The vulnerability of the UnlockProjectUserRights method in the software for managing and monitoring removed objects in telemetry and telemechanics systems, such as the TeleControl Server Basic, allows a hacker to circumvent security restrictions and gain access to write and read arbitrary files.

The vulnerability of the UnlockProjectUserRights method in the software for managing and monitoring removed objects in telemetry and telemechanics systems related to the TeleControl Server Basic is linked to the lack of measures taken to protect the SQL query structure. Exploiting this...

The vulnerability of the `dc_elt_size` component in the virtuoso-opensource web application development platform allows a attacker to trigger a service failure.

The vulnerability of the dceltsize component in the virtuoso-opensource web application development platform is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker to cause service interruptions remotely...

The vulnerability of the web interface for managing microprogramming software-based network storage devices STEALTHONE D220 and D340 allows a intruder to gain unauthorized access to protected information.

The vulnerability of the web interface for managing microprogramming software-based network storage devices STEALTHONE D220 and D340 is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability can allow an attacker, operating remotely, to gain...

WordPress plugin Fancy Product Designer SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerability...

PT-2025-1764 · WordPress · Gdy Modular Content

Name of the Vulnerable Software and Affected Versions: GDY Modular Content plugin for WordPress versions up to, and including, 0.9.91 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg without proper escaping on the URL. This allows unauthenticated...

PT-2024-16913 · WordPress · Comfino Payment Gateway

Name of the Vulnerable Software and Affected Versions: Comfino Payment Gateway plugin for WordPress versions up to, and including, 4.1.1 Description: The Comfino Payment Gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add query arg and remove query a...

CVE-2024-10877

The AFI – The Easiest Integration Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 1.92.0. This makes it possible for unauthenticated attackers t...

The vulnerability of the AWV component (Audio, Web, and Video Conferencing) of the Mitel MiCollab collaboration platform allows a perpetrator to execute arbitrary code.

The vulnerability of the AWV component Audio, Web, and Video Conferencing is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2024-9377

The Products, Order & Customers Export for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 2.0.15. This makes it possible for unauthenticat...

CVE-2024-9375

The WordPress Captcha Plugin by Captcha Bank plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 4.0.36. This makes it possible for unauthenticated attackers to inject...

CVE-2024-9220

The LH Copy Media File plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.08. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...

PT-2024-39193 · WordPress · Kodex Posts Likes Plugin

Name of the Vulnerable Software and Affected Versions: Kodex Posts likes plugin for WordPress versions up to, and including, 2.5.0 Description: The issue arises from the use of add query arg without proper escaping on the URL, allowing unauthenticated attackers to inject arbitrary web scripts int...

CVE-2024-8716

The XT Ajax Add To Cart for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to inject arbitrary...

The vulnerability of the LoadMotherboardTable method in the Ivanti EPM endpoint management software allows a hacker to execute arbitrary code.

The vulnerability of the LoadMotherboardTable method in the Ivanti EPM endpoint management software is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2024-39214 · WordPress · Pdf Thumbnail Generator

Name of the Vulnerable Software and Affected Versions: PDF Thumbnail Generator plugin for WordPress versions up to, and including, 1.3 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg without appropriate escaping on the URL. This allows...

PT-2024-39212 · WordPress · Lucas String Replace

Name of the Vulnerable Software and Affected Versions: Lucas String Replace plugin for WordPress versions up to, and including, 2.0.5 Description: The issue arises from the use of add query arg without proper escaping on the URL, allowing unauthenticated attackers to inject arbitrary web scripts...

The vulnerability of the Timeperiod component of the Centreon IT infrastructure monitoring software’s web interface allows a hacker to execute arbitrary SQL commands.

The vulnerability of the Timeperiod component of the Centreon IT infrastructure monitoring software’s web interface is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL commands remotely...

The vulnerability of the login.php file of the Loan Management System allows a perpetrator to execute arbitrary SQL code.

The vulnerability of the login.php file of the Loan Management System is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary SQL code through the username parameter...

The vulnerability of the `updateServiceHost` function in the Centreon IT infrastructure monitoring software allows a hacker to execute arbitrary code.

The vulnerability of the updateServiceHost function in the Centreon IT infrastructure monitoring software is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the RecordGoodApp method in the Ivanti Endpoint Manager software for managing endpoints in information networks allows a hacker to execute arbitrary code.

The vulnerability of the RecordGoodApp method in the Ivanti Endpoint Manager software for managing endpoints in information networks relates to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a...