CVE-2023-26016 WordPress Simple Portfolio Gallery Plugin <= 0.1 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Tauhidul Alam Simple Portfolio Gallery plugin = 0.1 versions...

CVE-2023-21494

The CVE-2023-21494 issue affects Samsung Shannon baseband, specifically the auth API in mm_Authentication.c. It describes a potential buffer overflow that could allow remote attackers to cause invalid memory access. The vulnerability is rooted in the Shannon baseband code prior to SMR May-2023 Re...

CVE-2023-23875 WordPress Bing Site Verification plugin using Meta Tag Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Himanshu Bing Site Verification plugin using Meta Tag plugin = 1.0 versions...

CVE-2023-23808

CVE-2023-23808 affects the WordPress Sponsors Carousel plugin for versions prior to or equal to 4.02. The issue is an Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in the Sponsors Carousel plugin, with the root cause described as stored XSS. The available sources indicate...

CVE-2023-23809

CVE-2023-23809 concerns a stored XSS in the WordPress plugin “Stock market charts from finviz” (plugin versions

CVE-2023-23708

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Themeisle Visualizer: Tables and Charts Manager for WordPress plugin = 3.9.4 versions...

CVE-2023-23874

CVE-2023-23874 is a stored XSS vulnerability in the WordPress Ditty plugin (versions ≤ 3.0.32) affecting contributors. The issue is caused by an insufficient input sanitization in the plugin, allowing malicious scripts to be stored and potentially executed in user sessions. The connected sources ...

CVE-2023-23820

The CVE-2023-23820 entry concerns the WordPress ProfilePress Plugin (Membership Team) versions &lt;= 4.5.4. The vulnerability is a stored XSS that requires authentication (contributors or higher) to exploit. The available documents specify the issue as an Auth. (contributor+) Stored Cross-Site Sc...

CVE-2023-25797

Auth. Stored Cross-Site Scripting XSS vulnerability in Mr.Vibe vSlider Multi Image Slider for WordPress plugin = 4.1.2 versions...

CVE-2023-22713

The CVE-2023-22713 issue affects WordPress Download Manager Gutenberg Blocks plugin (

CVE-2023-25796

CVE-2023-25796 is a stored XSS in the WordPress plugin WP BaiDu Submit (

CVE-2023-25798

CVE-2023-25798 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Olevmedia Shortcodes (versions 1.1.9) to mitigate risk. Monitor for official patch details as they become publicly available.

CVE-2023-25797

CVE-2023-25797 affects WordPress plugin vSlider Multi Image Slider for WordPress (

CVE-2023-25784

CVE-2023-25784 refers to an admin+ stored XSS in the WordPress plugin Sticky Ad Bar (older name variants) up to version 1.3.1. Public sources in the connected documents consistently describe the flaw as arising from inadequate sanitization/escaping of plugin settings, enabling stored XSS by high-...

CVE-2023-25792

CVE-2023-25792 is an Authenticated Stored XSS vulnerability in the XiaoMac WP Open Social plugin (versions

Debian: Security Advisory (DLA-3409-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Sharepoint Dynamic Proxy Generator Unauth RCE

This module exploits two vulnerabilities in Sharepoint 2019, an auth bypass CVE-2023-29357 which was patched in June of 2023 and CVE-2023-24955, an RCE which was patched in May of 2023. The auth bypass allows attackers to impersonate the Sharepoint Admin user. This vulnerability stems from the...

DLA-3409-1 libapache2-mod-auth-openidc - security update

Bulletin has no description...

Concrete CMS (previously concrete5) is vulnerable to possible auth bypass in the jobs section

Concrete CMS previously concrete5 before 9.2 is vulnerable to possible Auth bypass in the jobs section...

Design/Logic Flaw

Concrete CMS previously concrete5 versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to possible Auth bypass in the jobs section...