Moodle 安全漏洞

Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. A security vulnerability exists in Moodle that stems from allowing a user to control the path of old files to be created in the TinyMCE...

GHSA-8595-6653-96P2 phpMyFAQ vulnerable to Stored Cross-site Scripting

phpMyFAQ prior to version 3.1.13 has a stored cross site scripting vulnerability in name field in add question module. This allows an attacker to steal user cookies...

phpMyFAQ vulnerable to Stored Cross-site Scripting

phpMyFAQ prior to version 3.1.13 has a stored cross site scripting vulnerability in name field in add question module. This allows an attacker to steal user cookies...

PT-2023-19508 · Phpmyfaq · Phpmyfaq

Name of the Vulnerable Software and Affected Versions: phpMyFAQ versions prior to 3.1.13 Description: The issue is related to a stored Cross-site Scripting XSS vulnerability. This vulnerability allows an attacker to steal user cookies by exploiting the name field in the add question module...

CVE-2023-2421

A vulnerability classified as problematic has been found in Control iD RHiD 23.3.19.0. Affected is an unknown function of the file /v2//add/department. The manipulation of the argument Name leads to cross site scripting. It is possible to launch the attack remotely. VDB-227718 is the identifier...

SQL Injection in expenses/ajax.php & loan-management/ajax.php

Description An administrator user can use different operations and parameters to execute SQL queries. -employeeId on operation addMonthlySalary in expenses/ajax.php. -returnAdvancePaymentEmployee on operation returnAdvancePaymentSubmit, in expenses/ajax.php. -id on operation editLoan in...

PT-2023-35795 · Libssh2 · Libssh2

Name of the Vulnerable Software and Affected Versions: libssh2 affected versions not specified Description: The issue is related to a heap-buffer-overflow read. Technical details about the crash include the packet authagent open function and the libssh2 packet add function. The libssh2 ntohu32...

CVE-2023-1129

The WP FEvents Book WordPress plugin through 0.46 does not ensures that bookings to be updated belong to the user making the request, allowing any authenticated user to book, add notes, or cancel booking on behalf of other users...

Stored XSS in the module named "Dashboard"

Description I tested the demo site you provided. I see that there is an XSS vulnerability. I hope you can check and provide a fix as soon as possible. Proof of Concept link video PoC https://drive.google.com/file/d/19lzyLY20fn0WdgRxsIrIRSfkrq36j7s5/view?usp=sharing Steps 1.Login as administrator...

PT-2023-22444 · Unknown · Bang Resto

Name of the Vulnerable Software and Affected Versions: Bang Resto version 1.0 Description: The issue is related to a stored cross-site scripting XSS vulnerability. This vulnerability can be exploited via the itemName parameter in the admin/menu.php Add New Menu function. Recommendations: For Bang...

CVE-2022-45080

Cross-Site Request Forgery CSRF vulnerability in KrishaWeb Add Multiple Marker plugin = 1.2 versions...

CVE-2022-45080

Cross-Site Request Forgery CSRF vulnerability in KrishaWeb Add Multiple Marker plugin = 1.2 versions...

CVE-2022-45080

CVE-2022-45080 is a CSRF vulnerability affecting the WordPress Add Multiple Marker plugin (versions <= 1.2). The vulnerability is described across multiple sources as a Cross-Site Request Forgery flaw in KrishaWeb Add Multiple Marker plugin

WordPress Plugin Add Multiple Marker 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...

PT-2023-14591 · Krishaweb · Krishaweb Add Multiple Marker Plugin

Name of the Vulnerable Software and Affected Versions: KrishaWeb Add Multiple Marker plugin versions = 1.2 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a we...

CVE-2023-29909

H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the AddWlanMacList interface at /goform/aspForm...

CVE-2023-29911

H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the AddMacList interface at /goform/aspForm...

Unable to indicate negative amount in captial

Description Unable to indicate negative amount in captial Proof of Concept 1 Login application 2 Go to Capital Add Capital Fill in amount -999,999,999.00 3 The website indicate an negative amount...

Campcodes Advanced Online Voting System SQL Injection Vulnerability (CNVD-2023-29415)

Campcodes Advanced Online Voting System is an online voting system. The Campcodes Advanced Online Voting System v1.0 is vulnerable to SQL injection. The vulnerability stems from the lack of validation of external input SQL statements in the parameter description of the file /admin/positionsadd.ph...

CVE-2023-2050

A vulnerability was found in Campcodes Advanced Online Voting System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/positionsadd.php. The manipulation of the argument description leads to sql injection. The attack may be initiated remotely. The...