7177 matches found
Exploit for CVE-2023-38646
Metabase Metabase is an open source business intelligence tool...
CVE-2023-32130
CVE-2023-32130 affects WordPress Multi Rating Plugin prior to or at version 5.0.6. It is a Stored Cross-Site Scripting (XSS) vulnerability in the plugin’s settings exposed to authenticated administrators. The CVSS vectors in the initial entry show a low-to-medium base impact with user interaction...
CVE-2023-29387
CVE-2023-29387 affects the WordPress plugin Manager for Icomoon (Julien Crego) with a Stored Cross-Site Scripting (XSS) vulnerability in versions ≤ 2.0, exploitable by users with contributor+ permissions. Multiple sources corroborate a fix in version 2.2; update to >2.0 (ideally 2.2 or later) ...
Important Cookie without Secure flag
Description Cookie accessToken is without Secure flag. Mentioned cookie is responsible for user auth. Proof of Concept Repro steps: As logged in user https://app.vrite.io/ open DevTools and check Cookies table, get value of accessToken cookie. Open other browser, go to app.vrite.io site, open...
CVE-2023-28690 WordPress WP BrowserUpdate Plugin <= 4.5 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Marco Steinbrecher WP BrowserUpdate plugin = 4.5 versions...
CVE-2023-31079
CVE-2023-31079 affects the WordPress Tippy plugin 6.2.1 and earlier (
CVE-2023-30784 WordPress Kaya QR Code Generator Plugin <= 1.5.2 is vulnerable to Cross Site Scripting (XSS)
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Kaya Studio Kaya QR Code Generator plugin = 1.5.2 versions...
CVE-2023-30778
CVE-2023-30778 is a stored XSS vulnerability in the Blubrry PowerPress Podcasting plugin for WordPress, affecting versions ≤ 10.0.1. The flaw arises from how user-supplied data can be stored and later reflected in output (stored XSS via shortcode), potentially enabling an attacker with contributo...
CVE-2023-30778 WordPress PowerPress Podcasting Plugin <= 10.0.1 is vulnerable to Cross Site Scripting (XSS)
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Blubrry PowerPress Podcasting plugin by Blubrry plugin = 10.0.1 versions...
Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : MySQL vulnerabilities (USN-6288-1)
The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6288-1 advisory. Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has...
CVE-2023-30752
The CVE-2023-30752 entry concerns the WordPress External Videos plugin and is documented as an authentication‑required Stored XSS in versions <= 2.0.1. Affected component: External Videos plugin; root cause: insufficient input filtering/escaping that allows stored script execution when an admi...
CVE-2023-30751 WordPress Article Directory Redux Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in iControlWP Article Directory Redux plugin = 1.0.2 versions...
CVE-2023-30751
CVE-2023-30751 affects the WordPress plugin Article Directory Redux (iControlWP Article Directory Redux) versions ≤ 1.0.2. It is described as an Authenticated Stored XSS vulnerability that an administrator can exploit via the plugin’s input handling. Impact is characterized as low for confidentia...
CVE-2023-30477
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Essitco AFFILIATE Solution plugin = 1.0 versions...
CVE-2023-30477
CVE-2023-30477 describes a stored XSS in the WordPress plugin AFFILIATE Solution
CVE-2023-29097
CVE-2023-29097 is a Stored XSS vulnerability in the WordPress plugin a3 Portfolio (versions
CVE-2023-3263
The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to authentication bypass in the REST API due to the mishandling of special characters when parsing credentials.Successful exploitation allows the malicious agent to obtain a valid authorization token and read...
Easy2Pilot 7 SQL Injection
==================================================================================================================================== | Title : Easy2Pilot V7 Auth By Pass Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 69.032-bit | | Vendo...
Greeva 2.0 SQL Injection
==================================================================================================================================== | Title : Greeva 2.0 Auth By Pass Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 115.0.264-bit | | Vendo...
CVE-2023-38397 WordPress Gestion-Pymes Plugin <= 1.5.6 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Eggemplo Gestion-Pymes plugin = 1.5.6 versions...