CVE-2022-0848

Summary (CVE-2022-0848): part-db/part-db prior to 0.5.11 is vulnerable to an OS Command Injection via unrestricted file upload, enabling remote code execution on the affected web server. Multiple sources document an RCE exploit and practical PoCs (e.g., packetstorm/huntr/exploit-db) that leverage...

PT-2022-13470

Name of the Vulnerable Software and Affected Versions part-db/part-db versions prior to 0.5.11 Description The issue is related to OS Command Injection in the GitHub repository part-db/part-db. Recommendations For versions prior to 0.5.11, update to version 0.5.11 or later to resolve the issue...

CVE-2022-0848: Improper Neutralization of Special Elements used in an OS Command

OS Command Injection in GitHub repository part-db/part-db prior to 0.5.11...

WordPress Advanced Contact form 7 DB plugin <= 1.8.6 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by Krzysztof Zając in WordPress Advanced Contact form 7 DB plugin versions = 1.8.6. Solution Update the WordPress Advanced Contact form 7 DB plugin to the latest available version at least 1.8.7...

PT-2022-9631

Name of the Vulnerable Software and Affected Versions Duplicate Page or Post WordPress plugin versions prior to 1.5.1 Description The issue concerns a lack of authorization and a flawed CSRF check in the wpdevart duplicate post parametrs save in db AJAX action. This allows any authenticated user ...

db-thueringen.de Cross Site Scripting vulnerability OBB-2377074

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WordPress Form Store to DB plugin cross-site scripting vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports the hosting of personal blog sites on servers with PHP and MySQL. cross-site scripting vulnerability exists in versions of the WordPress Form Store to DB plugin...

CVE-2021-25107

The Form Store to DB WordPress plugin before 1.1.1 does not sanitise and escape parameter keys before outputting it back in the created entry, allowing unauthenticated attacker to perform Cross-Site Scripting attacks against admin...

CVE-2021-25107

The Form Store to DB WordPress plugin before 1.1.1 does not sanitise and escape parameter keys before outputting it back in the created entry, allowing unauthenticated attacker to perform Cross-Site Scripting attacks against admin...

Cross site scripting

The Form Store to DB WordPress plugin before 1.1.1 does not sanitise and escape parameter keys before outputting it back in the created entry, allowing unauthenticated attacker to perform Cross-Site Scripting attacks against admin...

CVE-2021-25107

The CVE corresponds to the WordPress Form Store to DB plugin prior to version 1.1.1, where the plugin does not sanitize or escape parameter keys before echoing them back into a created entry. This causes unauthenticated stored Cross-Site Scripting (XSS) that can affect site admins. Affected compo...

CVE-2021-25107: Improper Neutralization of Input During Web Page Generation

The Form Store to DB WordPress plugin before 1.1.1 does not sanitise and escape parameter keys before outputting it back in the created entry, allowing unauthenticated attacker to perform Cross-Site Scripting attacks against admin...

PT-2022-9662

Name of the Vulnerable Software and Affected Versions Form Store to DB WordPress plugin versions prior to 1.1.1 Description The issue allows an unauthenticated attacker to perform Cross-Site Scripting attacks against administrators. This is due to the plugin not sanitizing and escaping parameter...

AlmaLinux 8 : libdb (ALSA-2021:1675)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2021:1675 advisory. - Vulnerability in the Data Store component of Oracle Berkeley DB. Supported versions that are affected are Prior to 6.138, prior to 6.2.38 and prior to 18.1.32...

Rockwell Automation Allen-Bradley CompactLogix Reflective Cross-Site Scripting (CVE-2016-2279)

Cross-site scripting XSS vulnerability in the web server in Rockwell Automation Allen-Bradley CompactLogix 1769-L before 28.011+ allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. This plugin only works with Tenable.ot. Please visit...

Mageia: Security Advisory (MGASA-2021-0057)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2018-0222)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

com.cloudbees.jenkins.plugins:custom-tools-plugin (>=0.3, <=0.4.4), com.datical.integration.jenkins:datical-db-plugin (>=1.0.3, <=1.0.35) +47 more potentially affected by CVE-2022-20612 via org.jenkins-ci.main:jenkins-core (1.480.3)

org.jenkins-ci.main:jenkins-core MAVEN version 1.480.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.cloudbees.jenkins.plugins:custom-tools-plugin =0.3, =1.0.3, =1.0.0, =0.1, =0.1, =0.1.0,...

Form Store to DB < 1.1.1 - Unauthenticated Stored Cross-Site Scripting

The plugin does not sanitise and escape parameter keys before outputting it back in the created entry, allowing unauthenticated attacker to perform Cross-Site Scripting attacks against admin POST /wp-json/contact-form-7/v1/contact-forms/1337/feedback HTTP/2 Content-Type: multipart/form-data;...

WordPress Form Store to DB plugin <= 1.1.0 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated Stored Cross-Site Scripting XSS vulnerability discovered by Yoru Oni in WordPress Form Store to DB plugin versions = 1.1.0. Solution Update the WordPress Form Store to DB plugin to the latest available version at least 1.1.1...