CVE-2023-25792

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in XiaoMac WP Open Social plugin = 5.0 versions...

CVE-2023-25787 WordPress WP资源下载管理 Plugin <= 1.3.9 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Wbolt team WP资源下载管理 plugin = 1.3.9 versions...

Hackers Exploiting 5-year-old Unpatched Vulnerability in TBK DVR Devices

Threat actors are actively exploiting an unpatched five-year-old flaw impacting TBK digital video recording DVR devices, according to an advisory issued by Fortinet FortiGuard Labs. The vulnerability in question is CVE-2018-9995 CVSS score: 9.8, a critical authentication bypass issue that could b...

PT-2023-10448 · Cyberark · Cyberark Viewfinity

Name of the Vulnerable Software and Affected Versions: CyberArk Viewfinity versions 5.5.10.95 through 6.1.1.219 CyberArk Viewfinity version 6.x before 6.1.1.220 Description: A low privilege user can escalate to an administrative user via a bug within the "add printer" option. Recommendations: For...

PT-2023-15077 · WordPress · Wp Table Builder

Name of the Vulnerable Software and Affected Versions: WP Table Builder plugin versions prior to 1.4.7 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects users with admin+ authentication. This allows for malicious script execution. Recommendations: F...

CVE-2023-1669

The SEOPress WordPress plugin before 6.5.0.3 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present...

CVE-2023-30603

Hitron Technologies CODA-5310 Telnet function with the default account and password, and there is no warning or prompt to ask users to change the default password and account. An unauthenticated remote attackers can exploit this vulnerability to obtain the administrator’s privilege, resulting in...

PT-2023-22357 · Tenda · Tenda N301

Name of the Vulnerable Software and Affected Versions: Tenda N301 version 6.0, Firmware version 12.02.01.61 multi Description: The issue allows an authenticated attacker on the LAN or WLAN to intercept communications with the router and obtain the password due to cleartext transmission in...

PT-2023-2597 · D Link · D-Link Dir-879

Name of the Vulnerable Software and Affected Versions: D-Link DIR-879 version v105A1 Description: The issue is related to a component called phpcgi in the D-Link DIR-879 router's firmware, which has weaknesses in its authentication procedure. This can be exploited by a remote attacker to bypass...

Sql injection

A vulnerability was found in SourceCodester Faculty Evaluation System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/manageacademic.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploi...

PT-2023-13978 · Apache +1 · Apache Solr +1

Name of the Vulnerable Software and Affected Versions: Sage 300 versions through 2022 Description: The optional Global Search feature for Sage 300 uses a set of hard-coded credentials for the accompanying Apache Solr instance. This issue could allow attackers to login to the Solr dashboard with...

CVE-2023-23995

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Tim Reeves & David Stöckl TinyMCE Custom Styles plugin = 1.1.2 versions...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Tim Reeves & David Stöckl TinyMCE Custom Styles plugin = 1.1.2 versions...

CVE-2023-25793

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in George Pattihis Link Juice Keeper plugin = 2.0.2 versions...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Bernhard Kux JSON Content Importer plugin = 1.3.15 versions...

CVE-2023-25793 WordPress Link Juice Keeper Plugin <= 2.0.2 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in George Pattihis Link Juice Keeper plugin = 2.0.2 versions...

CVE-2022-47608

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Fullworks Quick Contact Form plugin = 8.0.3.1 versions...

CVE-2023-25479

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Podlove Podlove Subscribe button plugin = 1.3.7 versions...

CVE-2023-25710

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in DIGITALBLUE Click to Call or Chat Buttons plugin = 1.4.0 versions...

ChurchCRM 跨站请求伪造漏洞

ChurchCRM is an open source CRM system for churches. A security vulnerability exists in ChurchCRM version v4.5.3. An attacker exploited the vulnerability to set a person as a user and set that user as an administrator...