PT-2022-21010

Name of the Vulnerable Software and Affected Versions Online Fire Reporting System version 1.0 Description The issue allows for SQL Injection via the "/ofrs/admin/?page=user/manage user&id=" API endpoint, specifically targeting the id variable. This could potentially lead to unauthorized data...

WordPress JivoChat Live Chat plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in versions of the WordPress JivoChat Live Chat plugi...

PT-2022-21016

Name of the Vulnerable Software and Affected Versions Online Fire Reporting System version 1.0 Description The issue allows for SQL Injection via the "/ofrs/admin/?page=requests/view request&id=" API endpoint, specifically targeting the id variable. This could potentially lead to unauthorized...

PT-2022-20701

Name of the Vulnerable Software and Affected Versions Online Car Wash Booking System version 1.0 Description The issue concerns SQL Injection via the /ocwbs/admin/?page=user/manage user&id= endpoint. This allows for potential manipulation of database queries. No information is provided about the...

CVE-2022-31975: Improper Neutralization of Special Elements used in an SQL Command

Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=user/manageuser&id=...

PT-2022-21015

Name of the Vulnerable Software and Affected Versions Online Fire Reporting System version 1.0 Description The issue allows for SQL Injection via the "/ofrs/admin/?page=teams/view team&id=" API endpoint, specifically through the id variable. This could potentially lead to unauthorized access or...

CVE-2022-29653

OFCMS v1.1.4 was discovered to contain a cross-site scripting XSS vulnerability via the component /admin/comn/service/update.json...

CVE-2022-30815

elitecms 1.01 is vulnerable to SQL Injection via admin/editsidebar.php?page=2&sidebar=...

HCL Technologies Traveler Companion 跨站脚本漏洞

HCL Technologies Traveler Companion is an ios Iphone and Ipad application from HCL Technologies, India. It is used to read encrypted Hcl Notes emails on Apple devices.A cross-site scripting vulnerability exists in HCL Technologies Traveler Companion version 12.0.1.0 and earlier, which stems from...

CVE-2022-1527

The WP 2FA WordPress plugin before 2.2.1 does not sanitise and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...

CVE-2022-0642

The JivoChat Live Chat WordPress plugin before 1.3.5.4 does not properly check CSRF tokens on POST requests to the plugins admin page, and does not sanitise some parameters, leading to a stored Cross-Site Scripting vulnerability where an attacker can trick a logged in administrator to inject...

PT-2022-13590

Name of the Vulnerable Software and Affected Versions Smush WordPress plugin versions prior to 3.9.9 Description The issue arises from the Smush WordPress plugin not sanitizing and escaping a configuration parameter before outputting it back in an admin page when uploading a malicious preset...

WordPress plugin Smush 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plug-in. A cross-site scripting vulnerability exists in versions of WordPress Smush plugin prior to 3.9.9,...

PT-2022-13323

Name of the Vulnerable Software and Affected Versions JivoChat Live Chat WordPress plugin versions prior to 1.3.5.4 Description The issue arises from the plugin's failure to properly check CSRF tokens on POST requests to its admin page and its lack of sanitization for certain parameters. This lea...

CVE-2022-1009: Improper Neutralization of Input During Web Page Generation

The Smush WordPress plugin before 3.9.9 does not sanitise and escape a configuration parameter before outputting it back in an admin page when uploading a malicious preset configuration, leading to a Reflected Cross-Site Scripting. For the attack to be successful, an attacker would need an admin ...

WordPress plugin JivoChat Live Chat 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in versions of the WordPress JivoChat Live Chat plugi...

CVE-2022-1527: Improper Neutralization of Input During Web Page Generation

The WP 2FA WordPress plugin before 2.2.1 does not sanitise and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...

WordPress plugin WP 2FA 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress WP 2FA plugin version 2.2.1 before version 2.2.1 has a cross-site scripting vulnerability...

CVE-2022-0642: Cross-Site Request Forgery (CSRF)

The JivoChat Live Chat WordPress plugin before 1.3.5.4 does not properly check CSRF tokens on POST requests to the plugins admin page, and does not sanitise some parameters, leading to a stored Cross-Site Scripting vulnerability where an attacker can trick a logged in administrator to inject...

PT-2022-13931

Name of the Vulnerable Software and Affected Versions WP 2FA WordPress plugin versions prior to 2.2.1 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in an admin page...