PT-2023-23709 · Unknown · Kathy Darling Simple User Listing

Name of the Vulnerable Software and Affected Versions: Kathy Darling Simple User Listing plugin versions = 1.9.2 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. No information is provided about the estimated number of potentially affected devices...

PT-2023-28414 · Samsung · Samsung Account

Name of the Vulnerable Software and Affected Versions: Samsung Account versions prior to 14.5.00.7 Description: The issue concerns the use of implicit intent for sensitive communication in the startEmailValidationActivity function within Samsung Account. This allows attackers to access arbitrary...

PT-2023-15047 · Unknown · Simple Newsletter Plugin – Noptin

Name of the Vulnerable Software and Affected Versions: Simple Newsletter Plugin – Noptin versions 1.9.5 and earlier Description: The issue is related to the improper neutralization of formula elements in a CSV file, which affects the Simple Newsletter Plugin – Noptin. Recommendations: For version...

PT-2023-32459 · WordPress · Updraftplus

Name of the Vulnerable Software and Affected Versions: UpdraftPlus: WordPress Backup & Migration Plugin versions up to, and including, 1.23.10 Description: The issue is related to Cross-Site Request Forgery due to a lack of nonce validation and insufficient validation of the instance id on the...

PT-2023-30344 · Unknown · Linker Plugin

Name of the Vulnerable Software and Affected Versions: Linker plugin versions prior to 1.2.1 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For versions prior to 1.2.1, update to a version...

PT-2023-30207 · Unknown · Thefreewindows Auto Limit Posts Reloaded

Name of the Vulnerable Software and Affected Versions: TheFreeWindows Auto Limit Posts Reloaded plugin versions = 2.5 Description: A Cross-Site Request Forgery CSRF issue affects the plugin, allowing unauthorized actions to be performed on behalf of a user without their knowledge. Recommendations...

PT-2023-29388 · WordPress · The Video Gallery – Best Wordpress Youtube Gallery Plugin

Name of the Vulnerable Software and Affected Versions: Video Gallery – Best WordPress YouTube Gallery Plugin versions prior to 2.1.4 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL...

PT-2023-30210 · Alter · Alter

Name of the Vulnerable Software and Affected Versions: Alter plugin versions = 1.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application that the user is authenticated to. No...

PT-2023-32357 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 16.2 through 16.3.5 GitLab CE/EE versions 16.4 through 16.4.1 GitLab CE/EE versions 16.5 through 16.5.0 Description: A low-privileged attacker can point a CI/CD Component to an incorrect path, causing the server to exhau...

PT-2023-30211 · WordPress · Roland Murg Current Menu Item For Custom Post Types

Name of the Vulnerable Software and Affected Versions: Roland Murg Current Menu Item for Custom Post Types plugin versions = 1.5 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing...

PT-2023-30351 · WordPress · Wpdiscuz

Name of the Vulnerable Software and Affected Versions: wpDiscuz plugin versions 7.6.11 and earlier Description: The issue is related to an Unauth. Stored Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into a website, which can the...

Important: plexus-archiver

Issue Overview: Plexis Archiver is a collection of Plexus components to create archives or extract archives to a directory with a unified Archiver/UnArchiver API. Prior to version 4.8.0, using AbstractUnArchiver for extracting an archive might lead to an arbitrary file creation and possibly remot...

PT-2023-23989 · Unknown · Contact Form To Any Api

Name of the Vulnerable Software and Affected Versions: Contact Form to Any API versions 1.1.2 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2023-32027 · WordPress · Photos/Files Contest Gallery Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Photos and Files Contest Gallery WordPress plugin version 21.2.8.1 and earlier Description: The issue allows unauthenticated users to perform Cross-Site Scripting attacks via certain headers due to the plugin not sanitising and escaping some...

PT-2023-29908 · Webcource · Webcource Wc Captcha

Name of the Vulnerable Software and Affected Versions: WebCource WC Captcha plugin versions = 1.4 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For WebCource WC Captcha plugin versions =...

PT-2023-29976 · Prestashop · Csv Feeds Pro

Name of the Vulnerable Software and Affected Versions: PrestaShop module CSV Feeds PRO versions prior to 2.6.1 Description: The issue allows a guest to perform SQL injection due to a sensitive SQL call in the SearchApiCsv::getProducts method. This can be exploited with a trivial HTTP call, allowi...

PT-2023-32403 · Pkp-Lib · Pkp-Lib

Name of the Vulnerable Software and Affected Versions: pkp/pkp-lib versions prior to 3.4.0-4 Description: The issue is related to Cross-site Scripting XSS - Stored, which affects the GitHub repository pkp/pkp-lib. Recommendations: For versions prior to 3.4.0-4, update to version 3.4.0-4 or later ...

PT-2023-29955 · WordPress · Zotpress

Name of the Vulnerable Software and Affected Versions: Katie Seaborn Zotpress plugin versions prior to 7.3.4 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially...

PT-2023-10311 · Jhipster · Generator-Jhipster

Name of the Vulnerable Software and Affected Versions: JHipster generator-jhipster versions prior to 2.23.0 Description: The issue allows for a timing attack against the validateToken function due to a string comparison that stops at the first different character. This enables attackers to guess...

PT-2023-29928

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2023.8.4 and 2023.10.2 Description authentik is an open-source Identity Provider. When the default admin user has been deleted, it is potentially possible for an attacker to set the password of the default admin use...