Design/Logic Flaw

Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or by using database imports. This could allow for unexpected file creation on Superset webservers. Additionally, if Apache Superset is usin...

CVE-2023-39264 Apache Superset: Stack traces enabled by default

By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0...

apr: Windows out-of-bounds write in apr_socket_sendv function

A flaw was found in Apache Portable Runtime, affecting versions = 1.7.0. This issue may allow a malicious user to write beyond the end of a stack buffer and cause an integer overflow. This affects Windows environments...

CVE-2023-30485

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Solwin Infotech Responsive WordPress Slider – Avartan Slider Lite plugin = 1.5.3 versions...

CVE-2023-40208

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Aleksandar Urošević Stock Ticker plugin = 3.23.3 versions...

CVE-2023-40206

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in hwk-fr WP 404 Auto Redirect to Similar Post plugin = 1.0.3 versions...

PT-2023-30464 · Yonyou · Yongyou Ufida-Nc

Name of the Vulnerable Software and Affected Versions: Yongyou UFIDA-NC versions up to 20230807 Description: A critical issue has been found in the processing of the file PrintTemplateFileServlet.java, where the manipulation of the filePath argument leads to path traversal. This issue can be...

PT-2023-23242 · Wp Experts.In Team · Wp Categories Widget

Name of the Vulnerable Software and Affected Versions: WP-EXPERTS.IN TEAM WP Categories Widget plugin versions = 2.2 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing...

CVE-2023-38516

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in WP OnlineSupport, Essential Plugin Audio Player with Playlist Ultimate plugin = 1.2.2 versions...

PT-2023-30453 · Byzoro · Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform

Name of the Vulnerable Software and Affected Versions: Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform versions up to 20230822 Description: A critical issue affects some unknown functionality of the file /importexport.php, leading to sql injection. The attack can be...

PT-2023-19022 · WordPress · Chp Ads Block Detector

Name of the Vulnerable Software and Affected Versions: CHP Ads Block Detector plugin for WordPress versions up to, and including, 3.9.4 Description: The issue is related to Stored Cross-Site Scripting via admin settings reachable through an AJAX action due to insufficient input sanitization and...

PT-2023-27200 · WordPress · The Waiting

Name of the Vulnerable Software and Affected Versions: The Waiting: One-click countdowns plugin for WordPress versions up to, and including, 0.6.2 Description: The issue is due to missing or incorrect nonce validation on its AJAX actions, making it possible for unauthenticated attackers to create...

CVE-2023-25453

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Ian Sadovy WordPress Tables plugin = 1.3.9 versions...

CVE-2023-33320

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Mohammad I. Okfie WP-Hijri plugin = 1.5.1 versions...

CVE-2023-25462

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP htaccess Control plugin = 3.5.1 versions...

PT-2023-19869 · Premio · Premio Chaty Plugin

Name of the Vulnerable Software and Affected Versions: Premio Chaty plugin versions 3.0.9 and earlier Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing them to steal...

PT-2023-24638 · WordPress · Miled Wordpress Social Login

Name of the Vulnerable Software and Affected Versions: Miled WordPress Social Login plugin versions = 3.0.4 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing them to...

PT-2023-24575 · Unknown · Joaquín Ruiz Easy Admin Menu

Name of the Vulnerable Software and Affected Versions: Joaquín Ruiz Easy Admin Menu plugin versions = 1.3 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For Joaquín Ruiz Easy Admin Menu...

PT-2023-24219 · Unknown · Gsmith Cookie Monster

Name of the Vulnerable Software and Affected Versions: gsmith Cookie Monster plugin versions = 1.51 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability allows an attacker to inject malicious scripts into the application, which can then be...

PT-2023-20089 · Webcodin · Webcodin Wcp Openweather Plugin

Name of the Vulnerable Software and Affected Versions: Webcodin WCP OpenWeather plugin versions = 2.5.0 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing...