CVE-2023-0421

The Cloud Manager WordPress plugin through 1.0 does not sanitise and escape the query param ricerca before outputting it in an admin panel, allowing unauthenticated attackers to trick a logged in admin to trigger a XSS payload by clicking a link...

CraftCMS Administration Panel Login Form Detected

CraftCMS Administration Panel has been detected on the target web application. This may present an attacker with an exploit vector which could be leveraged using other techniques, such as a Brute-Force or Dictionary Attack, allowing an attacker to gain access to administrative functionality. No...

Here's what security teams need to know about the new Biden-Harris National Cybersecurity Strategy

The release of the National Cybersecurity Strategy by the Biden-Harris Administration is a significant development that will have an impact on security teams across the United States. What does it say?...

CyberPower PowerPanel Business Edition 代码问题漏洞

Cyber Power Systems CyberPower PowerPanel Business Edition is a suite of power management software from Cyber Power Systems, USA. The software automates the shutdown of physical and virtual infrastructures and monitors and manages CyberPower UPS systems and network-connected PDUs Power Distributi...

GHSA-9J36-3CP4-RH4J XWiki vulnerable to Code Injection in template provider administration

Impact Any user with edit rights on any document e.g., the own user profile can execute code with programming rights, leading to remote code execution by following these steps: 1. Set the title of any document you can edit can be the user profile to async async="true" cached="false"...

CVE-2023-23938

Tuleap is a Free & Source tool for end to end traceability of application and system developments. Affected versions are subject to a cross site scripting attack which can be injected in the name of a color of select box values of a tracker and then reflected in the tracker administration...

CVE-2023-23938 Cross-site Scripting (XSS) through the name of a color of select box values in tuleap

Tuleap is a Free & Source tool for end to end traceability of application and system developments. Affected versions are subject to a cross site scripting attack which can be injected in the name of a color of select box values of a tracker and then reflected in the tracker administration...

PT-2023-19309 · Tuleap · Tuleap

Name of the Vulnerable Software and Affected Versions: Tuleap versions prior to 14.5.99.4 Description: The issue is a cross-site scripting attack that can be injected in the name of a color of select box values of a tracker and then reflected in the tracker administration. Administrative privileg...

Iranian Hackers Using SimpleHelp Remote Support Software for Persistent Access

The Iranian threat actor known as MuddyWater is continuing its time-tested tradition of relying on legitimate remote administration tools to commandeer targeted systems. While the nation-state group has previously employed ScreenConnect, RemoteUtilities, and Syncro, a new analysis from Group-IB h...

Thumbnail carousel slider < 1.1.10 - Reflected XSS

The plugin does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting vulnerability which could be used against high privilege users such as admin. PoC Make a logged in admin open: GET...

Online Thesis Archiving System SQL注入漏洞

Online Thesis Archiving System by Carlo Montero Individual Developer provides an online platform to store student theses or capstone projects. A SQL injection vulnerability exists in Campcodes Online Thesis Archiving System version 1.0, which stems from an issue in the file...

PT-2023-18079 · Sourcecodester · Sourcecodester Purchase Order Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Purchase Order Management System version 1.0 Description: A critical vulnerability has been found in the SourceCodester Purchase Order Management System. The issue affects an unknown function of the file /admin/suppliers/view...

PT-2023-22193 · Vitess · Vitess

Name of the Vulnerable Software and Affected Versions: Vitess versions prior to 16.0.1 Description: The issue arises when a keyspace containing / characters is created, intentionally or inadvertently, causing errors when attempting to view keyspaces from VTAdmin or when using vtctldclient...

Cross site scripting

The Article Directory WordPress plugin through 1.3 does not properly sanitize the publishtermstext setting before displaying it in the administration panel, which may enable administrators to conduct Stored XSS attacks in multisite contexts...

CVE-2023-0422 Article Directory <= 1.3 - Admin+ Stored XSS

The Article Directory WordPress plugin through 1.3 does not properly sanitize the publishtermstext setting before displaying it in the administration panel, which may enable administrators to conduct Stored XSS attacks in multisite contexts...

CVE-2023-0422

CVE-2023-0422 affects the Article Directory WordPress plugin

PT-2023-16260 · WordPress · Article Directory Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Article Directory WordPress plugin versions prior to 1.4 Description: The issue arises from improper sanitization of the publish terms text setting, which can be exploited to conduct Stored XSS attacks, particularly in multisite environments...

tpAdmin 代码问题漏洞

tpAdmin is a ThinkPHP5 based administration backend. A code issue vulnerability exists in yuan1994 tpAdmin version 1.3.12, which stems from an incorrect manipulation of the parameter file resulting in unrestricted uploads...

CVE-2023-28852

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to versions 9.5.13 and 10.0.7, a user with dashboard administration rights may hack the dashboard form to store malicious code that will be executed when other users will use the related dashboard. Versio...

Design/Logic Flaw

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to versions 9.5.13 and 10.0.7, a user with dashboard administration rights may hack the dashboard form to store malicious code that will be executed when other users will use the related dashboard. Versio...