PT-2023-32758 · Dedebiz · Dedebiz

Name of the Vulnerable Software and Affected Versions: DedeBIZ version 6.2 Description: A critical issue affects the processing of the file /src/admin/content batchup action.php. The manipulation of the endid argument leads to SQL injection. The attack may be initiated remotely. Recommendations:...

PT-2023-31183 · Rockoa · Rockoa

Name of the Vulnerable Software and Affected Versions: Rockoa versions prior to 2.3.3 Description: The issue is related to SQL Injection. The problem exists in the indexAction method in reimpAction.php. Recommendations: For versions prior to 2.3.3, update to version 2.3.3 or later to resolve the...

DedeBIZ SQL Injection Vulnerability

DedeBIZ is a content management system from China Muyun Intelligent Technology DedeBIZ company. DedeBIZ 6.2 version exists SQL injection vulnerability, the vulnerability stems from the file /src/admin/contentbatchupaction.php SQL injection vulnerability...

CVE-2023-6727

Mattermost fails to perform correct authorization checks when creating a playbook action, allowing users without access to the playbook to create playbook actions. If the playbook action created is to post a message in a channel based on specific keywords in a post, some playbook information, lik...

CVE-2023-6727 Leak Inaccessible Playbook Information via Channel Action IDOR

Mattermost fails to perform correct authorization checks when creating a playbook action, allowing users without access to the playbook to create playbook actions. If the playbook action created is to post a message in a channel based on specific keywords in a post, some playbook information, lik...

CVE-2023-6727 Leak Inaccessible Playbook Information via Channel Action IDOR

Mattermost fails to perform correct authorization checks when creating a playbook action, allowing users without access to the playbook to create playbook actions. If the playbook action created is to post a message in a channel based on specific keywords in a post, some playbook information, lik...

CVE-2023-6727 Leak Inaccessible Playbook Information via Channel Action IDOR

Mattermost fails to perform correct authorization checks when creating a playbook action, allowing users without access to the playbook to create playbook actions. If the playbook action created is to post a message in a channel based on specific keywords in a post, some playbook information, lik...

CVE-2023-41118

An issue was discovered in EnterpriseDB Postgres Advanced Server EPAS before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. It may allow an authenticated user to bypass authorization requirements and access underlying implementation functions. Wh...

Social Media Feather < 2.1.4 - Subscriber+ Unauthorised Action

Description The plugin does not have authorisation in a function, allowing any authenticated users, such as subscriber to call it...

PT-2023-7642 · Microsoft · Windows Mshtml Platform +4

Name of the Vulnerable Software and Affected Versions: Windows MSHTML Platform affected versions not specified Description: The vulnerability in the Windows MSHTML Platform is related to insufficient input validation, allowing remote attackers to execute arbitrary code by sending a specially...

CVE-2023-6035

The EazyDocs WordPress plugin before 2.3.4 does not properly sanitize and escape "data" parameter before using it in an SQL statement via an AJAX action, which could allow any authenticated users, such as subscribers, to perform SQL Injection attacks...

Sql injection

The EazyDocs WordPress plugin before 2.3.4 does not properly sanitize and escape "data" parameter before using it in an SQL statement via an AJAX action, which could allow any authenticated users, such as subscribers, to perform SQL Injection attacks...

Playbook: Your First 100 Days as a vCISO - 5 Steps to Success

In an increasingly digital world, no organization is spared from cyber threats. Yet, not every organization has the luxury of hiring a full-time, in-house CISO. This gap in cybersecurity leadership is where you, as a vCISO, come in. You are the person who will establish, develop, and solidify the...

PT-2023-32488 · WordPress · Eazydocs

Name of the Vulnerable Software and Affected Versions: EazyDocs WordPress plugin versions prior to 2.3.4 Description: The issue arises from the improper sanitization and escaping of the data parameter before its use in an SQL statement via an AJAX action. This could allow any authenticated users ...

Shortcoder < 6.3.1 - Subscriber+ Unauthorised AJAX Call

Description The plugin does not have proper authorisation in an AJAX action, allowing any authenticated users, such as subscriber to call it...

Smart Forms < 2.6.85 - Subscriber+ Arbitrary Options Update

Description The plugin does not have authorisation in an AJAX action hooked to smartformssavesettings, and does not ensure that the option to be updated belong to the plugin. As a result, any authenticated users, such as subscriber could update arbitrary options such as defaultrole and...

WPPerformanceTester <= 2.0.0 - Cross-Site Request Forgery

Description The WPPerformanceTester plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.0. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unauthorize...

Custom Login < 4.1.1 - Subscriber+ Unauthorised Action

Description The plugin does not have proper authorisation in an unknown function, allowing any authenticated attackers, such as subscribers, to perform an unauthorized action...

Multi Currency For WooCommerce < 1.5.6 - Cross-Site Request Forgery

Description The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a site administrator into...

Awesome Support < 6.1.8 - Missing Authorization

Description The plugin is vulnerable to unauthorized access due to a missing capability check on an unknown function, allowing unauthenticated attackers to perform an unauthorized action...