6731 matches found
CVE-2023-2715
The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submitticket' function in versions up to, and including, 2.7.9.8. This makes it possible for authenticated attackers to create a support ticket that sends the website's...
Design/Logic Flaw
The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submitticket' function in versions up to, and including, 2.7.9.8. This makes it possible for authenticated attackers to create a support ticket that sends the website's...
CVE-2023-2715 Groundhogg <= 2.7.9.8 - Missing Authorization to Admin Account and Ticket Creation
The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submitticket' function in versions up to, and including, 2.7.9.8. This makes it possible for authenticated attackers to create a support ticket that sends the website's...
PT-2023-20975 · WordPress · Groundhogg
Name of the Vulnerable Software and Affected Versions: Groundhogg plugin for WordPress versions up to, and including, 2.7.9.8 Description: The issue is due to a missing capability check on the submit ticket function, allowing authenticated attackers to create a support ticket that sends the...
Rockwell ArmorStart
1. EXECUTIVE SUMMARY CVSS v3 7.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Equipment: ArmorStart Vulnerabilities: Improper Input Validation 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow a malicious user to view and modify sensitive...
CVE-2023-31233
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Haoqisir Baidu Tongji generator plugin = 1.0.2 versions...
CVE-2022-47157 WordPress WP Custom Fields Search Plugin <= 1.2.34 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Don Benjamin WP Custom Fields Search plugin = 1.2.34 versions...
U.S. Dept Of Defense: Endpoint Redirects to Admin Page and Provides Admin role
The web application running on Oracle Apex Express platform was found to have an endpoint that redirected users to the admin page and provided them with admin privileges, bypassing access control restrictions. The vulnerability was discovered by navigating to a specific page within the applicatio...
PT-2023-2778 · Cisco · Cisco Identity Services Engine
Name of the Vulnerable Software and Affected Versions: Cisco Identity Services Engine ISE affected versions not specified Description: The issue is related to the web-based management interface of Cisco Identity Services Engine ISE and involves multiple vulnerabilities. These vulnerabilities coul...
CVE-2023-23727
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Formilla Live Chat by Formilla plugin = 1.3 versions...
CVE-2023-23673
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Harish Chouhan, Themeist I Recommend This plugin = 3.8.3 versions...
CVE-2023-23727 WordPress Live Chat by Formilla – Real-time Chat & Chatbots Plugin Plugin <= 1.3 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Formilla Live Chat by Formilla plugin = 1.3 versions...
CVE-2023-23673 WordPress I Recommend This Plugin <= 3.8.3 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Harish Chouhan, Themeist I Recommend This plugin = 3.8.3 versions...
Photo Gallery by Ays < 5.1.7 - Reflected XSS
The plugin does not escape some parameters before outputting it back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin Make a logged in admin open one of the URLs below v 5.1.7 -...
CVE-2023-0763
The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting Holidays, which could allow attackers to make logged in admins delete arbitrary holidays via a CSRF attack...
CVE-2023-23683
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Ozan Canakli White Label Branding for Elementor Page Builder plugin = 1.0.2 versions...
CVE-2023-23654
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in SparkPost plugin = 3.2.5 versions...
CVE-2023-22684
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Subscribers.Com Subscribers plugin = 1.5.3 versions...
Vulnerability fixed in Netapp SnapCenter
Netapp has fixed a vulnerability in SnapCenter. A unauthenticated malicious party could exploit the vulnerability to gain access to the backup environment with administrator privileges. This allows the malicious party to gain access to sensitive information, manipulate data or cause a...