CVE-2023-30319

ChatEngine (Java web app) is affected by a cross-site scripting (XSS) vulnerability in the username field of /src/chatbotapp/LoginServlet.java, observed in commit fded8e710ad59f816867ad47d7fc4862f6502f3e. The issue allows arbitrary code execution as described in multiple sources referencing CVE-2...

CVE-2023-30322

The CVE-2023-30322 vulnerability, documented for Payatu ChatEngine v1.0, is a Cross-Site Scripting (XSS) issue in the username field of /src/chatbotapp/chatWindow.java that can allow an attacker to execute arbitrary code. Affected component/file: ChatEngine 1.0, + root cause described as input ha...

CVE-2023-30322

Cross Site Scripting XSS vulnerability in username field in /src/chatbotapp/chatWindow.java in Payatu ChatEngine v.1.0, allows attackers to execute arbitrary code...

CVE-2023-30323

SQL Injection vulnerability in username field in /src/chatbotapp/chatWindow.java in Payatu ChatEngine v.1.0, allows attackers to gain sensitive information...

CVE-2023-30326

CVE-2023-30326 : XSS vulnerability in wliang6 ChatEngine, in the file /WebContent/WEB-INF/lib/chatbox.jsp (username field). The root cause is improper input handling in chatbox.jsp, enabling injection of scripts. Affected product: wliang6 ChatEngine (version 1.0 per CNNVD/CVE context). Impact per...

CVE-2023-30319

Cross Site Scripting XSS vulnerability in username field in /src/chatbotapp/LoginServlet.java in wliang6 ChatEngine commit fded8e710ad59f816867ad47d7fc4862f6502f3e, allows attackers to execute arbitrary code...

ChatEngine 跨站脚本漏洞

ChatEngine is a Java web application by the individual developer Winnie Liang. A security vulnerability exists in ChatEngine version 1.0, which is caused by a cross-site scripting XSS vulnerability in the username field...

CVE-2023-30322

Cross Site Scripting XSS vulnerability in username field in /src/chatbotapp/chatWindow.java in Payatu ChatEngine v.1.0, allows attackers to execute arbitrary code...

PT-2023-22632 · Payatu · Payatu Chatengine

Name of the Vulnerable Software and Affected Versions: Payatu ChatEngine version 1.0 Description: The issue is related to a Cross Site Scripting XSS vulnerability in the username field, located in the /src/chatbotapp/chatWindow.java file. This vulnerability allows attackers to execute arbitrary...

CVE-2023-30323

SQL Injection vulnerability in username field in /src/chatbotapp/chatWindow.java in Payatu ChatEngine v.1.0, allows attackers to gain sensitive information...

CVE-2023-30326

Cross Site Scripting XSS vulnerability in username field in /WebContent/WEB-INF/lib/chatbox.jsp in wliang6 ChatEngine commit fded8e710ad59f816867ad47d7fc4862f6502f3e, allows attackers to execute arbitrary code...

CVE-2023-3473

A vulnerability, which was classified as critical, was found in Campcodes Retro Cellphone Online Store 1.0. Affected is an unknown function of the file /admin/editproduct.php. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The explo...

Authentication flaw

The Web3 – Crypto wallet Login & NFT token gating plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.6.0. This is due to incorrect authentication checking in the 'hiddenformdata' function. This makes it possible for authenticated attackers to log in as...

CVE-2023-3457

A vulnerability was found in SourceCodester Shopping Website 1.0. It has been classified as critical. Affected is an unknown function of the file index.php. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclos...

CVE-2023-3447

The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Injection in versions up to, and including, 4.1.5. This is due to insufficient escaping on the supplied username value. This makes it possible for unauthenticated attackers to extract potentially...

PT-2023-24927 · Unknown · Sourcecodester Shopping Website

Name of the Vulnerable Software and Affected Versions: SourceCodester Shopping Website version 1.0 Description: A critical issue has been found, affecting an unknown function of the file index.php. The manipulation of the username argument leads to sql injection, allowing remote attacks. The...

Web3 – Crypto wallet Login & NFT token gating < 2.7.0 - Authentication Bypass

The plugin does not properly perform authentication in the 'hiddenformdata' function, allowing an unauthenticated user to log in as any existing user on the site, such as an administrator, if they have access to the username...

SourceCodester Shopping Website SQL注入漏洞

SourceCodester Shopping Website is a shopping website type CMS. A SQL injection vulnerability exists in SourceCodester Shopping Website version 1.0, which stems from a problem in the file index.php, where manipulation of the parameter username can lead to sql injection...

WordPress plugin Active Directory Integration/LDAP Integration 注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. An injection vulnerability exists in...

PT-2023-3437 · WordPress · Active Directory Integration / Ldap Integration

Name of the Vulnerable Software and Affected Versions: Active Directory Integration / LDAP Integration plugin for WordPress versions up to, and including, 4.1.5 Description: The issue is related to insufficient escaping on the supplied username value, which makes it possible for unauthenticated...