CVE-2021-25068

The Sync WooCommerce Product feed to Google Shopping WordPress plugin through 1.2.4 uses the 'feedid' POST parameter which is not properly sanitized for use in a SQL statement, leading to a SQL injection vulnerability in the admin dashboard...

Sql injection

The Sync WooCommerce Product feed to Google Shopping WordPress plugin through 1.2.4 uses the 'feedid' POST parameter which is not properly sanitized for use in a SQL statement, leading to a SQL injection vulnerability in the admin dashboard...

Cross site scripting

The Pz-LinkCard WordPress plugin through 2.4.4.4 does not sanitise and escape multiple parameters before outputting them back in admin dashboard pages, leading to Reflected Cross-Site Scripting issues...

Cross site scripting

The Popup Builder WordPress plugin before 4.1.1 does not sanitise and escape the sgpb-subscription-popup-id parameter before using it in a SQL statement in the All Subscribers admin dashboard, leading to a SQL injection, which could also be used to perform Reflected Cross-Site Scripting attack...

CVE-2021-25068 Sync WooCommerce Product feed to Google Shopping <= 1.2.4 - Admin+ SQLi

The Sync WooCommerce Product feed to Google Shopping WordPress plugin through 1.2.4 uses the 'feedid' POST parameter which is not properly sanitized for use in a SQL statement, leading to a SQL injection vulnerability in the admin dashboard...

CVE-2021-46434

EMQ X Dashboard V3.0.0 is affected by username enumeration in the "/api /v3/auth" interface. When a user login, the application returns different results depending on whether the account is correct, that allowed an attacker to determine if a given username was valid...

CVE-2021-46434

EMQ X Dashboard V3.0.0 is affected by username enumeration in the "/api /v3/auth" interface. When a user login, the application returns different results depending on whether the account is correct, that allowed an attacker to determine if a given username was valid...

CVE-2021-46434

EMQ X Dashboard V3.0.0 is affected by username enumeration in the "/api /v3/auth" interface. When a user login, the application returns different results depending on whether the account is correct, that allowed an attacker to determine if a given username was valid...

Code injection

UNSUPPORTED WHEN ASSIGNED EMQ X Dashboard V3.0.0 is affected by username enumeration in the "/api /v3/auth" interface. When a user login, the application returns different results depending on whether the account is correct, that allowed an attacker to determine if a given username was valid...

CVE-2021-46434

EMQ X Dashboard V3.0.0 is affected by username enumeration in the "/api /v3/auth" interface. When a user login, the application returns different results depending on whether the account is correct, that allowed an attacker to determine if a given username was valid...

CVE-2021-46434

EMQ X Dashboard 3.0.0 is affected by a username enumeration vulnerability in the /api/v3/auth interface. The login response differs depending on whether the username exists, allowing an attacker to determine if a given username is valid. Public references across CNVD/OSV/NVD/CVE records confirm t...

EMQ X 安全漏洞

EMQ X is a fully open source, highly scalable and highly available distributed MQTT messaging agent for IoT, M2M and mobile applications. Suitable for IoT, M2M and mobile applications EMQ programs can handle tens of millions of concurrent clients. EMQ X Dashboard version V3.0.0 contains a user...

PT-2022-12705 · Emq · Emq X Dashboard

Name of the Vulnerable Software and Affected Versions: EMQ X Dashboard version 3.0.0 Description: The issue concerns username enumeration in the "/api/v3/auth" interface. When a user logs in, the application returns different results depending on whether the account is correct, allowing an attack...

WordPress plugin Pz-LinkCard 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress plugin is a WordPress open source application plugin . A cross-site scripting vulnerability exists in the...

CVE-2022-21947

A Exposure of Resource to Wrong Sphere vulnerability in Rancher Desktop of SUSE allows attackers in the local network to connect to the Dashboard API steve to carry out arbitrary actions. This issue affects: SUSE Rancher Desktop versions prior to V...

Amministrazione Aperta < 3.8 - Admin+ LFI

The plugin does not validate the open parameter before using it in an include statement, leading to a Local File Inclusion issue. The original advisory mentions that unauthenticated users can exploit this, however the affected file generates a fatal error when accessed directly and the affected...

Security Bulletin: IBM InfoSphere Information Governance Dashboard is affected by an Information Disclosure vulnerability

Summary An Information Disclosure vulnerability was addressed by IBM InfoSphere Information Governance Dashboard. Vulnerability Details CVEID: CVE-2019-4453 DESCRIPTION: IBM InfoSphere Information Server could disclose sensitive information to an unauthorized user that could be used in further...

Stored Cross Site Scripting

Vulnerability Type Stored Cross Site-Scripting XSS Affected URL https://localhost/openemr-6.0.0/interface/new/newcomprehensivesave.php Affected Parameters “formfname” “formlname” Authentication Required? Yes Issue Summary A stored XSS vulnerability found in “/interface/new/newcomprehensivesave.ph...

Image optimization & Lazy Load < 3.3.2 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape its "Lazyload background images for selectors" settings, which could allow high privilege users such as admin to perform Cross-Site scripting attacks even when the unfilteredhtml capability is disallowed. Put the following payload in the Media Optimole...

Jenkins Environment Dashboard Plugin Cross-Site Scripting Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.A cross-site scripting vulnerability exist...