CVE-2022-34449: Use of Hard-coded Credentials

PowerPath Management Appliance with versions 3.3 & 3.2 contains a Hardcoded Cryptographic Keys vulnerability. Authenticated admin users can exploit the issue that leads to view and modifying sensitive information stored in the application...

jenkins-plugin/pipeline-stage-view: CSRF protection for any URL can be bypassed in Pipeline: Stage View Plugin

A Cross-site request forgery CSRF vulnerability was found in a Jenkins plugin. This issue may allow an authenticated attacker to access Jenkins builds, bypassing CSRF protections...

Introducing Enterprise TruRisk Management from Qualys

Since the release of Qualys VMDR 2.0 with TruRisk last year, our customers have quickly adopted it to perform cyber risk assessments across the entire enterprise. With detail-rich cyber risk visualization, customers can now pinpoint the areas of their business exposed to elevated levels of cyber...

CVE-2023-0711

The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajaxsavestate function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this...

PT-2023-16468 · WordPress · Wicked Folders

Name of the Vulnerable Software and Affected Versions: Wicked Folders plugin for WordPress versions up to, and including, 2.18.16 Description: The issue is related to a missing capability check on the ajax save state function, allowing authenticated attackers with subscriber-level permissions and...

CVE-2023-0711: Missing Authorization

The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajaxsavestate function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this...

PT-2023-2055

Name of the Vulnerable Software and Affected Versions Grafana versions 7.0 through 8.5.20 Grafana versions 9.2.0 through 9.2.12 Grafana versions 9.3.0 through 9.3.7 Description Grafana has a stored XSS vulnerability in the trace view visualization. The vulnerability is possible due to the value o...

Cross site scripting

The Page View Count WordPress plugin before 2.6.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-0095 Page View Count < 2.6.1 - Contributor+ Stored XSS

The Page View Count WordPress plugin before 2.6.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-0095

The CVE-2023-0095 entry concerns the WordPress plugin Page View Count (before 2.6.1). The issue is that the plugin does not validate and escape certain block options when the Gutenberg block is embedded, enabling Stored XSS for users with the Contributor role or higher. Affects Page View Count

CVE-2023-24197

Online Food Ordering System v2 was discovered to contain a SQL injection vulnerability via the id parameter at vieworder.php...

CVE-2023-24197

Online Food Ordering System v2 was discovered to contain a SQL injection vulnerability via the id parameter at vieworder.php...

PT-2023-19471 · Unknown · Online Food Ordering System

Name of the Vulnerable Software and Affected Versions: Online Food Ordering System version v2 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "view order.php" endpoint. Recommendations: For Online Food Ordering...

WordPress Plugin Page View Count: Cross-site Script Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

CVE-2023-0095: Undefined Security Weakness

The Page View Count WordPress plugin before 2.6.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

PT-2023-16009

Name of the Vulnerable Software and Affected Versions Page View Count WordPress plugin versions prior to 2.6.1 Description The issue allows users with the contributor role and above to perform Stored Cross-Site Scripting attacks due to the plugin's failure to validate and escape some of its block...

Online Food Ordering System Cross-Site Script Vulnerabilities

Online Food Ordering System is an online food ordering system. An SQL injection vulnerability exists in Online Food Ordering System, which stems from a lack of validation of externally entered SQL statements in the id parameter of the vieworder.php page. An attacker could use this vulnerability t...

CVE-2023-0673

A vulnerability classified as critical was found in SourceCodester Online Eyewear Shop 1.0. Affected by this vulnerability is an unknown functionality of the file oews/?p=products/viewproduct.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The...

PT-2023-16443 · Unknown · Sourcecodester Online Eyewear Shop

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Eyewear Shop version 1.0 Description: A critical vulnerability was found in the software, affecting an unknown functionality of the file oews/products/view product.php. The manipulation of the id argument leads to SQL...

Online Eyewear Shop SQL Injection Vulnerability

Online Eyewear Shop is an online eyewear store by Carlo Montero, a personal developer. A SQL injection vulnerability exists in Online Eyewear Shop version 1.0 due to an unknown function in the file oews/products/viewproduct.php, which can be used for SQL injection via the parameters name/pwd...