CVE-2022-47589 WordPress CTT Expresso para WooCommerce Plugin <= 3.2.11 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in this.Functional CTT Expresso para WooCommerce plugin = 3.2.11 versions...

CVE-2022-22512

Hard-coded credentials in Web-UI of multiple VARTA Storage products in multiple versions allows an unauthorized attacker to gain administrative access to the Web-UI via network...

PT-2023-20074 · Klaviyo · Klaviyo

Name of the Vulnerable Software and Affected Versions: Klaviyo plugin versions 3.0.7 and earlier Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin access can inject malicious scripts into the application,...

VARTA Storage 信任管理问题漏洞

VARTA Storage is VARTA's AC all-in-one system with an integrated battery inverter, ideal for retrofits or new installations. VARTA Storage suffers from a trust management issue vulnerability that stems from hard-coded credentials that allow an unauthorized attacker to gain administrative access t...

PT-2023-17101 · Sourcecodester · Sourcecodester Automatic Question Paper Generator System

Name of the Vulnerable Software and Affected Versions: SourceCodester Automatic Question Paper Generator System version 1.0 Description: A critical vulnerability was found in the SourceCodester Automatic Question Paper Generator System. This issue affects the file admin/courses/view class.php of...

PT-2023-1956 · Foreman · Foreman

Name of the Vulnerable Software and Affected Versions: Foreman affected versions not specified Description: An arbitrary code execution flaw was found in Foreman, related to incorrect handling of code generation in the YAML.load function of the YAML parser library. This issue may allow an admin...

CVE-2023-22680

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Altanic No API Amazon Affiliate plugin = 4.2.2 versions...

CVE-2023-25064 WordPress WP htpasswd Plugin <= 1.7 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Matteo Candura WP htpasswd plugin = 1.7 versions...

CVE-2023-25795 WordPress Feed Changer Plugin <= 0.2 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Cross-Site Scripting XSS vulnerability in WP-master.Ir Feed Changer & Remover plugin = 0.2 versions...

CVE-2023-25782

Auth. admin+ vulnerability in Second2none Service Area Postcode Checker plugin = 2.0.8 versions...

All-In-One Security (AIOS) < 5.1.5 - Admin+ Arbitrary File/Folder Access via Traversal

The plugin does not limit what log files to display in it's settings pages, allowing an authorized user admin+ to view the contents of arbitrary files and list directories anywhere on the server to which the web server has access. The plugin only displays the last 50 lines of the file. PoC POST...

PT-2023-20309 · Unknown · Mighty Digital Nooz

Name of the Vulnerable Software and Affected Versions: Mighty Digital Nooz plugin versions prior to 1.6.0 Description: The issue is related to an Authenticated admin+ Cross-Site Scripting XSS vulnerability. This means that an attacker who has admin access can inject malicious scripts into the...

PT-2023-19542 · Nsthemes · Nsthemes Advanced Social Pixel

Name of the Vulnerable Software and Affected Versions: NsThemes Advanced Social Pixel plugin versions = 2.1.1 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For NsThemes Advanced Social Pix...

PT-2023-20299 · WordPress · Second2None Service Area Postcode Checker

Name of the Vulnerable Software and Affected Versions: Second2none Service Area Postcode Checker plugin versions prior to 2.0.9 Description: The issue is related to an authentication vulnerability that affects users with admin+ privileges in the Second2none Service Area Postcode Checker plugin...

All-In-One Security (AIOS) < 5.1.5 - Admin+ Arbitrary File/Folder Access via Traversal

The plugin does not limit what log files to display in it's settings pages, allowing an authorized user admin+ to view the contents of arbitrary files and list directories anywhere on the server to which the web server has access. The plugin only displays the last 50 lines of the file. POST...

CVE-2023-1470

The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parameters in versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2023-17007 · WordPress · Wp Express Checkout

Name of the Vulnerable Software and Affected Versions: WP Express Checkout plugin for WordPress versions up to, and including, 2.2.8 Description: The issue is related to Stored Cross-Site Scripting via the pec couponcode parameter due to insufficient input sanitization and output escaping. This...

PT-2023-21232 · Miniflux · Miniflux

Name of the Vulnerable Software and Affected Versions: Miniflux versions 2.0.25 through 2.0.42 Description: The issue arises when Miniflux automatically proxies images served over HTTP to prevent mixed content errors. If an outbound request made by the Go HTTP client fails, the html.ServerError i...

IBM MQ 安全漏洞

IBM MQ IBM WebSphere MQ is a messaging middleware product from International Business Machines IBM. It provides a reliable and proven messaging backbone for Service Oriented Architecture SOA. A security vulnerability exists in IBM MQ Certified Container versions 9.3.0.1 through 9.3.0.3 and 9.3.1....

CVE-2023-27269 Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform

SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker with non-administrative authorizations to exploit a directory traversal flaw in an available service to overwrite the system files. In...