CVE-2023-1124 Shopping Cart & eCommerce Store < 5.4.3 - Admin+ LFI

The Shopping Cart & eCommerce Store WordPress plugin before 5.4.3 does not validate HTTP requests, allowing authenticated users with admin privileges to perform LFI attacks...

PT-2023-16772 · WordPress · Shopping Cart & Ecommerce Store

Name of the Vulnerable Software and Affected Versions: The Shopping Cart & eCommerce Store WordPress plugin versions prior to 5.4.3 Description: The issue allows authenticated users with admin privileges to perform Local File Inclusion LFI attacks due to a lack of validation of HTTP requests. LFI...

PT-2023-20704 · Dupeoff.Com · Dupeoff

Name of the Vulnerable Software and Affected Versions: DupeOff.Com DupeOff plugin versions 1.6 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For DupeOff.Com DupeOff plugin...

CVE-2022-43647

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the xupnpd service, which listens on TCP port 4044. The issue...

CVE-2022-43642

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the YouTube plugin for the xupnpd service, which listens on TC...

CVE-2023-28158

Privilege escalation via stored XSS using the file upload service to upload malicious content. The issue can be exploited only by authenticated users which can create directory name to inject some XSS content and gain some privileges such admin user...

PT-2023-15419 · WordPress · Jeffrey-Wp Media Library Categories

Name of the Vulnerable Software and Affected Versions: Jeffrey-WP Media Library Categories plugin versions prior to 1.9.9 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability requires authentication with admin+ privileges. Recommendations: For...

PT-2023-15436 · Unknown · Quantumcloud Ai Chatbot Plugin

Name of the Vulnerable Software and Affected Versions: QuantumCloud AI ChatBot plugin versions prior to 4.3.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For versions prior to 4.3.0,...

PT-2023-15429 · Usersnap · Usersnap

Name of the Vulnerable Software and Affected Versions: Usersnap plugin versions prior to 4.17 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin or higher privileges. Recommendations: For versions prior to 4.17, update to...

CVE-2022-47529

Insecure Win32 memory objects in Endpoint Windows Agents in RSA NetWitness Platform before 12.2 allow local and admin Windows user accounts to modify the endpoint agent service configuration: to either disable it completely or run user-supplied code or commands, thereby bypassing tamper-protectio...

CVE-2023-25704 WordPress Interactive SVG Image Map Builder Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Mehjabin Orthi Interactive SVG Image Map Builder plugin = 1.0 versions...

PT-2023-20257 · Unknown · Mehjabin Orthi Interactive Svg Image Map Builder

Name of the Vulnerable Software and Affected Versions: Mehjabin Orthi Interactive SVG Image Map Builder plugin versions = 1.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability affects the...

PT-2023-15088 · Fullworks · Fullworks Quick Event Manager

Name of the Vulnerable Software and Affected Versions: Fullworks Quick Event Manager plugin versions = 9.6.4 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For versions = 9.6.4, update to a...

CVE-2023-1025 Simple File List < 6.0.10 - Admin+ Stored XSS

The Simple File List WordPress plugin before 6.0.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-1400 Modern Events Calendar lite < 6.5.2 - Admin+ Stored XSS

The Modern Events Calendar Lite WordPress plugin before 6.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-26361

Adobe ColdFusion versions 2018 Update 15 and earlier and 2021 Update 5 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could result in Arbitrary file system read. Exploitation of this issue does not require user...

PT-2023-21709 · Magepeople · Magepeople Team Event Manager/Tickets Selling Plugin For Woocommerce

Name of the Vulnerable Software and Affected Versions: MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce versions 3.8.6 and earlier Description: The issue is related to a Stored Cross-site Scripting XSS vulnerability that requires authentication with admin+ privileges. This...

EUVD-2023-30182

Adobe ColdFusion versions 2018 Update 15 and earlier and 2021 Update 5 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could result in Arbitrary file system read. Exploitation of this issue does not require user...

Dell Client BIOS RCE (DSA-2023-046)

The Dell BIOS on the remote device is missing a security patch and is, therefore, affected by a remote code execution vulnerability due to improper input validation. A locally authenticated malicious user with admin privileges could exploit this vulnerability to perform arbitrary code execution...

Open Web Analytics 1.7.3 Remote Code Execution Exploit

Open Web Analytics OWA versions prior to 1.7.4 allow an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. class MetasploitModule 'Open Web Analytics 1.7.3 - Remote Code Execution RCE', 'Description' = %q Op...