Server-Side Template Injection (SSTI)

wintercms/winter is vulnerable to Server-side Template Injection SSTI. The vulnerability is due to insufficient input validation, allowing an admin authenticated remote attacker to execute arbitrary code by injecting a crafted payload into the CMS Pages field and Plugin components...

Cross Site Scripting (XSS)

concrete5/concrete5 is vulnerable to Cross Site ScriptingXSS. The vulnerability due to file attributes which are insufficiently sanitized via the Edit Attributes page. It vulnerability allows an admin authenticated attacker to inject malicious code into file tags or description attributes,...

CVE-2023-22273

Adobe RoboHelp Server versions 11.4 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to Remote Code Execution by an admin authenticated attacker. Exploitation of this issue does not require user interaction...

Path traversal

Adobe RoboHelp Server versions 11.4 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to Remote Code Execution by an admin authenticated attacker. Exploitation of this issue does not require user interaction...

CVE-2023-22273 ZDI-CAN-21307: Adobe RoboHelp Server OnPublishFile Directory Traversal Remote Code Execution Vulnerability

Adobe RoboHelp Server versions 11.4 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to Remote Code Execution by an admin authenticated attacker. Exploitation of this issue does not require user interaction...

CVE-2023-22273: Improper Limitation of a Pathname to a Restricted Directory

Adobe RoboHelp Server versions 11.4 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to Remote Code Execution by an admin authenticated attacker. Exploitation of this issue does not require user interaction...

PT-2023-7165

Name of the Vulnerable Software and Affected Versions Adobe RoboHelp Server versions 11.4 and earlier Description The issue is related to an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' that could lead to Remote Code Execution by an admin authenticated attacker...

CVE-2023-47228

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Muneeb Layer Slider plugin = 1.1.9.7 versions...

CVE-2023-47223: Improper Neutralization of Input During Web Page Generation

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP Map Plugins Basic Interactive World Map plugin = 2.0 versions...

CVE-2023-23702

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Pixelgrade Comments Ratings plugin = 1.1.7 versions...

CVE-2023-47177: Improper Neutralization of Input During Web Page Generation

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Yakir Sitbon, Ariel Klikstein Linker plugin = 1.2.1 versions...

CVE-2023-44230

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Gopi Ramasamy Popup contact form plugin = 7.1 versions...

CVE-2023-27526: Incorrect Authorization

A non Admin authenticated user could incorrectly create resources using the import charts feature, on Apache Superset up to and including 2.1.0...

Arbitrary Code Execution

Pagekit/pagekit is vulnerable to Arbitrary Code Execution. The vulnerability exists because the updateAction function in UpdateController.php blindly executes code in the uploaded requirements.php file which allow an admin authenticated attacker to execute malicious code into the system...

CVE-2023-32294

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Radical Web Design GDPR Cookie Consent Notice Box plugin = 1.1.6 versions...

CVE-2023-32505

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Arshid Easy Hide Login plugin = 1.0.7 versions...

CVE-2023-30874

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Steve Curtis, St. Pete Design Gps Plotter plugin = 5.1.4 versions...

Ivanti Addressed Second Zero-Day Flaw Exploited by Attackers

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary The zero-day vulnerability CVE-2023-35081 in Ivanti EPMM enables admin-authenticated attackers to write arbitrary files, risking unauthorized access, OS command execution, and malicious web shell...

Denial Of Service (DoS)

ethyca-fides is vulnerable to Denial Of Service DoS. The vulnerability exists due to the lack of validation checks for SVGs in the savetemplate function of connectorregistryservice.py, which allows an admin authenticated attacker to crash the application by uploading a zip file containing a...

CVE-2023-29423: Improper Neutralization of Input During Web Page Generation

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in PI Websolution Cancel order request / Return order / Repeat Order / Reorder for WooCommerce plugin = 1.3.2 versions...