XML Injection

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to XML Injection via the widgets update layout. An attacker with administrative privileges can execute arbitrary commands by submitting specially crafted XML data. Remediation...

CVE-2021-36023

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution...

CVE-2021-36023 Magento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code Execution

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution...

CVE-2023-4588

Delinea Secret Server (versions v10.9.000002 and v11.4.000002) contains a file accessibility vulnerability that could let an authenticated user with administrative privileges create a backup file in the webroot, redirect the default backup directory to wwwroot, and download files (e.g., encryptio...

PT-2023-27389 · Carrot · Carrot

Name of the Vulnerable Software and Affected Versions: Carrrot plugin versions = 1.1.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability affects the Carrrot plugin and can be exploited by an...

PT-2023-4832 · Imind · Imind

Name of the Vulnerable Software and Affected Versions: iMind affected versions not specified Description: The issue is related to the possibility of code or data injection, which could allow a remote attacker to execute arbitrary code with administrative privileges. Recommendations: At the moment...

Privilege Escalation

github.com/usememos/memos is vulnerable to Privilege Escalation. The vulnerability exists in JWTMiddleware function at jwt.go due to improper admin privileges which allows an attacker to view high privilege user Admin PRIVATE POST...

PT-2023-4771 · Asus · Asus Rt-Ax56U V2

Name of the Vulnerable Software and Affected Versions: ASUS RT-AX56U V2 Description: A format string vulnerability is identified in the set iperf3 svr.cgi module of ASUS RT-AX56U V2, caused by lacking validation for a specific value within this module. This vulnerability can be exploited by a...

PT-2023-4936 · Cacti +1 · Cacti +1

Name of the Vulnerable Software and Affected Versions: Cacti versions prior to 1.2.25 Description: Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting XSS Vulnerability which allows an authenticated user to...

CVE-2023-4253

The AI ChatBot WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-4253 Chatbot < 4.7.8 - Admin+ Stored XSS in FAQ Builder

The AI ChatBot WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

PT-2023-25563 · WordPress · Jeffrey-Wp Media Library Categories

Name of the Vulnerable Software and Affected Versions: Jeffrey-WP Media Library Categories plugin versions = 2.0.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects the Jeffrey-WP Media Library Categories plugin. This vulnerability requires...

PT-2023-26498 · WordPress · Exifography

Name of the Vulnerable Software and Affected Versions: Exifography plugin versions = 1.3.1 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability affects the Exifography plugin. Recommendations:...

Fedora 38 : kubernetes (2023-a3fcc0751f)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-a3fcc0751f advisory. Updates to Kubernetes for F38 and F39. Security fixes for CVE-2023-3955 and CVE-2023-3676. Related update for rawhide already in stable. Update for...

PT-2023-19573 · Unknown · Web-Settler Image Social Feed

Name of the Vulnerable Software and Affected Versions: Web-Settler Image Social Feed plugin versions 1.7.6 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For versions 1.7.6 and...

PT-2023-24630 · Unknown · Shopconstruct

Name of the Vulnerable Software and Affected Versions: ShopConstruct plugin versions 1.1.2 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability affects the ShopConstruct plugin...

PT-2023-19892 · WordPress · Sumo Social Share Boost

Name of the Vulnerable Software and Affected Versions: Sumo Social Share Boost plugin versions = 4.4 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For Sumo Social Share Boost plugin versio...

CVE-2023-28415

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in XootiX Side Cart Woocommerce Ajax plugin = 2.2 versions...

CVE-2023-3501

The FormCraft WordPress plugin before 1.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

PT-2023-24221 · Nuajik · Nuajik

Name of the Vulnerable Software and Affected Versions: nuajik plugin versions prior to 0.1.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For nuajik plugin versions prior to 0.1.0, update...