WordPress Art Direction Plugin <= 0.2.4 is vulnerable to Cross Site Scripting (XSS)

Software Art Direction Type Plugin Vulnerable versions = 0.2.4 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-37983 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 4089f50ae9ad Credits Yuki Haruma Required...

PT-2023-26196 · Macstadium +1 · Jenkins Orka By Macstadium Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Orka by MacStadium Plugin versions 1.33 and earlier Description: A missing permission check in the Jenkins Orka by MacStadium Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using...

WordPress WooCommerce Product Stock Alert Plugin <= 2.0.1 is vulnerable to Sensitive Data Exposure

Software WooCommerce Product Stock Alert Type Plugin Vulnerable versions = 2.0.1 Fixed in 2.0.2 OWASP Top 10 A5: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2023-37972 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 90d3154cbc8c Credits Mika Requir...

WordPress All In One WP Security & Firewall Plugin 5.1.9 is vulnerable to Sensitive Data Exposure

Software All In One WP Security & Firewall Type Plugin Vulnerable versions 5.1.9 Fixed in 5.2.0 OWASP Top 10 A4: Insecure Design Classification Sensitive Data Exposure CVE N/A Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 68fc84a40ab7 Credits Unknown Required privilege...

WordPress Short URL Plugin < 1.6.5 is vulnerable to Cross Site Scripting (XSS)

Software Short URL Type Plugin Vulnerable versions 1.6.5 Fixed in 1.6.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-3130 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 9ca4df5fae13 Credits Bob Matyas Required privilege...

WordPress Post SMTP Plugin <= 2.5.7 is vulnerable to Cross Site Scripting (XSS)

Software Post SMTP Type Plugin Vulnerable versions = 2.5.7 Fixed in 2.5.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-3082 Patch priority Low CVSS severity Low 7.1 Developer WPExperts PSID c8d98d03e5dd Credits Alex Thomas Required privilege...

WordPress DirectoryPress Plugin <= 3.6.2 is vulnerable to Broken Access Control

Software DirectoryPress Type Plugin Vulnerable versions = 3.6.2 Fixed in 3.6.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-37967 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID f4392bc7ad6f Credits Abdi Pranata Required...

WordPress Mail Control Plugin <= 0.3.1 is vulnerable to Cross Site Scripting (XSS)

Software Mail Control Type Plugin Vulnerable versions = 0.3.1 Fixed in 0.3.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-3158 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 0eca928a8cff Credits Alex Thomas Required...

WordPress WPFunnels Plugin <= 2.7.15 is vulnerable to Insecure Direct Object References (IDOR)

Software WPFunnels Type Plugin Vulnerable versions = 2.7.15 Fixed in 2.7.16 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE N/A Patch priority Low CVSS severity Low 5.4 Developer WPFunnels Team PSID fefed9db57ed Credits Unknown Required privilege...

PT-2023-25418 · Tamronos · Tamronos

Name of the Vulnerable Software and Affected Versions: TamronOS versions up to 20230703 Description: A critical issue has been found, affecting an unknown part of the file "/api/ping". The manipulation of the host argument leads to os command injection, allowing remote attacks. The issue has been...

Tenda FH1203 缓冲区错误漏洞

Tenda FH1203 is a dual-band wireless router from China's Tenda, mainly used for home network coverage and enhancement. The Tenda FH1203 suffers from a stack buffer overflow vulnerability that originates from the deviceId parameter of the formSetClientState method failing to properly validate the...

WordPress Yet Another Stars Rating Plugin <= 3.3.8 is vulnerable to Race Condition

Software Yet Another Stars Rating Type Plugin Vulnerable versions = 3.3.8 Fixed in 3.3.9 OWASP Top 10 A5: Broken Access Control Classification Race Condition CVE CVE-2023-37867 Patch priority Low CVSS severity Low 3.7 Developer Claim ownership PSID 9a9795e352fc Credits Abdi Pranata Required...

WordPress WooCommerce GoCardless Gateway Plugin <= 2.5.6 is vulnerable to Insecure Direct Object References (IDOR)

Software WooCommerce GoCardless Gateway Type Plugin Vulnerable versions = 2.5.6 Fixed in 2.5.7 OWASP Top 10 A5: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2023-37871 Patch priority Low CVSS severity Low 8.2 Developer Claim ownership PSID 5a7891bcb8a5 Credi...

Exploit for Race Condition in Canonical Snapd

CVE-2021-44731-snap-confine-SUID Local Privilege Escalation Ex...

WordPress Image Social Feed Plugin Plugin <= 1.7.6 is vulnerable to Cross Site Scripting (XSS)

Software Image Social Feed Plugin Type Plugin Vulnerable versions = 1.7.6 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-24412 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID a2267f708209 Credits yuyudhn Required...

PT-2023-25214 · Thinutech · Thinucms

Name of the Vulnerable Software and Affected Versions: ThinuTech ThinuCMS version 1.5 Description: A vulnerability has been found in an unknown functionality of the file /author posts.php. The manipulation of the argument author with the input g6g12alert1o8sdm leads to cross site scripting. The...

CVE-2023-22365

An OS command injection vulnerability exists in the ysthirdparty checksystemuser functionality of Milesight UR32L v32.3.0.5. A specially crafted set of network packets can lead to command execution. An attacker can send a network request to trigger this vulnerability...

WordPress BadgeOS Plugin <= 3.7.1.6 is vulnerable to Cross Site Scripting (XSS)

Software BadgeOS Type Plugin Vulnerable versions = 3.7.1.6 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2171 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 965111d21cf9 Credits Alex Thomas Required privilege...

WordPress Secondary Title Plugin <= 2.0.9.1 is vulnerable to Cross Site Scripting (XSS)

Software Secondary Title Type Plugin Vulnerable versions = 2.0.9.1 Fixed in 2.1.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-28773 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 7e2f601fb066 Credits TaeEun Lee Required...

WordPress RSVPMarker Plugin < 10.5.5 is vulnerable to SQL Injection

Software RSVPMarker Type Plugin Vulnerable versions 10.5.5 Fixed in 10.5.5 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-29095 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 4d11f7569f33 Credits Rafi Priatna Kasbiantoro Required privilege...