WordPress plugin Advanced Import 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

CVE-2022-35154

Shopro Mall System v1.3.8 was discovered to contain a SQL injection vulnerability via the value parameter...

CVE-2022-35154

Shopro Mall System v1.3.8 was discovered to contain a SQL injection vulnerability via the value parameter...

PT-2022-22604 · Unknown · Shopro Mall System

Name of the Vulnerable Software and Affected Versions: Shopro Mall System version 1.3.8 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the value parameter. Recommendations: For Shopro Mall System version 1.3.8, consider restricting acce...

Shopro Mall System SQL注入漏洞

XPTECH Shopro Mall System is a mall management system from China's XPTECH company. A security vulnerability exists in Shopro Mall System v1.3.8, which originates from the discovery of a SQL injection vulnerability via the value parameter...

CVE-2022-0598

The Login with phone number WordPress plugin before 1.3.8 does not sanitise and escape plugin settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

Mangboard commerce package 输入验证错误漏洞

Mangboard commerce package is an e-commerce website plugin from the Korean company Mangboard. A security vulnerability exists in Mangboard commerce package prior to version 1.3.8, which stems from improper input validation. A remote attacker can exploit the vulnerability to manipulate the total...

Domain Replace <= 1.3.8 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape a parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting PoC https://example.com/wp-admin/admin.php?page=dr-convert=%3Csvg%2Fonload%3Dalert%28%2Fxss%2F%29%3E...

Domain Replace <= 1.3.8 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape a parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting https://example.com/wp-admin/admin.php?page=dr-convert&msg=%3Csvg%2Fonload%3Dalert%28%2Fxss%2F%29%3E...

CVE-2022-25615

Cross-Site Request Forgery CSRF in StylemixThemes eRoom – Zoom Meetings & Webinar WordPress plugin = 1.3.8 allows cache deletion...

WECON PLC Editor Out-of-Bounds Writing Vulnerability

WECON PLC Editor is a PLC programming software.An out-of-bounds write vulnerability exists in WECON PLC Editor 1.3.8 and earlier versions. An attacker can exploit this vulnerability to execute arbitrary code...

WECON Technologies PLC Editor 安全漏洞

WECON PLC Editor is a PLC programming software.WECON PLC Editor 1.3.8 and earlier versions are vulnerable to a stack buffer overflow. An attacker can exploit this vulnerability to execute arbitrary code...

Wecon Plc Editor 缓冲区错误漏洞

WECON PLC Editor is a PLC programming software.An out-of-bounds write vulnerability exists in WECON PLC Editor 1.3.8 and earlier versions. An attacker can exploit this vulnerability to execute arbitrary code...

CVE-2021-36845

Multiple Authenticated Stored Cross-Site Scripting XSS vulnerabilities in YITH Maintenance Mode WordPress plugin versions = 1.3.8, there are 46 vulnerable parameters that were missed by the vendor while patching the 1.3.7 version to 1.3.8. Vulnerable parameters: 1 - "Newsletter" tab,...

CVE-2020-20294

An issue was found in CMSWing project version 1.3.8. Because the log function does not check the log parameter, malicious parameters can execute arbitrary commands...

CVE-2020-20296

An issue was found in CMSWing project version 1.3.8, Because the rechargeAction function does not check the balance parameter, malicious parameters can execute arbitrary SQL commands...

CVE-2020-20294

An issue was found in CMSWing project version 1.3.8. Because the log function does not check the log parameter, malicious parameters can execute arbitrary commands...

Command injection

An issue was found in CMSWing project version 1.3.8. Because the log function does not check the log parameter, malicious parameters can execute arbitrary commands...

CVE-2020-20296

An issue was found in CMSWing project version 1.3.8, Because the rechargeAction function does not check the balance parameter, malicious parameters can execute arbitrary SQL commands...

CVE-2020-20295

CMSWing 1.3.8 contains a SQL injection vulnerability: the updateAction function does not validate the detail parameter, allowing an attacker to supply malicious input and execute arbitrary SQL commands. Affected component: updateAction path handling, within CMSWing’s backend. Impact described in ...