CVE-2023-50030

In the module "Jms Setting" jmssetting from Joommasters for PrestaShop, a guest can perform SQL injection in versions = 1.1.0. The method JmsSetting::getSecondImgs has a sensitive SQL call that can be executed with a trivial http call and exploited to forge a blind SQL injection...

Exploit for Weak Password Recovery Mechanism for Forgotten Password in Gitlab

CVE-2023-7028 ⚠️ This exploit is for defensive purposes and s...

WordPress WP Recipe Maker Plugin <= 9.1.0 is vulnerable to Cross Site Scripting (XSS)

Software WP Recipe Maker Type Plugin Vulnerable versions = 9.1.0 Fixed in 9.1.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6958 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 88ec62474017 Credits wesley wcraft Required...

WordPress WP Recipe Maker Plugin <= 9.1.0 is vulnerable to Path Traversal

Software WP Recipe Maker Type Plugin Vulnerable versions = 9.1.0 Fixed in 9.1.1 OWASP Top 10 A1: Broken Access Control Classification Path Traversal CVE CVE-2024-0380 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 156eb3d878da Credits wesley wcraft Required privilege...

Novel-Plus SQL Injection Vulnerability

Novel-Plus is an online social reading and writing platform from Novel-Plus, Inc. An SQL injection vulnerability exists in Novel-Plus version 4.3.0-RC1, which stems from the parameter sort in the file /novel/bookSetting/list that can lead to SQL injection...

Exploit for Improper Input Validation in Kubernetes Ingress-Nginx

CVE-2023-5044 Ingress Nginx Exploit Proof-Of-Concept This is...

WordPress BP Profile Search Plugin <= 5.5 is vulnerable to Cross Site Scripting (XSS)

Software BP Profile Search Type Plugin Vulnerable versions = 5.5 Fixed in 5.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-22293 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 5fc1725a4a59 Credits Le Ngoc Anh Required privilege...

WordPress Burst Statistics Plugin <= 1.5.3 is vulnerable to SQL Injection

Software Burst Statistics Type Plugin Vulnerable versions = 1.5.3 Fixed in 1.5.4 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-0405 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 5b21f7530708 Credits Ivan Spiridonov xbz0n Required privilege Editor...

WordPress Contact Form builder with drag & drop - Kali Forms Plugin <= 2.3.36 is vulnerable to Insecure Direct Object References (IDOR)

Software Contact Form builder with drag & drop - Kali Forms Type Plugin Vulnerable versions = 2.3.36 Fixed in 2.3.37 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2024-22305 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership...

CVE-2023-22526

This High severity RCE Remote Code Execution vulnerability was introduced in version 7.19.0 of Confluence Data Center. This RCE Remote Code Execution vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high...

PT-2024-1245 · Citrix · Citrix Storefront

Name of the Vulnerable Software and Affected Versions: Citrix StoreFront affected versions not specified Description: The issue exists due to inadequate protection of the web page structure in Citrix StoreFront, allowing a remote attacker to conduct a cross-site scripting XSS attack...

WordPress Product Import Export for WooCommerce Plugin <= 2.3.7 is vulnerable to Arbitrary File Upload

Software Product Import Export for WooCommerce Type Plugin Vulnerable versions = 2.3.7 Fixed in 2.3.8 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-22152 Patch priority Medium CVSS severity Medium 8 Developer Claim ownership PSID 7b62ca7055ba Credits Dateoljo of BoB...

WordPress Import and export users and customers Plugin <= 1.24.6 is vulnerable to Broken Access Control

Software Import and export users and customers Type Plugin Vulnerable versions = 1.24.6 Fixed in 1.24.7 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-22151 Patch priority Low CVSS severity Low 5.3 Developer Codection PSID 127865efe8c3 Credits emad Requir...

PT-2024-14370 · Totolink · Totolink X6000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X6000R version 9.4.0cu.852 B20230719 Description: An issue in the TOTOLINK X6000R allows attackers to run arbitrary code via the sub 410118 function of the shttpd program. Recommendations: For TOTOLINK X6000R version 9.4.0cu.852...

WordPress HD Quiz Plugin <= 1.8.11 is vulnerable to Cross Site Scripting (XSS)

Software HD Quiz Type Plugin Vulnerable versions = 1.8.11 Fixed in 1.8.12 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-22161 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID b20e08ed859a Credits MyungJu Kim Required privilege Administrator...

WordPress Advanced Custom Fields PRO Plugin < 6.2.5 is vulnerable to Cross Site Scripting (XSS)

Software Advanced Custom Fields PRO Type Plugin Vulnerable versions 6.2.5 Fixed in 6.2.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-6701 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 5c62a93a2661 Credits Francesco Carlucci Required...

WordPress Image Tag Manager Plugin <= 1.5 is vulnerable to Cross Site Scripting (XSS)

Software Image Tag Manager Type Plugin Vulnerable versions = 1.5 Fixed in N/A OWASP Top 10 A4: Insecure Design Classification Cross Site Scripting XSS CVE CVE-2024-22160 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 21a3315fa407 Credits Dimas Maulana Required...

WordPress WP SMS Plugin <= 6.5.1 is vulnerable to Cross Site Scripting (XSS)

Software WP SMS Type Plugin Vulnerable versions = 6.5.1 Fixed in 6.5.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID b81910d51fc0 Credits WordFence Required privilege Contributor...

PAX Technology A920 Injection Vulnerability

PAX Technology A920 is an Android mobile payment terminal from PAX Technology. The PAX Technology A920 suffers from a security vulnerability that originates from a version checking error, which can be exploited by an attacker to steer the loader to downgrade to a vulnerable version, leading to...

WordPress CformsII Plugin <= 15.0.6 is vulnerable to Cross Site Scripting (XSS)

Software CformsII Type Plugin Vulnerable versions = 15.0.6 Fixed in 15.0.7 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-22149 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 2aac355b9ab7 Credits emad Required privilege Unauthenticat...