PT-2023-23989 · Unknown · Contact Form To Any Api

Name of the Vulnerable Software and Affected Versions: Contact Form to Any API versions 1.1.2 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

Important: plexus-archiver

Issue Overview: Plexis Archiver is a collection of Plexus components to create archives or extract archives to a directory with a unified Archiver/UnArchiver API. Prior to version 4.8.0, using AbstractUnArchiver for extracting an archive might lead to an arbitrary file creation and possibly remot...

PT-2023-29908 · Webcource · Webcource Wc Captcha

Name of the Vulnerable Software and Affected Versions: WebCource WC Captcha plugin versions = 1.4 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For WebCource WC Captcha plugin versions =...

PT-2023-32027 · WordPress · Photos/Files Contest Gallery Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Photos and Files Contest Gallery WordPress plugin version 21.2.8.1 and earlier Description: The issue allows unauthenticated users to perform Cross-Site Scripting attacks via certain headers due to the plugin not sanitising and escaping some...

PT-2023-29976 · Prestashop · Csv Feeds Pro

Name of the Vulnerable Software and Affected Versions: PrestaShop module CSV Feeds PRO versions prior to 2.6.1 Description: The issue allows a guest to perform SQL injection due to a sensitive SQL call in the SearchApiCsv::getProducts method. This can be exploited with a trivial HTTP call, allowi...

PT-2023-29928

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2023.8.4 and 2023.10.2 Description authentik is an open-source Identity Provider. When the default admin user has been deleted, it is potentially possible for an attacker to set the password of the default admin use...

PT-2023-6636 · Google +3 · Google Chrome +3

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 119.0.6045.105 Description: The issue is related to incorrect security UI in the Downloads component of Google Chrome, which can be exploited by a remote attacker to perform domain spoofing via a crafted domain...

PT-2023-10311 · Jhipster · Generator-Jhipster

Name of the Vulnerable Software and Affected Versions: JHipster generator-jhipster versions prior to 2.23.0 Description: The issue allows for a timing attack against the validateToken function due to a string comparison that stops at the first different character. This enables attackers to guess...

PT-2023-29955 · WordPress · Zotpress

Name of the Vulnerable Software and Affected Versions: Katie Seaborn Zotpress plugin versions prior to 7.3.4 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially...

PT-2023-32403 · Pkp-Lib · Pkp-Lib

Name of the Vulnerable Software and Affected Versions: pkp/pkp-lib versions prior to 3.4.0-4 Description: The issue is related to Cross-site Scripting XSS - Stored, which affects the GitHub repository pkp/pkp-lib. Recommendations: For versions prior to 3.4.0-4, update to version 3.4.0-4 or later ...

PT-2023-23234 · Wpforms +1 · Wpforms +2

Name of the Vulnerable Software and Affected Versions: Database for Contact Form 7, WPforms, Elementor forms versions 1.3.0 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQ...

PT-2023-31866 · WordPress · Bellows Accordion Menu

Name of the Vulnerable Software and Affected Versions: The Bellows Accordion Menu plugin for WordPress versions up to, and including, 1.4.2 Description: The issue is related to Stored Cross-Site Scripting via shortcodes due to insufficient input sanitization and output escaping on user-supplied...

PT-2023-31975 · WordPress · Grid Plus

Name of the Vulnerable Software and Affected Versions: The Grid Plus plugin for WordPress versions up to, and including, 1.3.2 Description: The issue allows unauthorized modification of data and loss of data due to a missing capability check on the grid plus save layout callback and grid plus...

PT-2023-29950 · WordPress · Wpdiscuz

Name of the Vulnerable Software and Affected Versions: wpDiscuz versions 7.6.10 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For versions 7.6.10 and earlier,...

PT-2023-13518 · Lenovo · Lenovo Vantage Hardwarescan Plugin

Name of the Vulnerable Software and Affected Versions: Lenovo Vantage HardwareScan Plugin versions 1.3.0.5 and earlier Description: A denial of service issue was reported that could allow a local attacker to delete contents of an arbitrary directory under certain conditions. Recommendations: For...

PT-2023-29898 · Triberr · Triberr

Name of the Vulnerable Software and Affected Versions: Triberr plugin versions = 4.1.1 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects the Triberr plugin. This vulnerability requires authentication with admin+ privileges. Recommendations: For...

PT-2023-28148 · Unknown · Flyteadmin

Name of the Vulnerable Software and Affected Versions: FlyteAdmin versions prior to 1.1.124 Description: The issue concerns a SQL vulnerability in list endpoints on FlyteAdmin, where a malicious user can send a REST request with custom SQL statements as list filters. This requires the attacker to...

PT-2023-29843 · Lionscripts.Com · Lionscripts.Com Webmaster Tools

Name of the Vulnerable Software and Affected Versions: LionScripts.Com Webmaster Tools plugin versions = 2.0 Description: The issue is related to an Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with administrative access can inject malicious...

PT-2023-23985 · Alkaweb · Alkaweb Eonet Manual User Approve Plugin

Name of the Vulnerable Software and Affected Versions: Alkaweb Eonet Manual User Approve plugin versions = 2.1.3 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects the Alkaweb Eonet Manual User Approve plugin. This vulnerability requires authenticati...

PT-2023-30234 · Ispconfig · Ispconfig

Name of the Vulnerable Software and Affected Versions: ISPConfig versions prior to 3.2.11p1 Description: An issue was discovered that allows PHP code injection in the language file editor by an admin if admin allow langedit is enabled. This issue can be exploited to achieve PHP code injection...