CVE-2023-23650

Summary: CVE-2023-23650 affects the WordPress plugin MainWP Code Snippets Extension for versions

CVE-2023-22712 WordPress TemplatesNext ToolKit Plugin <= 3.2.7 is vulnerable to Cross Site Scripting (XSS)

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in TemplatesNext TemplatesNext ToolKit plugin = 3.2.7 versions...

CVE-2023-22715

WP-CommentNavi (WordPress)

CVE-2023-22716

CVE-2023-22716 affects WordPress OOPSpam Anti-Spam plugin, versions

CVE-2022-45843

Auth. contributor+ Stored Cross-Site Scripting vulnerability in Nextend Smart Slider 3 plugin = 3.5.1.9 versions...

CVE-2022-44742

The CVE-2022-44742 entry concerns the WordPress Community Events plugin, affected versions are = 1.4.9) when available, and monitor for updated advisories from the plugin maintainers.

WorkOrder CMS 0.1.0 - SQL Injection

Exploit Title: WorkOrder CMS 0.1.0 - SQL Injection Date: Sep 22, 2022 Exploit Author: Chokri Hammedi Vendor Homepage: https://github.com/romzes13/WorkOrderCMS Software Link: https://github.com/romzes13/WorkOrderCMS/archive/refs/tags/v0.1.0.zip Version: 0.1.0 Tested on: Linux Auth Bypass: username...

WorkOrder CMS 0.1.0 - SQL Injection Vulnerability

Exploit Title: WorkOrder CMS 0.1.0 - SQL Injection Exploit Author: Chokri Hammedi Vendor Homepage: https://github.com/romzes13/WorkOrderCMS Software Link: https://github.com/romzes13/WorkOrderCMS/archive/refs/tags/v0.1.0.zip Version: 0.1.0 Tested on: Linux Auth Bypass: username:' or '1'='1...

CVE-2022-41785

CVE-2022-41785 concerns a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Gallery Images Ape (Galleryape Gallery Images Ape) , affecting versions

CVE-2022-41831

CVE-2022-41831 affects the TCBarrett WP Glossary WordPress plugin up to version 3.1.2. An Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability exists, with exploitability reported for users with contributor or higher permissions. Some sources note no patched version is available; others ...

CVE-2023-22680

CVE-2023-22680 affects the WordPress plugin No API Amazon Affiliate (Altanic No API Amazon Affiliate) 4.2.2 (4.4.0) with low severity. No public exploit details are provided in the connected documents. Remediation: upgrade to a version greater than 4.2.2 (e.g., 4.4.0+). If upgrading is not feasib...

CVE-2023-22679

CVE-2023-22679 affects the WordPress WP Better Emails plugin, version

CVE-2023-25064

CVE-2023-25064 affects the WordPress plugin WP htpasswd (Plugin

CVE-2023-25782

CVE-2023-25782 affects the WordPress plugin Service Area Postcode Checker ≤ 2.0.8. The issue is an authentication-related Cross‑Site Scripting flaw that can be triggered with admin+ privileges, per CVE and vendor records. Root cause described in related advisories is insufficient sanitization/esc...

SEO Panel 4.8.0 - Blind SQL Injection

SEO Panel 4.8.0 is susceptible to time-based blind SQL injection via the ordercol parameter in archive.php. An attacker can potentially retrieve all databases and thus obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected...

Cross-Site Request Forgery (CSRF)

next-auth is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability exists due to the missing state, nonce, and PKCE checks for OAuth authentication, which allows an attacker to bypass the CSRF protection...

Missing proper state, nonce and PKCE checks for OAuth authentication

Impact next-auth applications using OAuth provider versions before v4.20.1 are affected. A bad actor who can spy on the victim's network or able to social engineer the victim to click a manipulated login link could intercept and tamper with the authorization URL to log in as the victim, bypassing...

GHSA-7R7X-4C4Q-C4QF Missing proper state, nonce and PKCE checks for OAuth authentication

Impact next-auth applications using OAuth provider versions before v4.20.1 are affected. A bad actor who can spy on the victim's network or able to social engineer the victim to click a manipulated login link could intercept and tamper with the authorization URL to log in as the victim, bypassing...

Debian: Security Advisory (DLA-3359-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 3359-1] libapache2-mod-auth-mellon security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-3359-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta March 13, 2023 https://wiki.debian.org/LTS -...