Page Builder by AZEXO <= 1.27.133 - Cross-Site Request Forgery (CSRF) to Stored XSS

The plugin does not protect the ajax actions azhsave against CSRF attacks, allowing an unauthenticated attacker to modify posts by tricking a logged in user with rights to edit the post to submit a crafted request. Furthermore if the targeted user has a role of editor or above, arbitrary web...

New treasury rate should not affect existing loan

Lines of code Vulnerability details Impact In the protocol, lenders have to pay a small treasury fee when they claim their interest. The contract owner can change this treasuryRate at any time using the function setTreasuryRate. // @audit treasury rate should not affect existing loan function...

Page Builder by AZEXO <= 1.27.133 - Subscriber+ Post Creation

The plugin does not properly authorize post creation in it's azhaddpost ajax action, allowing any authenticated users to create posts with any post type and status, even when that should not have this capability...

CISA Known Exploited Vulnerability Catalog May 2023

For a detailed CISAs KEV Catalog, download the pdf file here Summary The Known Exploited Vulnerability KEV catalog, maintained by CISA, is the authoritative source of vulnerabilities that have been exploited in the wild. To be included in the catalog, a vulnerability must meet three criteria: hav...

CVE-2022-47029

An issue was found in Action Launcher v50.5 allows an attacker to escalate privilege via modification of the intent string to function update...

CVE-2022-47029

An issue was found in Action Launcher v50.5 allows an attacker to escalate privilege via modification of the intent string to function update...

CVE-2022-47028

An issue discovered in Action Launcher for Android v50.5 allows an attacker to cause a denial of service via arbitary data injection to function insert...

CVE-2022-47028

An issue discovered in Action Launcher for Android v50.5 allows an attacker to cause a denial of service via arbitary data injection to function insert...

CVE-2022-47028

An issue discovered in Action Launcher for Android v50.5 allows an attacker to cause a denial of service via arbitary data injection to function insert...

CVE-2022-47029

An issue was found in Action Launcher v50.5 allows an attacker to escalate privilege via modification of the intent string to function update...

Code injection

An issue discovered in Action Launcher for Android v50.5 allows an attacker to cause a denial of service via arbitary data injection to function insert...

Information disclosure

An issue was found in Action Launcher v50.5 allows an attacker to escalate privilege via modification of the intent string to function update...

CVE-2023-1938

The WP Fastest Cache WordPress plugin before 1.1.5 does not have CSRF check in an AJAX action, and does not validate user input before using it in the wpremoteget function, leading to a Blind SSRF issue...

CVE-2023-2117

The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitize the dir parameter when handling the getsubdirs ajax action, allowing a high privileged users such as admins to inspect names of files and directories outside of the sites root...

CVE-2023-1938

The WP Fastest Cache WordPress plugin before 1.1.5 does not have CSRF check in an AJAX action, and does not validate user input before using it in the wpremoteget function, leading to a Blind SSRF issue...

CVE-2023-2117

The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitize the dir parameter when handling the getsubdirs ajax action, allowing a high privileged users such as admins to inspect names of files and directories outside of the sites root...

CVE-2023-1938 WP Fatest Cache < 1.1.5 - Blind SSRF via CSRF

The WP Fastest Cache WordPress plugin before 1.1.5 does not have CSRF check in an AJAX action, and does not validate user input before using it in the wpremoteget function, leading to a Blind SSRF issue...

CVE-2023-1938 WP Fatest Cache < 1.1.5 - Blind SSRF via CSRF

The WP Fastest Cache WordPress plugin before 1.1.5 does not have CSRF check in an AJAX action, and does not validate user input before using it in the wpremoteget function, leading to a Blind SSRF issue...

Action Launcher 注入漏洞

Action Launcher is a powerful launcher from Action Launcher, Inc. A security vulnerability exists in Action Launcher version v50.5 that originates from allowing an attacker to cause a denial of service via arbitrary data injection function insertion...

PT-2023-15137 · Unknown · Action Launcher

Name of the Vulnerable Software and Affected Versions: Action Launcher for Android version 50.5 Description: An issue in Action Launcher for Android allows an attacker to cause a denial of service via arbitrary data injection to the insert function. Recommendations: For Action Launcher for Androi...