6456 matches found
CVE-2023-34203
In Progress OpenEdge OEM OpenEdge Management and OEE OpenEdge Explorer before 12.7, a remote user who has any OEM or OEE role could perform a URL injection attack to change identity or role membership, e.g., escalate to admin. This affects OpenEdge LTS before 11.7.16, 12.x before 12.2.12, and...
CVE-2023-34170
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP Overnight Quick/Bulk Order Form for WooCommerce plugin = 3.5.7 versions...
CVE-2023-34170 WordPress Quick/Bulk Order Form for WooCommerce Plugin <= 3.5.7 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP Overnight Quick/Bulk Order Form for WooCommerce plugin = 3.5.7 versions...
CVE-2023-33323
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Repute InfoSystems ARMember plugin = 4.0.2 versions...
CVE-2023-28778
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in BestWebSoft Pagination plugin = 1.2.2 versions...
CVE-2023-28778
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in BestWebSoft Pagination plugin = 1.2.2 versions...
CVE-2023-28423
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Prism Tech Studios Modern Footnotes plugin = 1.4.15 versions...
PT-2023-24708 · WordPress · Wp Overnight Quick/Bulk Order Form For Woocommerce
Name of the Vulnerable Software and Affected Versions: WP Overnight Quick/Bulk Order Form for WooCommerce plugin versions = 3.5.7 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For WP...
PT-2023-21911 · Unknown · Vigilantor
Name of the Vulnerable Software and Affected Versions: Drew Phillips VigilanTor plugin versions prior to 1.3.11 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects users with admin+ authentication. This type of vulnerability allows an attacker to inje...
CVE-2023-27429
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Automattic - Jetpack CRM team Jetpack CRM plugin = 5.4.4 versions...
CVE-2023-2400
Improper deletion of resource in the user management feature in Devolutions Server 2023.1.8 and earlier allows an administrator to view users vaults of deleted users via database access...
CVE-2023-35854
Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session token for identity spoofing, thereby achieving the privileges of the domain controller administrator. NOTE: the vendor's perspective is that they have "found...
CVE-2023-35878
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Vadym K. Extra User Details plugin = 0.5 versions...
CVE-2023-3325
The CMS Commander plugin for WordPress is vulnerable to authorization bypass due to the use of an insufficiently unique cryptographic signature on the 'cmscaddsite' function in versions up to, and including, 2.287. This makes it possible for unauthenticated attackers to the plugin to change the...
Authorization
The CMS Commander plugin for WordPress is vulnerable to authorization bypass due to the use of an insufficiently unique cryptographic signature on the 'cmscaddsite' function in versions up to, and including, 2.287. This makes it possible for unauthenticated attackers to the plugin to change the...
WordPress Plugin CMS Commander 安全特征问题漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security signature issue...
PT-2023-11558 · Khodakhah · Nodcms
Name of the Vulnerable Software and Affected Versions: khodakhah NodCMS version 3.0 Description: The issue allows a remote attacker to execute arbitrary code and gain access to sensitive information via a crafted script to the address parameter. This can be done by an attacker with administrative...
CVE-2023-35779
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Seed Webs Seed Fonts plugin = 2.3.1 versions...
Sql injection
The Integration for Contact Form 7 and Zoho CRM, Bigin WordPress plugin before 1.2.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...