CVE-2025-0877 XSS in AtaksAPP's Reservation Management System

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in AtaksAPP Reservation Management System allows Cross-Site Scripting XSS. This issue affects Reservation Management System: before 4.2.3...

PT-2025-9919

Name of the Vulnerable Software and Affected Versions AtaksAPP Reservation Management System versions prior to 4.2.3 Description The issue affects the AtaksAPP Reservation Management System, allowing Cross-Site Scripting XSS due to improper neutralization of input during web page generation...

PT-2025-4867 · Dell · Enterprise Sonic

Name of the Vulnerable Software and Affected Versions: Dell Networking Switches running Enterprise SONiC OS versions prior to 4.4.1 and 4.2.3 Description: The issue concerns an Insertion of Sensitive Information into Log File, which could be exploited by a high privileged attacker with remote...

PT-2025-1371 · Analytify · Analytify

Name of the Vulnerable Software and Affected Versions: Analytify versions n/a through 4.2.3 Description: The issue is related to a Missing Authorization vulnerability in Analytify. This vulnerability allows unauthorized access due to the lack of proper authorization checks. Recommendations: For...

WordPress plugin WP users media 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin Astoundify Jobify 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2024-35318 · WordPress · Ben Marshall Jobify - Job Board Wordpress Theme

Name of the Vulnerable Software and Affected Versions: Ben Marshall Jobify - Job Board WordPress Theme versions n/a through 4.2.3 Description: The issue is related to improper neutralization of input during web page generation, also known as Cross-site Scripting, which allows Stored XSS. This mea...

WordPress plugin Jobify 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...

WordPress Jobify - Job Board WordPress Theme Theme <= 4.2.3 is vulnerable to Cross Site Scripting (XSS)

Software Jobify - Job Board WordPress Theme Type Theme Vulnerable versions = 4.2.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-52478 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 1dc3663080eb Credits Ananda Dhakal Patchsta...

Cerberus Helpdesk User Hash Disclosure

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Cerberus Helpdesk User Hash Disclosure', 'Description' = %q This module extracts usernames and password hashes from the Cerberus Helpdesk through...

WordPress WP Easy Pay plugin <= 4.2.3 - Missing Authorization to Unauthenticated Service Disconnection vulnerability

Missing Authorization to Unauthenticated Service Disconnection vulnerability discovered by Lucio Sá in WordPress Plugin WP EasyPay versions = 4.2.3...

WordPress plugin LearnPress Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin LearnPress Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-29706 · WordPress · Bulk Posts Editing For Wordpress

Name of the Vulnerable Software and Affected Versions: Bulk Posts Editing For WordPress plugin for WordPress versions up to, and including, 4.2.3 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the plugin's AJAX actions. This allows...

Cross site scripting

The YML for Yandex Market plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the feedid parameter in all versions up to, and including, 4.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

ASUSTOR ADM Multiple Vulnerabilities (AS-2023-009, AS-2023-010, AS-2023-011, AS-2023-012)

ASUSTOR ADM is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:asustor:adm"; if description...

PYSEC-2023-100

In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS regular expression denial of service attack via a very large number of domain name labels of emails and URLs...

CVE-2023-34092

Vite provides frontend tooling. Prior to versions 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and 4.3.9, Vite Server Options server.fs.deny can be bypassed using double forward-slash // allows any unauthenticated user to read file from the Vite root-path of the application including the default fs.deny...

CVE-2023-32695 Insufficient validation when decoding a Socket.IO packet

socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3...

CVE-2022-3474 Bazel leaks user credentials through the remote assets API

A bad credential handling in the remote assets API for Bazel versions prior to 5.3.2 and 4.2.3 sends all user-provided credentials instead of only the required ones for the requests. We recommend upgrading to versions later than or equal to 5.3.2 or 4.2.3...