10.2 - Cross-Site Scripting
Cross-site scripting XSS vulnerability in /scp/directory.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "order" parameter. id: CVE-2018-7193 info: name: osTicket 1.10.2 - Cross-Site Scripting author: ritikchaddha severity: medium...
WordPress Stop Spammers <2021.9 - Cross-Site Scripting
WordPress Stop Spammers plugin before 2021.9 contains a reflected cross-site scripting vulnerability. It does not escape user input when blocking requests such as matching a spam word, thus outputting it in an attribute after sanitizing it to remove HTML tags. id: CVE-2021-24245 info: name:...
Imgproxy < 3.14.0 - Cross-site Scripting (XSS)
Cross-site Scripting XSS - Reflected in GitHub repository imgproxy/imgproxy prior to 3.14.0. id: CVE-2023-1496 info: name: Imgproxy 3.14.0 - Cross-site Scripting XSS author: pdteam severity: medium description: Cross-site Scripting XSS - Reflected in GitHub repository imgproxy/imgproxy prior to...
WPZOOM Social Icons Widget <= 4.2.15 - Missing Authorization
WPZOOM Social Icons Widget & Block versions up to 4.2.15 contain a missing authorization vulnerability caused by insufficient access control in the widget and block, letting attackers perform unauthorized actions, exploit requires no special conditions. id: CVE-2024-30464 info: name: WPZOOM Socia...
CVE-2026-101104
The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate configurations of devices they do not own. By exploiting this flaw, an attacker can alter device settings, trigger unintended behaviors, or access sensitive informatio...
EUVD-2026-91704
In SuperAGI v0.0.14 and prior, controller endpoints /api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/editschedule, /api/agents/stopschedule allow authenticated users from one organization to create, schedule, edit, stop, and delete agents belonging to a different...
CVE-2026-51899
SuperAGI versions v0.0.14 and prior are vulnerable to an Improper Access Control flaw (CWE-284) in several controller endpoints, including /api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/edit_schedule, and /api/agents/stop_schedule. The root cause is that these endpoints...
CVE-2026-1375
CVE-2026-1375: Tutor LMS 플러그인의 인증된 IDOR / 끊어진 접근 제어 고지 사항: 이 저장소는 교육 목적 및 윤리적 공개를 위해서만 생성되었습니다. 이 취약점은 책임 있는 공개 절차를 통해 공급업체에 보고되었으며 패치가 적용되었습니다. 적절한 승인 없이 시스템을 악용하는 데 이 정보를 사용하지 마십시오. 요약 Tutor LMS WordPress 플러그인버전 = 3.9.5에서 안전하지 않은 직접 객체 참조IDOR / 끊어진 접근 제어 취약점이 발견되었습니다. 이 결함으로 인해 Tutor 강사 역할을 가진 ...
