Sql injection

The Bestbooks WordPress plugin through 2.6.3 does not sanitise and escape some parameters before using them in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users...

Sql injection

The KiviCare WordPress plugin before 2.3.9 does not sanitise and escape some parameters before using them in SQL statements via the ajaxpost AJAX action with the getdoctordetails route, leading to SQL Injections exploitable by unauthenticated users...

CVE-2022-1724 Simple Membership < 4.1.1 - Reflected Cross-Site Scripting

The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting them back in AJAX actions, leading to Reflected Cross-Site Scripting...

CVE-2022-0885

Affected software/variant : WordPress Member Hero plugin versions 1.0.0–1.0.9. Vulnerability : unauthenticated remote code execution via an AJAX parameter; plugin lacks authorization checks and does not validate the parameter, enabling calls to arbitrary PHP functions with no arguments. Impact : ...

CVE-2022-0827

WordPress Best Books plugin (versions up to 2.6.3) contains an SQL injection due to insufficient sanitization/escaping of parameters in an Ajax action. The vulnerability affects the plugin's handling of user-supplied data in SQL statements, enabling unauthenticated attackers to potentially read o...

CVE-2022-1822 Zephyr Project Manager <= 3.2.40 - Reflected Cross-Site Scripting

The Zephyr Project Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘project’ parameter in versions up to, and including, 3.2.40 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2021-37404

CVE-2021-37404 describes a potential heap buffer overflow in Apache Hadoop’s libhdfs native code. Opening a file path supplied by a user without proper validation may lead to a denial of service or arbitrary code execution. The description specifies vulnerable software and versions and provides f...

MAL-2022-1667 Malicious code in brave-bitgo-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cc083f0135dbe25e14931c86c5bb99d26642341eca8c6ac96803a1fff4cec2ee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2022-3505 · Elementor · Elementor Website Builder

Name of the Vulnerable Software and Affected Versions: Elementor Website Builder plugin versions prior to 3.5.6 Description: The issue is related to insufficient protection of the webpage structure, allowing a remote attacker to perform cross-site scripting. This is a DOM-based Reflected Cross-Si...

Security Bulletin: A vulnerability (CVE-2021-39028) in WebSphere Application Server Liberty affects IBM TXSeries for Multiplatforms

Summary WebSphere Application Server Liberty is used by IBM TXSeries for Multiplatforms to provide a web based administration console and to provide web services support. The fix removes vulnerability CVE-2021-39038 that allows a remote attacker to hijack the clicking action of the victim...

MAL-2022-412 Malicious code in @manomano-toolbox/async-exports (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ed6043d62007fd2c0e9cbb7d2c4c3f699d6f97ae27a7f8cc5744c19e9128c6c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1492 Malicious code in bebekair (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 85f7bbcbf226b61f0938eddc89d049cfb4dfed9c1e0d18bd9566e68eb57d2d90 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EGavilan Media User-Registration-and-Login-System-With-Admin-Panel SQL Injection Vulnerability

EGavilan Media User-Registration-and-Login-System-With-Admin-Panel is a user registration and login system with an administrative panel from EGavilan Media. EGavilan Media User-Registration -and-Login-System-With-Admin-Panel version 1.0 contains a SQL injection vulnerability, which stems from...

CVE-2022-1709

The Throws SPAM Away WordPress plugin before 3.3.1 does not have CSRF checks in place when deleting comments either all, spam, or pending, allowing attackers to make a logged in admin delete comments via a CSRF attack...

Cross site request forgery (csrf)

The Discy WordPress theme before 5.2 does not check for CSRF tokens in the AJAX action discyresetoptions, allowing an attacker to trick an admin into resetting the site settings back to defaults...

Path traversal

The User Meta WordPress plugin before 2.4.4 does not validate the filepath parameter of its umshowuploadedfile AJAX action, which could allow low privileged users such as subscriber to enumerate the local files on the web server via path traversal payloads...

Sql injection

The amtyThumb WordPress plugin through 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement via its shortcode, leading to an SQL injection and is exploitable by any authenticated user and not just Author+ like the original advisory mention due to the fact that they ca...

MAL-2022-5965 Malicious code in scilla (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb59474865c382bf4153fdb43653e3e82ded140b0d1abd2db8a26d5c087b8af8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4735 Malicious code in multisig (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4eb9c4b4228a3a5f5b0a57247fb0920a79451a4f5b183a7568412f2d8be3a61b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7389 Malicious code in zilliqa-exchange-tutorial (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware abfd66f13f5f9c577c71376fac31dab474c4661aa755ac57e48cff489861cbb4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...