7225 matches found
CVE-2023-25484
CVE-2023-25484 affects the WordPress plugin Simple Yearly Archive (Oliver Schlöbe) up to version 2.1.8. It is a Stored XSS vulnerability that requires admin+ authentication to exploit. Public sources specify the vulnerable component as the plugin’s code handling user input, with the impact descri...
Cross site scripting
Auth subscriber+ Reflected Cross-Site Scripting XSS vulnerability in Macho Themes Regina Lite theme = 2.0.7 versions...
CVE-2023-25490
CVE-2023-25490 concerns the WordPress plugin Archivist – Custom Archive Templates (versions
CVE-2023-25710
CVE-2023-25710 affects the WordPress plugin DigitalBLUE Click to Call or Chat Buttons up to version 1.4.0. The issue is a Stored Cross-Site Scripting (XSS) vulnerability requiring admin+ privileges. The root cause is an XSS flaw stored in the plugin, with impact limited to confidentiality and int...
CVE-2022-40482
The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\Auth\SessionGuard class when a us...
Sophos Web Appliance 4.3.10.4 - Pre-auth command injection Exploit
!/bin/bash Exploit Title: Sophos Web Appliance 4.3.10.4 - Pre-auth command injection Exploit Author: Behnam Abasi Vanda Vendor Homepage: https://www.sophos.com Version: Sophos Web Appliance older than version 4.3.10.4 Tested on: Ubuntu CVE : CVE-2023-1671 Shodan Dork: title:"Sophos Web Appliance"...
Sophos Web Appliance 4.3.10.4 - Pre-auth command injection
!/bin/bash Exploit Title: Sophos Web Appliance 4.3.10.4 - Pre-auth command injection Exploit Author: Behnam Abasi Vanda Vendor Homepage: https://www.sophos.com Version: Sophos Web Appliance older than version 4.3.10.4 Tested on: Ubuntu CVE : CVE-2023-1671 Shodan Dork: title:"Sophos Web Appliance"...
CVE-2022-41612
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Shareaholic Similar Posts plugin = 3.1.6 versions...
Exploit for Command Injection in Sophos Web_Appliance
Dork fofa title="Sophos Web Appliance" || app="Sophos-W...
CVE-2023-23892
CVE-2023-23892 affects the WordPress plugin “M Chart” by Jamie Poitra. Versions 1.9.4, specifically 1.10, to mitigate. Reported impact is confined to XSS with a Moderate CVSS baseline in public sources, and there is no explicit public exploitation detail in the provided documents. Recommend appl...
CVE-2022-48477
In JetBrains Hub before 2023.1.15725 SSRF protection in Auth Module integration was missing...
Design/Logic Flaw
In JetBrains Hub before 2023.1.15725 SSRF protection in Auth Module integration was missing...
CVE-2022-48477
JetBrains Hub prior to 2023.1.15725 contains a missing SSRF protection in the Auth Module integration. This affects JetBrains Hub versions before 2023.1.15725. Remediation: update to 2023.1.15725 or later (or apply restrictions to Auth Module access as a temporary workaround). The connected sourc...
CVE-2022-48477
In JetBrains Hub before 2023.1.15725 SSRF protection in Auth Module integration was missing...
CVE-2022-48477
In JetBrains Hub before 2023.1.15725 SSRF protection in Auth Module integration was missing...
PT-2023-15810 · Jetbrains · Jetbrains Hub
Name of the Vulnerable Software and Affected Versions: JetBrains Hub versions prior to 2023.1.15725 Description: The issue concerns a missing Server-Side Request Forgery SSRF protection in the Auth Module integration. This could potentially allow for unauthorized access or actions. No information...
Cross site scripting
Auth. contrinbutor+ Cross-Site Scripting XSS vulnerability in WebArea | Vera Nedvyzhenko Simple PDF Viewer plugin = 1.9 versions...
CVE-2023-23816
CVE-2023-23816 is an authenticated (admin+) Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Sitemap Index prior to version 1.2.3. Public sources consistently describe the issue as XSS that requires administrator privileges to exploit, affecting the plugin’s sitemap index handling...
CVE-2023-23817
CVE-2023-23817 details an XSS vulnerability in the WordPress Simple PDF Viewer (WebArea) Vera Nedvyzhenko plugin, affected versions 1.9 where available; monitor vendor advisories for a confirmed fixed release.