WordPress eBecas Plugin <= 3.1.3 is vulnerable to Cross Site Scripting (XSS)

Software eBecas Type Plugin Vulnerable versions = 3.1.3 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-32584 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID a40684e094e5 Credits Pavak Tiwari Required privilege...

WordPress LetterPress Plugin <= 1.2.2 is vulnerable to Cross Site Scripting (XSS)

Software LetterPress Type Plugin Vulnerable versions = 1.2.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-27415 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 71ef1d80815f Credits Pavak Tiwari Required privile...

Design/Logic Flaw

IBM i 7.2, 7.3, 7.4, and 7.5 could allow an authenticated privileged administrator to gain elevated privileges in non-default configurations, as a result of improper SQL processing. By using a specially crafted SQL operation, the administrator could exploit the vulnerability to perform additional...

CVE-2023-22901

ChangingTec MOTP system has a path traversal vulnerability. A remote attacker with administrator’s privilege can exploit this vulnerability to access arbitrary system files...

WordPress Ad Inserter Plugin < 2.7.27 is vulnerable to PHP Object Injection

Software Ad Inserter Type Plugin Vulnerable versions 2.7.27 Fixed in 2.7.27 OWASP Top 10 A8: Insecure Deserialization Classification PHP Object Injection CVE CVE-2023-1549 Patch priority Low CVSS severity Low 4.4 Developer Igor Funa PSID 3b84de757ee4 Credits Nguyen Huu Do Required privilege...

CVE-2023-22901

CVE-2023-22901 concerns the ChangingTec MOTP system, which is reported to have a path traversal vulnerability. The affected component is the MOTP system itself, with the root cause described as a path traversal flaw that could allow a remote attacker with administrator privileges to access arbitr...

WordPress Customizer Export/Import Plugin < 0.9.6 is vulnerable to PHP Object Injection

Software Customizer Export/Import Type Plugin Vulnerable versions 0.9.6 Fixed in 0.9.6 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2023-1347 Patch priority Low CVSS severity Low 4.4 Developer Claim ownership PSID 014e99d7d277 Credits Nguyen Huu Do Required privilege...

WordPress Logo Scheduler Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)

Software Logo Scheduler Type Plugin Vulnerable versions = 1.2.0 Fixed in 1.2.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-30875 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 576e4137e757 Credits Yuki Haruma Required...

WordPress Elementor Website Builder Plugin <= 3.12.1 is vulnerable to SQL Injection

Software Elementor Website Builder Type Plugin Vulnerable versions = 3.12.1 Fixed in 3.12.2 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-0329 Patch priority Low CVSS severity Low 6.6 Developer Elementor PSID c642fe631d89 Credits Sanjay Das Required privilege Administrator...

WordPress Blog Navigator Chatbot by Xatkit Plugin <= 4.4.9 is vulnerable to Cross Site Scripting (XSS)

Software Blog Navigator Chatbot by Xatkit Type Plugin Vulnerable versions = 4.4.9 Fixed in 4.5.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-1649 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 73a888678fc8 Credits Erwan L...

WordPress Shortcode IMDB Plugin <= 6.0.8 is vulnerable to SQL Injection

Software Shortcode IMDB Type Plugin Vulnerable versions = 6.0.8 Fixed in N/A OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2022-47432 Patch priority Low CVSS severity Low 6.7 Developer Claim ownership PSID 90dd9be6ea07 Credits minhtuanact Required privilege Administrator Publish...

WordPress Flyzoo Chat Plugin <= 2.3.3 is vulnerable to Cross Site Scripting (XSS)

Software Flyzoo Chat Type Plugin Vulnerable versions = 2.3.3 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-46817 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 081268519060 Credits Justiice Required privilege...

WordPress Booking calendar, Appointment Booking System Plugin <= 3.2.7 is vulnerable to SQL Injection

Software Booking calendar, Appointment Booking System Type Plugin Vulnerable versions = 3.2.7 Fixed in 3.2.8 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2022-47428 Patch priority Low CVSS severity Low 6.7 Developer Claim ownership PSID be3286ef939c Credits thiennv Required...

Discourse 资源管理错误漏洞

Discourse is an open source community discussion platform. The platform includes features such as communities, email, and chat rooms. A resource management error vulnerability exists in Discourse, which stems from the fact that a malicious request from a Discourse administrator could cause the...

WordPress Article Directory Redux Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)

Software Article Directory Redux Type Plugin Vulnerable versions = 1.0.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-30751 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 1d10759d477b Credits Pavitra Tiwari...

WordPress Site Reviews Plugin < 6.7.1 is vulnerable to Cross Site Scripting (XSS)

Software Site Reviews Type Plugin Vulnerable versions 6.7.1 Fixed in 6.7.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-1525 Patch priority Low CVSS severity Low 5.9 Developer Gemini Labs PSID 152640d57067 Credits Shreya Pohekar Required privilege...

Arbitrary file deletion

A local file deletion vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to delete files from the local file system with elevated privileges. These files can include logs and system components that impact the integrity and availability of PAN-OS software...

WordPress Zyrex Popup Plugin <= 1.0 is vulnerable to Arbitrary File Upload

Software Zyrex Popup Type Plugin Vulnerable versions = 1.0 Fixed in 1.1 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-0924 Patch priority Low CVSS severity Low 9.1 Developer Claim ownership PSID 902b3bcce78c Credits Yogesh Verma Required privilege Administrator...

WordPress Transbank Webpay REST Plugin <= 1.6.6 is vulnerable to SQL Injection

Software Transbank Webpay REST Type Plugin Vulnerable versions = 1.6.6 Fixed in 1.6.7 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-27610 Patch priority Low CVSS severity Low 5.5 Developer Claim ownership PSID d271398a2afa Credits Mika Required privilege Administrator...

WordPress SimpleModal Contact Form (SMCF) Plugin <= 1.2.9 is vulnerable to Cross Site Scripting (XSS)

Software SimpleModal Contact Form SMCF Type Plugin Vulnerable versions = 1.2.9 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-29438 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 0838ea65d5e5 Credits Rio Darmawa...