Server-side Request Forgery (SSRF)

Overview magento/project-community-edition is an eCommerce Platform for Growth Community Edition Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the injection of arbitrary URLs. An admin-privilege authenticated attacker can force the application to mak...

CVE-2023-33621

GL.iNET GL-AR750S-Ext firmware v3.215 inserts the admin authentication token into a GET request when the OpenVPN Server config file is downloaded. The token is then left in the browser history or access logs, potentially allowing attackers to bypass authentication via session replay...

CVE-2023-27624

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Marcelotorres Redirect After Login plugin = 0.1.9 versions...

CVE-2023-26538

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Kamyabsoft Chat Bee plugin = 1.1.0 versions...

CVE-2023-25964

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Noah Hearle, Design Extreme We’re Open! plugin = 1.46 versions...

CVE-2023-33621

GL.iNET GL-AR750S-Ext firmware v3.215 inserts the admin authentication token into a GET request when the OpenVPN Server config file is downloaded. The token is then left in the browser history or access logs, potentially allowing attackers to bypass authentication via session replay...

CVE-2023-33621

CVE-2023-33621 concerns GL.iNET GL-AR750S-Ext firmware v3.215. The OpenVPN Server config file download issue causes the admin authentication token to be inserted into a GET request, leaving the token in browser history or access logs. This could allow a session-replay based bypass of authenticati...

CVE-2023-33328

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in PluginOps MailChimp Subscribe Form plugin = 4.0.9.1 versions...

CVE-2023-33216

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in gVectors Team WooDiscuz – WooCommerce Comments woodiscuz-woocommerce-comments allows Stored XSS.This issue affects WooDiscuz – WooCommerce Comments: from n/a through 2.2.9...

CVE-2023-25781

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Sebastian Krysmanski Upload File Type Settings plugin = 1.1 versions...

PT-2023-19224 · Unknown · Snaporbital Panorama Plugin

Name of the Vulnerable Software and Affected Versions: SnapOrbital Panorama plugin versions = 1.5 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For SnapOrbital Panorama plugin versions =...

CVE-2022-47423

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Ulf Benjaminsson WP-dTree plugin = 4.4.5 versions...

PT-2023-22043 · Unknown · Wpmobile.App

Name of the Vulnerable Software and Affected Versions: WPMobile.App versions prior to 11.20 Description: A Stored Cross-Site Scripting XSS vulnerability exists, allowing authentication bypass for admin+ users. Recommendations: For versions prior to 11.20, update to a version that contains a fix f...

CVE-2023-23883

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in David Gwyer WP Content Filter plugin = 3.0.1 versions...

PT-2023-20072 · Cms Press · Cms Press

Name of the Vulnerable Software and Affected Versions: CMS Press plugin versions 0.2.3 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. There is no information provided about the estimated number ...

CVE-2022-47434

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in PB SEO Friendly Images plugin = 4.0.5 versions...

CVE-2023-23785

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in DgCult Exquisite PayPal Donation plugin = v2.0.0 versions...

CVE-2023-25789

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Tapfiliate plugin = 3.0.12 versions...

CVE-2023-25786

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Thom Stark Eyes Only: User Access Shortcode plugin = 1.8.2 versions...

CVE-2023-25792

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in XiaoMac WP Open Social plugin = 5.0 versions...