LG Simple Editor Remote Code Execution Exploit

This Metasploit module exploits broken access control and directory traversal vulnerabilities in LG Simple Editor software for gaining code execution. The vulnerabilities exist in versions of LG Simple Editor prior to v3.21. By exploiting this flaw, an attacker can upload and execute a malicious...

CVE-2023-4847

A vulnerability classified as problematic has been found in SourceCodester Simple Book Catalog App 1.0. Affected is an unknown function of the component Update Book Form. The manipulation of the argument booktitle/bookauthor leads to cross site scripting. It is possible to launch the attack...

SourceCodester Simple Book Catalog App Cross-Site Scripting Vulnerability

Simple Book Catalog App is a simple book catalog application by the individual developer Remy Andrade. A cross-site scripting vulnerability exists in SourceCodester Simple Book Catalog App version 1.0, which stems from the presence of an unknown function in the component Update Book Form, leading...

PT-2023-8074 · Sourcecodester · Sourcecodester Simple Book Catalog App

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Book Catalog App version 1.0 Description: A vulnerability has been found in the Update Book Form component of the SourceCodester Simple Book Catalog App. The manipulation of the book title and book author arguments leads...

WordPress Meks Smart Author Widget Plugin <= 1.1.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Meks Smart Author Widget Type Plugin Vulnerable versions = 1.1.3 Fixed in 1.1.4 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-25989 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 7a6fdc5ff131 Credits Muhammad...

CVE-2023-4019

The Media from FTP WordPress plugin before 11.17 does not properly limit who can use the plugin, which may allow users with author+ privileges to move files around, like wp-config.php, which may lead to RCE in some cases...

CVE-2023-4019 Media from FTP < 11.17 - Author+ Arbitrary File Access

The Media from FTP WordPress plugin before 11.17 does not properly limit who can use the plugin, which may allow users with author+ privileges to move files around, like wp-config.php, which may lead to RCE in some cases...

CVE-2023-39164

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Molongui Author Box for Authors, Co-Authors, Multiple Authors and Guest Authors – Molongui plugin = 4.6.19 versions...

CVE-2023-39164

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Molongui Author Box for Authors, Co-Authors, Multiple Authors and Guest Authors – Molongui plugin = 4.6.19 versions...

Cross site scripting

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Molongui Author Box for Authors, Co-Authors, Multiple Authors and Guest Authors – Molongui plugin = 4.6.19 versions...

CVE-2023-39164

CVE-2023-39164: Unauthenticated reflected XSS in Molongui Author Box for Authors, Co-Authors, Multiple Authors and Guest Authors (Molongui plugin 4.6.19. CVE-2023-39164 details and vendor advisories confirm the XSS vuln; no exploit details are provided in the supplied sources.

WordPress plugin Author Box for Authors, Co-Authors, Multiple Authors and Guest Authors - Molongui Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress plugin Author Box for Authors,...

PT-2023-26818 · Molongui · Molongui Author Box

Name of the Vulnerable Software and Affected Versions: Molongui Author Box for Authors, Co-Authors, Multiple Authors and Guest Authors – Molongui plugin versions = 4.6.19 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject...

WordPress Folders Plugin <= 2.9.2 is vulnerable to Arbitrary File Upload

Software Folders Type Plugin Vulnerable versions = 2.9.2 Fixed in 2.9.3 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2023-40204 Patch priority Medium CVSS severity Medium 9.1 Developer Claim ownership PSID c5881308f6ec Credits Rafie Muhammad Patchstack Required privileg...

CVE-2023-40573

CVE-2023-40573 affects XWiki Platform’s Groovy job scheduler. The vulnerability arises because the system validates the content author for programming rights on scheduled Groovy jobs, while modifications to a job script on a document do not update the author, enabling an attacker with edit rights...

Color Prediction Game v1.0 - SQL Injection Vulnerability

Exploit Title: Color Prediction Game v1.0 - SQL Injection Exploit Author: Ahmet Ümit BAYRAM Vendor: https://www.codester.com/items/44411/color-prediction-game-php-script Tested on: Kali Linux & MacOS CVE: N/A Request POST /loginNow.php HTTP/1.1 Host: localhost Cookie:...

CVE-2023-3601

The Simple Author Box WordPress plugin before 2.52 does not verify a user ID before outputting information about that user, leading to arbitrary user information disclosure to users with a role as low as Contributor...

CVE-2023-3601

The Simple Author Box WordPress plugin before 2.52 does not verify a user ID before outputting information about that user, leading to arbitrary user information disclosure to users with a role as low as Contributor...

Information disclosure

The Simple Author Box WordPress plugin before 2.52 does not verify a user ID before outputting information about that user, leading to arbitrary user information disclosure to users with a role as low as Contributor...

CVE-2023-3601 Simple Author Box < 2.52 - Contributor+ Arbitrary User Information Disclosure via IDOR

The Simple Author Box WordPress plugin before 2.52 does not verify a user ID before outputting information about that user, leading to arbitrary user information disclosure to users with a role as low as Contributor...