Rocky Linux 8 : mailman:2.1 (RLSA-2021:1751)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:1751 advisory. - /options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection. CVE-2020-12108 - GNU Mailman before 2.1.33 allows arbitrary content...

WordPress wpDiscuz Plugin <= 7.6.10 is vulnerable to Content Injection

Software wpDiscuz Type Plugin Vulnerable versions = 7.6.10 Fixed in 7.6.11 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2023-46310 Patch priority Medium CVSS severity Medium 5.3 Developer Claim ownership PSID c4aa65661de4 Credits Revan Arifio Required privilege...

CVE-2023-32786

In Langchain through 0.0.155, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks...

CVE-2023-32786

CVE-2023-32786 affects LangChain up to version 0.0.155, where prompt injection can cause SSRF by forcing the service to fetch data from an arbitrary URL and potentially inject content into downstream tasks. Remediation in the connected advisories points to upgrading beyond 0.0.329 (e.g., LangChai...

CVE-2023-32786

In Langchain through 0.0.155, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks...

WordPress Responsive Tabs Plugin < 4.0.6 is vulnerable to Content Injection

Software Responsive Tabs Type Plugin Vulnerable versions 4.0.6 Fixed in 4.0.6 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2023-45635 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID bf3a377a744c Credits Abdi Pranata Required privilege Contributor...

WordPress WP Content Pilot – Autoblogging & Affiliate Marketing Plugin Plugin <= 1.3.3 is vulnerable to Content Injection

Software WP Content Pilot – Autoblogging & Affiliate Marketing Plugin Type Plugin Vulnerable versions = 1.3.3 Fixed in 1.3.4 OWASP Top 10 A1: Injection Classification Content Injection CVE CVE-2023-45053 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 3eca281a4e9c Credits...

Vulnerability of the CMS system: 1C-Bitrix. Website management that arises from the lack of measures to protect the structure of web pages allows attackers to inject malicious content into the website.

Vulnerability of the CMS system 1C-Bitrix: Website management exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to inject malicious content using BBcode functions...

WordPress Tabs & Accordion Plugin <= 1.3.10 is vulnerable to Content Injection

Software Tabs & Accordion Type Plugin Vulnerable versions = 1.3.10 Fixed in N/A OWASP Top 10 A1: Injection Classification Content Injection CVE CVE-2023-40557 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 2f516072a35d Credits Abdi Pranata Required privilege Contributor...

Improper Neutralization

getkirby/cms is vulnerable to Improper Neutralization. The vulnerability exists in the decode function at Txt.php due to a field injection bug in the content storage implementation which allows an attacker to inject malicious data or code...

WordPress Discussion Board Plugin <= 2.4.8 is vulnerable to Content Injection

Software Discussion Board Type Plugin Vulnerable versions = 2.4.8 Fixed in 2.4.9 OWASP Top 10 A5: Broken Access Control Classification Content Injection CVE CVE-2023-39161 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID e808296acb35 Credits Abdi Pranata Required privilege...

CVE-2023-3122

The GD Mail Queue plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 3.9.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

Drogon 环境问题漏洞

Drogon is an open source HTTP application framework based on C++14/17. Drogon can be used to easily build various types of web application server programs using C++. Drogon is vulnerable to an environmental issue that stems from an HTTP response splitting problem that allows an attacker to add th...

CVE-2021-4383

The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to page content injection in versions up to, and including, 5.5. This is due to missing capability checks in the plugin's page-editing functionality. This makes it possible for low-authenticated attackers, such as subscribers, to...

CVE-2021-4369

The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Content Injection in versions up to, and including, 18.2. This is due to lacking authorization protections, checks against users editing other's posts, and lacking a security nonce, all on the wpfmeditfiletitledesc AJ...

CVE-2021-4369

The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Content Injection in versions up to, and including, 18.2. This is due to lacking authorization protections, checks against users editing other's posts, and lacking a security nonce, all on the wpfmeditfiletitledesc AJ...

CVE-2020-36700

The Page Builder: KingComposer plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 2.9.3. This is due to a security nonce being leaked in the '/wp-admin/index.php' page. This makes it possible for authenticated attackers to change arbitrary WordPress...

Design/Logic Flaw

The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to page content injection in versions up to, and including, 5.5. This is due to missing capability checks in the plugin's page-editing functionality. This makes it possible for low-authenticated attackers, such as subscribers, to...

Authorization

The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Content Injection in versions up to, and including, 18.2. This is due to lacking authorization protections, checks against users editing other's posts, and lacking a security nonce, all on the wpfmeditfiletitledesc AJ...

CVE-2021-4383 WP Quick FrontEnd Editor <= 5.5 - Authenticated (Subscriber+) Content Injection

The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to page content injection in versions up to, and including, 5.5. This is due to missing capability checks in the plugin's page-editing functionality. This makes it possible for low-authenticated attackers, such as subscribers, to...