PT-2023-12374 · Unknown · Openmage Lts

Name of the Vulnerable Software and Affected Versions: OpenMage LTS versions prior to 19.4.22 OpenMage LTS versions prior to 20.0.19 Description: The issue affects OpenMage LTS, an e-commerce platform. Magento admin users with access to the customer media could execute code on the server...

PHICOMM K2G A1 安全漏洞

The PHICOMM K2G A1 is a dual-band Gigabit wireless WiFi router from PHICOMM China. A security vulnerability exists in Phicomm K2 version v22.6.534.263, which stems from the fact that an attacker can discover the passwords of the root and admin users stored in the plaintext...

PT-2023-16334 · Unknown · Sourcecodester Online Tours & Travels Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Tours & Travels Management System version 1.0 Description: A critical issue has been found in the system, affecting an unknown part of the file admin/abc.php. The manipulation of the id argument leads to SQL injection. I...

CVE-2023-23614 Improper session handling of "Remember me for 7 days" functionality

Pi-hole®'s Web interface based off of AdminLTE provides a central location to manage your Pi-hole. Versions 4.0 and above, prior to 5.18.3 are vulnerable to Insufficient Session Expiration. Improper use of admin WEBPASSWORD hash as "Remember me for 7 days" cookie value makes it possible for an...

Jenkins Plugin OpenID 安全漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

Jenkins Plugin Keycloak Authentication 授权问题漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

Jenkins Plugin Azure AD 代码问题漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

PT-2023-5523 · Nozomi · Nozomi Central Management Console +1

Name of the Vulnerable Software and Affected Versions: Nozomi Guardian and Nozomi Central Management Console CMC affected versions not specified Description: An authenticated attacker with administrative access to the web management interface can inject malicious JavaScript code inside the...

CVE-2023-0446

The My YouTube Channel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 3.0.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2022-4753

The Print-O-Matic WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privileg...

CVE-2022-4693

The User Verification WordPress plugin before 1.0.94 was affected by an Auth Bypass security vulnerability. To bypass authentication, we only need to know the user’s username. Depending on whose username we know, which can be easily queried because it is usually public data, we may even be given ...

CVE-2022-4307 Pardakht Delkhah < 2.9.3 - Unauthenticated Stored XSS

The پلاگین پرداخت دلخواه WordPress plugin before 2.9.3 does not sanitise and escape some parameters, allowing unauthenticated attackers to send a request with XSS payloads, which will be triggered when a high privilege users such as admin visits a page from the plugin...

PT-2023-15105 · WordPress · User Verification Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: User Verification WordPress plugin versions prior to 1.0.94 Description: The issue allows for an authentication bypass, requiring only the knowledge of a user's username to exploit. Since usernames are often publicly available, an attacker ma...

Design/Logic Flaw

In Yeastar N412 and N824 Configuration Panel 42.x and 45.x, an unauthenticated attacker can create backup file and download it, revealing admin hash, allowing, once cracked, to login inside the Configuration Panel, otherwise, replacing the hash in the archive and restoring it on the device which...

CVE-2022-40697 WordPress 3com – Asesor de Cookies para normativa española Plugin <= 3.4.3 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in 3com – Asesor de Cookies para normativa española plugin = 3.4.3 versions...

CVE-2022-34457

Dell command configuration, version 4.8 and prior, contains improper folder permission when installed not to default path but to non-secured path which leads to privilege escalation. This is critical severity vulnerability as it allows non-admin to modify the files inside installed directory and...

CVE-2022-4547

The Conditional Payment Methods for WooCommerce WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin|users with a role as low as admin...

PT-2023-18727 · Tiki · Tiki

Name of the Vulnerable Software and Affected Versions: Tiki versions prior to 24.2 Description: The issue allows PHP Object Injection in lib/importer/tikiimporter blog wordpress.php by an admin due to an unserialize call. Recommendations: For versions prior to 24.2, update to version 24.2 or late...

PT-2023-16150 · WordPress · Launchpad

Name of the Vulnerable Software and Affected Versions: Launchpad plugin for WordPress versions up to, and including, 1.0.13 Description: The issue is related to Stored Cross-Site Scripting via several settings parameters due to insufficient input sanitization and output escaping. This allows...

PT-2023-14811 · Unknown · Hospital Management System

Name of the Vulnerable Software and Affected Versions: Hospital Management System version 1.0 Description: The issue allows attackers to gain administrator privileges without the need for a password through SQL Injection. Recommendations: For Hospital Management System version 1.0, consider...