1642 matches found
Display post meta, term meta, comment meta, and user meta <= 0.4.1 - Contributor+ Stored Cross-Site Scripting
The plugin does not validate and escape post metadata before outputting it back into the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high-privilege users such as admins...
Groundhogg < 2.7.9.8 - Disable All Plugins via CSRF
The plugin does not have CSRF check when enabling Safe-mode on the plugin, which could allow attackers to make logged-in admins perform such action via a CSRF attack leading to disabling all other plugins...
CVE-2023-20167
Multiple vulnerabilities in Cisco Identity Services Engine ISE could allow an authenticated attacker to perform path traversal attacks on the underlying operating system to either elevate privileges to root or read arbitrary files. To exploit these vulnerabilities, an attacker must have valid...
CVE-2023-0762
The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting designations, which could allow attackers to make logged in admins delete arbitrary designations via a CSRF attack...
CVE-2023-0761
The CVE-2023-0761 entry concerns a CSRF vulnerability in the Clock In Portal – Staff & Attendance Management WordPress plugin (versions
CVE-2023-0762 Clock In Portal <= 2.1 - Designation Deletion via CSRF
The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting designations, which could allow attackers to make logged in admins delete arbitrary designations via a CSRF attack...
CVE-2023-0763: Cross-Site Request Forgery (CSRF)
The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting Holidays, which could allow attackers to make logged in admins delete arbitrary holidays via a CSRF attack...
May 9, 2023—KB5026368 (OS Build 22000.1936)
None None...
Online Reviewer System SQL注入漏洞
Online Reviewer System is a software application. An online reviewer system. A SQL injection vulnerability exists in SourceCodester Online Reviewer System version 1.0, which stems from a problem in the file /reviewer/system/system/admins/manage/users/user-update.php, where an operation on the...
PT-2023-16597 · WordPress · The Pickup | Delivery | Dine-In Date Time Wordpress Plugin
Name of the Vulnerable Software and Affected Versions: The Pickup | Delivery | Dine-in date time WordPress plugin versions 1.0.0 through 1.0.9 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capabili...
DEBIAN-CVE-2021-23166
A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read and write local files on the server...
CVE-2021-23166
A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read and write local files on the server...
PT-2023-12043 · Odoo · Odoo Community +1
Name of the Vulnerable Software and Affected Versions: Odoo Community versions 15.0 and earlier Odoo Enterprise versions 15.0 and earlier Description: A sandboxing issue allows authenticated administrators to read and write local files on the server. Recommendations: For Odoo Community versions...
CVE-2023-0899 Steveas WP Live Chat Shoutbox <= 1.4.2 - Unauthenticated Stored XSS
The Steveas WP Live Chat Shoutbox WordPress plugin through 1.4.2 does not sanitise and escape a parameter before outputting it back in the Shoutbox, leading to Stored Cross-Site Scripting which could be used against high privilege users such as admins...
Introducing the Malwarebytes Admin app: Endpoint security at your fingertips
If youre on the beach sipping piña coladas, the last thing you probably want to do is rush to your desktop and address a critical security issue. And yet, this is the reality for many IT security professionals today. Regardless of the time or current location, security pros are expected to drop...
CVE-2023-28440
Discourse is an open source platform for community discussion. In affected versions a maliciously crafted request from a Discourse administrator can lead to a long-running request and eventual timeout. This has the greatest potential impact in shared hosting environments where admins are untruste...
CVE-2023-28440 Denial of service via admin theme import route in Discourse
Discourse is an open source platform for community discussion. In affected versions a maliciously crafted request from a Discourse administrator can lead to a long-running request and eventual timeout. This has the greatest potential impact in shared hosting environments where admins are untruste...
CVE-2023-1331
The Redirection WordPress plugin before 1.1.5 does not have CSRF checks in the uninstall action, which could allow attackers to make logged in admins delete all the redirections through a CSRF attack...