276 matches found
WordPress Custom Banners plugin <= 3.3 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Custom Banners versions = 3.3...
WordPress Advanced Sermons Plugin <= 3.3 is vulnerable to Cross Site Scripting (XSS)
Software Advanced Sermons Type Plugin Vulnerable versions = 3.3 Fixed in 3.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-7599 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID d85d91823452 Credits vgo0 Required privilege...
WordPress plugin Visual Composer Starter 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
WordPress Visual Composer Starter Theme <= 3.3 is vulnerable to Cross Site Scripting (XSS)
Software Visual Composer Starter Type Theme Vulnerable versions = 3.3 Fixed in 3.4.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43263 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID ce7f81ff359f Credits stealthcopter Required privilege...
PT-2024-38326 · WordPress · My Custom Css Php & Ads
Name of the Vulnerable Software and Affected Versions: My Custom CSS PHP & ADS plugin for WordPress versions up to, and including, 3.3 Description: The issue is related to Full Path Disclosure, which occurs because the plugin does not prevent direct access to the...
Danfoss AK-SM800A Improper Authentication (CVE-2023-25913)
Because of an authentication flaw an attacker would be capable of generating a web report that discloses sensitive information such as internal IP addresses, usernames, store names and other sensitive information. This plugin only works with Tenable.ot. Please visit...
WordPress plugin Crafthemes Demo Import Access Control Error Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An access control error...
PT-2024-22931 · Bluerisc · Bluerisc Windowsscope Cyber Forensics
Name of the Vulnerable Software and Affected Versions: BlueRiSC WindowsSCOPE Cyber Forensics versions prior to 3.3 Description: The issue is related to an improper DACL being applied to the device created by the briscKernelDriver.sys driver, allowing a local attacker to execute arbitrary code...
PT-2024-20943 · Public Knowledge · Pkp Ojs
Name of the Vulnerable Software and Affected Versions: Pkp Ojs version 3.3 Description: A cross-site scripting XSS issue in the Submission module allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Input subject field under the Add Discussion function...
PT-2024-20940 · Public Knowledge · Pkp Ojs
Name of the Vulnerable Software and Affected Versions: Pkp Ojs version 3.3 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Publicname parameter. Recommendations: For Pkp Ojs version 3.3, consider...
jshERP SQL Injection Vulnerability
jshERP Huaxia ERP is a homegrown ERP system developed by a Chinese individual developer, Ji Sheng Hua. A SQL injection vulnerability exists in jshERP v3.3, which is caused by insufficient filtering of the "column" and "order" parameters...
jshERP SQL Injection Vulnerability
jshERP Huaxia ERP is a homegrown ERP system by the personal developer of Ji Sheng Hua in China. A SQL injection vulnerability exists in jshERP v3.3, which stems from not filtering column and order parameters well...
PT-2024-20227 · Jsherp · Jsherp
Name of the Vulnerable Software and Affected Versions: jshERP version 3.3 Description: The issue allows an attacker to construct a malicious payload to bypass the protection mechanism of jshERP via the com.jsh.erp.controller.DepotHeadController and the findallocationDetail function of...
PT-2024-20230 · Jsherp · Jsherp
Name of the Vulnerable Software and Affected Versions: jshERP version 3.3 Description: The issue concerns a SQL Injection vulnerability. Specifically, the findInOutDetail function in com.jsh.erp.controller.DepotHeadController does not adequately filter the column and order parameters, allowing an...
SE-elektronic GmbH E-DDC Code Injection Vulnerability
The SE-elektronic GmbH E-DDC is a freely configurable building controller from SE-elektronic GmbH, Germany. A code injection vulnerability exists in SE-elektronic GmbH E-DDC version 3.3 03.07.03 and earlier, which originates from allowing an attacker to send different commands to the system from...
CVE-2023-42323
Cross Site Request Forgery CSRF vulnerability in DouHaocms v.3.3 allows a remote attacker to execute arbitrary code via the adminAction.class.php file...
WordPress Taggbox Plugin <= 3.3 is vulnerable to Broken Access Control
Software Taggbox Type Plugin Vulnerable versions = 3.3 Fixed in 3.4 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-33215 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 74a01c79e50d Credits Jonas Höbenreich Required privilege...
WordPress Theme Switcha Plugin <= 3.3 is vulnerable to Cross Site Scripting (XSS)
Software Theme Switcha Type Plugin Vulnerable versions = 3.3 Fixed in 3.3.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5614 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 14276bf399ef Credits Lana Codes Required privileg...
