CVE-2022-37335 WordPress Word Search Puzzles game plugin <= 2.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated author+ Stored Cross-Site Scripting XSS vulnerability in WHA's Word Search Puzzles game plugin = 2.0.1 at WordPress...

CVE-2022-38058 WordPress WP Shamsi plugin <= 4.1.1 - Authenticated Plugin Setting change vulnerability

Authenticated subscriber+ Plugin Setting change vulnerability in WP Shamsi plugin = 4.1.1 at WordPress...

PT-2022-24177 · WordPress · Wp Shamsi

Name of the Vulnerable Software and Affected Versions: WP Shamsi plugin versions = 4.1.1 Description: The issue is related to an authenticated plugin setting change vulnerability. This means that an attacker with subscriber or higher privileges can change plugin settings. The estimated number of...

CVE-2021-36829 WordPress Launcher: Coming Soon & Maintenance Mode plugin <= 1.0.11 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability in MyThemeShop Launcher: Coming Soon & Maintenance Mode plugin = 1.0.11 at WordPress...

CVE-2022-36355 WordPress Easy Org Chart plugin <= 3.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated contributor+ Stored Cross-Site Scripting XSS vulnerability in PluginlySpeaking Easy Org Chart plugin = 3.1 at WordPress...

CVE-2022-34368

Dell EMC NetWorker 19.2.1.x 19.3.x, 19.4.x, 19.5.x, 19.6.x and 19.7.0.0 contain an Improper Handling of Insufficient Permissions or Privileges vulnerability. Authenticated non admin user could exploit this vulnerability and gain access to restricted resources...

CVE-2022-36347 WordPress Alpine PhotoTile for Pinterest plugin <= 1.3.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability in Alpine Press Alpine PhotoTile for Pinterest plugin = 1.3.1 at WordPress...

CVE-2022-36285

CVE-2022-36285 corresponds to an Authenticated Arbitrary File Upload in the WordPress plugin “Uploading SVG, WEBP and ICO files”

WordPress Contest Gallery plugin <= 17.0.4 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability discovered by Nguy Minh Tuan Patchstack Alliance in WordPress Contest Gallery plugin versions = 17.0.4. Solution Update the WordPress Contest Gallery plugin to the latest available version at least 17.0.5...

CVE-2022-33970

Authenticated WordPress Options Change vulnerability in Biplob018 Shortcode Addons plugin = 3.1.2 at WordPress...

CVE-2022-33970

Authenticated WordPress Options Change vulnerability in Biplob018 Shortcode Addons plugin = 3.1.2 at WordPress...

Code injection

Authenticated WordPress Options Change vulnerability in Biplob Adhikari's Flipbox plugin = 2.6.0 at WordPress...

EARCLINK ESPCMS 安全漏洞

Honghu Erchuang Netlink Information Technology EARCLINK ESPCMS is an enterprise website building system of China Honghu Erchuang Netlink Information Technology Company. A security vulnerability exists in EARCLINK ESPCMS P8, which was discovered via the fetchfilename function in...

Poly Studio X Series 操作系统命令注入漏洞

The Poly Studio X Series is a series of all-in-one video strips from Poly, Inc. It is used for video conferencing. An operating system command injection vulnerability exists in Poly Studio X30, Studio X50, Studio X70, G7500 version 3.4.0-292042, version 3.5.0-344025, and version 3.6.0, which stem...

GHSA-38F9-4VHQ-9CR8 Zen Cart vulnerable to authenticated remote code execution

Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element within the modules edit page and inserting a command...

CVE-2022-1816

A vulnerability, which was classified as problematic, has been found in Zoo Management System 1.0. Affected by this issue is /zoo/admin/publichtml/viewaccounts?type=zookeeper of the content module. The manipulation of the argument adminname with the input alert1 leads to an authenticated cross si...

CVE-2022-29424 WordPress Image Hover Effects Ultimate plugin <= 9.7.1 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

Authenticated admin or higher user role Reflected Cross-Site Scripting XSS vulnerability in Biplob Adhikari's Image Hover Effects Ultimate plugin = 9.7.1 at WordPress...

PT-2022-19623 · WordPress · Opal Hotel Room Booking

Name of the Vulnerable Software and Affected Versions: Opal Hotel Room Booking plugin versions prior to 1.2.8 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with contributor or higher user role can inject malicious...

CVE-2022-23672

A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager versions: 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability...

CVE-2022-23673

A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager versions: 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability...