Information disclosure

The SolarWinds Network Configuration Manager was susceptible to the Exposure of Sensitive Information Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to obtain sensitive information...

PT-2023-7569 · Cisco · Cisco Identity Services Engine

Name of the Vulnerable Software and Affected Versions: Cisco Identity Services Engine ISE affected versions not specified Description: The issue is related to unlimited file upload of dangerous types. An attacker with valid Administrator credentials could exploit this by uploading a crafted file ...

CVE-2023-40681

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Groundhogg Inc. Groundhogg plugin = 2.7.11.10 versions...

CVE-2023-46210

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WebCource WC Captcha plugin = 1.4 versions...

PT-2023-27597 · WordPress · Groundhogg

Name of the Vulnerable Software and Affected Versions: Groundhogg plugin versions = 2.7.11.10 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin or higher privileges. Recommendations: For Groundhogg plugin versions =...

FOGProject Security Breach

FOGProject is a free open source network computer cloning and management solution. It can be used to deploy and manage any desktop operating system. A security vulnerability exists in FOGProject versions prior to 1.5.10.15, which stems from a lack of request cleanup in the logs, where malicious...

CVE-2023-46200

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Stephen Darlington, Wandle Software Limited Smart App Banner plugin = 1.1.3 versions...

CVE-2022-34833

An issue was discovered in VERMEG AgileReporter 21.3. An admin can enter an XSS payload in the Analysis component...

CVE-2023-46093

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in LionScripts.Com Webmaster Tools plugin = 2.0 versions...

CVE-2023-46192

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Internet Marketing Ninjas Internal Link Building plugin = 1.2.3 versions...

CVE-2023-46091

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Bala Krishna, Sergey Yakovlev Category SEO Meta Tags plugin = 2.5 versions...

PT-2023-13422 · Vermeg · Vermeg Agilereporter

Name of the Vulnerable Software and Affected Versions: VERMEG AgileReporter version 21.3 Description: An issue was discovered in the Analysis component, allowing an admin to enter an XSS payload. Recommendations: For VERMEG AgileReporter version 21.3, consider restricting access to the Analysis...

CVE-2023-46088

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Mammothology WP Full Stripe Free plugin = 1.6.1 versions...

CVE-2023-25032

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Print, PDF, Email by PrintFriendly plugin = 5.5.1 versions...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in I Thirteen Web Solution Easy Testimonial Slider and Form plugin = 1.0.18 versions...

The vulnerability of the microprogramming software of the Connectize G6 AC2100 router allows a hacker to gain administrator privileges.

The vulnerability of the Connectize G6 AC2100 router’s microprogramming software is related to weak password requirements. Exploiting this vulnerability can allow a remote attacker to gain administrator privileges...

PT-2023-29680 · Unknown · Wokamoto Simple Tweet

Name of the Vulnerable Software and Affected Versions: Wokamoto Simple Tweet plugin versions = 1.4.0.2 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability allows an attacker to inject maliciou...

PT-2023-29794 · Seacms · Seacms

Name of the Vulnerable Software and Affected Versions: SeaCMS version 12.9 Description: An issue in the software allows an attacker to execute arbitrary commands via the admin safe.php component. Recommendations: For SeaCMS version 12.9, consider disabling access to the admin safe.php component...

CVE-2023-44760

Multiple Cross Site Scripting XSS vulnerabilities in Concrete CMS v.9.2.1 allow an attacker to execute arbitrary code via a crafted script to the Header and Footer Tracking Codes of the SEO & Statistics. NOTE: the vendor disputes this because these header/footer changes can only be made by an...

Satellite/Foreman: Arbitrary code execution through yaml global parameters

An arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to execute arbitrary code on the underlying operating system by setting global parameters with a YAML payload...