PT-2023-22068 · WordPress · Woocommerce

Name of the Vulnerable Software and Affected Versions: WooCommerce plugin versions prior to 3.0.19 Description: A Stored Cross-Site Scripting XSS vulnerability exists, allowing authenticated administrators to inject malicious scripts. This issue affects the PI Websolution Order date, Order pickup...

The vulnerability of the GLPI system’s request and incident handling process, related to improper management of privileges, allows a perpetrator to escalate their privileges within the application.

The vulnerability of the GLPI application for handling requests and incidents is related to improper management of privileges. An authenticated user can change the email addresses of any other user in the application, including the administrator’s email address. Exploiting this vulnerability allo...

CVE-2023-34203

In Progress OpenEdge OEM OpenEdge Management and OEE OpenEdge Explorer before 12.7, a remote user who has any OEM or OEE role could perform a URL injection attack to change identity or role membership, e.g., escalate to admin. This affects OpenEdge LTS before 11.7.16, 12.x before 12.2.12, and...

CVE-2023-34203

In Progress OpenEdge OEM OpenEdge Management and OEE OpenEdge Explorer before 12.7, a remote user who has any OEM or OEE role could perform a URL injection attack to change identity or role membership, e.g., escalate to admin. This affects OpenEdge LTS before 11.7.16, 12.x before 12.2.12, and...

CVE-2023-34203

In Progress OpenEdge OEM OpenEdge Management and OEE OpenEdge Explorer before 12.7, a remote user who has any OEM or OEE role could perform a URL injection attack to change identity or role membership, e.g., escalate to admin. This affects OpenEdge LTS before 11.7.16, 12.x before 12.2.12, and...

CVE-2023-34170

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP Overnight Quick/Bulk Order Form for WooCommerce plugin = 3.5.7 versions...

CVE-2023-34170 WordPress Quick/Bulk Order Form for WooCommerce Plugin <= 3.5.7 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP Overnight Quick/Bulk Order Form for WooCommerce plugin = 3.5.7 versions...

CVE-2023-33323

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Repute InfoSystems ARMember plugin = 4.0.2 versions...

CVE-2023-28778

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in BestWebSoft Pagination plugin = 1.2.2 versions...

CVE-2023-28778

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in BestWebSoft Pagination plugin = 1.2.2 versions...

CVE-2023-28423

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Prism Tech Studios Modern Footnotes plugin = 1.4.15 versions...

PT-2023-24708 · WordPress · Wp Overnight Quick/Bulk Order Form For Woocommerce

Name of the Vulnerable Software and Affected Versions: WP Overnight Quick/Bulk Order Form for WooCommerce plugin versions = 3.5.7 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For WP...

PT-2023-21911 · Unknown · Vigilantor

Name of the Vulnerable Software and Affected Versions: Drew Phillips VigilanTor plugin versions prior to 1.3.11 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects users with admin+ authentication. This type of vulnerability allows an attacker to inje...

CVE-2023-27429

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Automattic - Jetpack CRM team Jetpack CRM plugin = 5.4.4 versions...

CVE-2023-2400

Improper deletion of resource in the user management feature in Devolutions Server 2023.1.8 and earlier allows an administrator to view users vaults of deleted users via database access...

CVE-2023-35854

Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session token for identity spoofing, thereby achieving the privileges of the domain controller administrator. NOTE: the vendor's perspective is that they have "found...

CVE-2023-35878

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Vadym K. Extra User Details plugin = 0.5 versions...

CVE-2023-3325

The CMS Commander plugin for WordPress is vulnerable to authorization bypass due to the use of an insufficiently unique cryptographic signature on the 'cmscaddsite' function in versions up to, and including, 2.287. This makes it possible for unauthenticated attackers to the plugin to change the...

Authorization

The CMS Commander plugin for WordPress is vulnerable to authorization bypass due to the use of an insufficiently unique cryptographic signature on the 'cmscaddsite' function in versions up to, and including, 2.287. This makes it possible for unauthenticated attackers to the plugin to change the...

PT-2023-11558 · Khodakhah · Nodcms

Name of the Vulnerable Software and Affected Versions: khodakhah NodCMS version 3.0 Description: The issue allows a remote attacker to execute arbitrary code and gain access to sensitive information via a crafted script to the address parameter. This can be done by an attacker with administrative...