101 matches found
CVE-2024-51567
upgrademysqlstatus in databases/views.py in CyberPanel aka Cyber Panel before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware which is only for a POST request and using shell metacharacters in the...
PT-2024-23455 · WordPress · Wp Express Checkout
Name of the Vulnerable Software and Affected Versions: WP Express Checkout Accept PayPal Payments versions through 2.3.7 Description: The issue is related to improper validation of specified quantity in input, allowing manipulation of hidden fields. This can be exploited to manipulate the checkou...
WordPress WP Express Checkout plugin <= 2.3.7 - Price Manipulation vulnerability
Price Manipulation vulnerability discovered by Xinzhi Luo Patchstack Alliance in WordPress Plugin WP Express Checkout Accept PayPal Payments versions = 2.3.7...
CVE-2024-1745
The Testimonial Slider WordPress plugin before 2.3.7 does not properly ensure that a user has the necessary capabilities to edit certain sensitive Testimonial Slider WordPress plugin before 2.3.7 settings, making it possible for users with at least the Author role to edit them...
WordPress Plugin Testimonial Slider 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...
CVE-2024-22152
Unrestricted Upload of File with Dangerous Type vulnerability in WebToffee Product Import Export for WooCommerce.This issue affects Product Import Export for WooCommerce: from n/a through 2.3.7...
Repox Code Issues Vulnerabilities
Repox is a framework for managing data spaces from Repox. A code issue vulnerability exists in Repox 2.3.7 and earlier versions, which stems from the presence of an XML External Entity Injection XXE vulnerability. An attacker can exploit this vulnerability to upload malicious XML data via the...
Repox Code Issues Vulnerabilities
Repox is a framework for managing data spaces from Repox. A code issue vulnerability exists in Repox 2.3.7 and prior versions that stems from an arbitrary file upload vulnerability...
Repox Cross-Site Scripting Vulnerability
Repox is a framework for managing dataspaces from Repox. A cross-site scripting vulnerability exists in Repox 2.3.7 and earlier versions, which stems from the presence of a cross-site scripting XSS vulnerability...
AZL-31701 CVE-2023-46136 affecting package python-werkzeug for versions less than 2.3.7-1
Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing...
CVE-2022-24093
Summary: CVE-2022-24093 affects Adobe Commerce and Magento Open Source, with an improper input validation vulnerability that could enable post-authentication arbitrary code execution. Affected versions (per sources): Adobe Commerce 2.4.3-p1 and earlier; 2.3.7-p2 and earlier (and related 2.x lines...
GHSA-WQR6-WV6C-P8FX Magento improper access control vulnerability within Magento's Media Gallery Upload workflow
Magento versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper access control vulnerability within Magento's Media Gallery Upload workflow. By storing a specially crafted file in the website gallery, an authenticated attacker with administrative privile...
Magento affected by remote code execution vulnerability in the CMS page scheduled update feature
Magento versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an Improper input validation vulnerability within the CMS page scheduled update feature. An authenticated attacker with administrative privilege could leverage this vulnerability to achieve remote code...
XML Injection
Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to XML Injection via the widgets update layout. An attacker with administrative privileges can execute arbitrary commands by submitting specially crafted XML data. Remediation...
WordPress Stagtools Plugin <= 2.3.7 is vulnerable to Cross Site Scripting (XSS)
Software Stagtools Type Plugin Vulnerable versions = 2.3.7 Fixed in 2.3.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-41868 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 3bb564ac29eb Credits Le Ngoc Anh Required privilege...
CVE-2023-38517
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Realwebcare WRC Pricing Tables plugin = 2.3.7 versions...
PT-2023-23849 · WordPress · Gloriafood Restaurant Menu – Food Ordering System – Table Reservation
Name of the Vulnerable Software and Affected Versions: GloriaFood Restaurant Menu – Food Ordering System – Table Reservation plugin versions prior to 2.3.7 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attack...
WordPress Clone Plugin <= 2.3.7 is vulnerable to Cross Site Request Forgery (CSRF)
Software Clone Type Plugin Vulnerable versions = 2.3.7 Fixed in 2.3.8 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-3977 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 96ed031b1483 Credits Wordfence Required privilege...
WordPress Clone Plugin <= 2.3.7 is vulnerable to Broken Access Control
Software Clone Type Plugin Vulnerable versions = 2.3.7 Fixed in 2.3.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-0958 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 17cafe8314cd Credits WordFence Required privilege Subscriber...