1544 matches found
CVE-2024-54998
MonicaHQ v4.1.2 was discovered to contain an authenticated Client-Side Injection vulnerability via the Reason parameter at /people/h:id/debts/create...
CVE-2024-46625
An authenticated arbitrary file upload vulnerability in the /documentCache/upload endpoint of InfoDom Performa 365 v4.0.1 allows attackers to execute arbitrary code via uploading a crafted SVG file...
CVE-2023-32962
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in HasTheme WishSuite – Wishlist for WooCommerce plugin = 1.3.4 versions...
CVE-2023-50466
An authenticated command injection vulnerability in Weintek cMT2078X easyweb Web Version v2.1.3, OS v20220215 allows attackers to execute arbitrary code or access sensitive information via injecting a crafted payload into the HMI Name parameter...
CVE-2023-45627
An authenticated Denial-of-Service DoS vulnerability exists in the CLI service. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected access point...
CVE-2023-37983
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Noël Jackson Art Direction plugin = 0.2.4 versions...
CVE-2023-41108
TEF portal 2023-07-17 is vulnerable to authenticated remote code execution...
CVE-2023-39267
An authenticated remote code execution vulnerability exists in the command line interface in ArubaOS-Switch. Successful exploitation results in a Denial-of-Service DoS condition in the switch...
CVE-2023-44262
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Renzo Johnson Blocks plugin = 1.6.41 versions...
CVE-2023-44173
Online Movie Ticket Booking System v1.0 is vulnerable to an authenticated Reflected Cross-Site Scripting vulnerability...
CVE-2023-44230
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Gopi Ramasamy Popup contact form plugin = 7.1 versions...
CVE-2023-25783
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Alex Moss FireCask Like & Share Button plugin = 1.1.5 versions...
CVE-2023-24789
jeecg-boot v3.4.4 was discovered to contain an authenticated SQL injection vulnerability via the building block report component...
CVE-2023-24323
Mojoportal v2.7 was discovered to contain an authenticated XML external entity XXE injection vulnerability...
CVE-2023-23878
Auth. editor+ Stored Cross-Site Scripting XSS vulnerability in flippercode WordPress Plugin for Google Maps – WP MAPS plugin = 4.3.9 versions...
CVE-2023-51068
An authenticated reflected cross-site scripting XSS vulnerability in QStar Archive Solutions Release RELEASE3-0 Build 7 allows attackers to execute arbitrary javascript on a victim's browser via a crafted link...
CVE-2022-3141
The Translate Multilingual sites WordPress plugin before 2.3.3 is vulnerable to an authenticated SQL injection. By adding a new language via the settings page containing specific special characters, the backticks in the SQL query can be surpassed and a time-based blind payload can be injected...
📄 ABB Cylon Aspect 3.08.03 productRemovalUpdate.php Remote Code Execution
The ABB BMS/BAS controller suffers from an authenticated blind OS command injection vulnerability. This can be exploited to inject and execute arbitrary shell commands through the 'instance' HTTP POST parameter called by the productRemovalUpdate.php script. The token key POST param needs to be se...