CVE-2021-25107

The CVE corresponds to the WordPress Form Store to DB plugin prior to version 1.1.1, where the plugin does not sanitize or escape parameter keys before echoing them back into a created entry. This causes unauthenticated stored Cross-Site Scripting (XSS) that can affect site admins. Affected compo...

PT-2022-9662

Name of the Vulnerable Software and Affected Versions Form Store to DB WordPress plugin versions prior to 1.1.1 Description The issue allows an unauthenticated attacker to perform Cross-Site Scripting attacks against administrators. This is due to the plugin not sanitizing and escaping parameter...

CVE-2021-25107: Improper Neutralization of Input During Web Page Generation

The Form Store to DB WordPress plugin before 1.1.1 does not sanitise and escape parameter keys before outputting it back in the created entry, allowing unauthenticated attacker to perform Cross-Site Scripting attacks against admin...

AlmaLinux 8 : libdb (ALSA-2021:1675)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2021:1675 advisory. - Vulnerability in the Data Store component of Oracle Berkeley DB. Supported versions that are affected are Prior to 6.138, prior to 6.2.38 and prior to 18.1.32...

Rockwell Automation Allen-Bradley CompactLogix Reflective Cross-Site Scripting (CVE-2016-2279)

Cross-site scripting XSS vulnerability in the web server in Rockwell Automation Allen-Bradley CompactLogix 1769-L before 28.011+ allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. This plugin only works with Tenable.ot. Please visit...

Mageia: Security Advisory (MGASA-2021-0057)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2018-0222)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

com.cloudbees.jenkins.plugins:custom-tools-plugin (>=0.3, <=0.4.4), com.datical.integration.jenkins:datical-db-plugin (>=1.0.3, <=1.0.35) +47 more potentially affected by CVE-2022-20612 via org.jenkins-ci.main:jenkins-core (1.480.3)

org.jenkins-ci.main:jenkins-core MAVEN version 1.480.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.cloudbees.jenkins.plugins:custom-tools-plugin =0.3, =1.0.3, =1.0.0, =0.1, =0.1, =0.1.0,...

org.codehaus.fabric3:fabric3-db-h2 (>=0.5beta1, <=1.2), org.codehaus.service-conduit:sca4j-db-h2 (>=0.4.2, <=0.9.0) potentially affected by CVE-2022-23221 via com.h2database:h2 (1.0.71)

com.h2database:h2 MAVEN version 1.0.71 is affected by a known vulnerability. The following packages have a transitive dependency on com.h2database:h2 and may be impacted: - org.codehaus.fabric3:fabric3-db-h2 =0.5beta1, =0.4.2, =0.9.0 Source cves: CVE-2022-23221 Source advisory:...

WordPress Form Store to DB plugin <= 1.1.0 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated Stored Cross-Site Scripting XSS vulnerability discovered by Yoru Oni in WordPress Form Store to DB plugin versions = 1.1.0. Solution Update the WordPress Form Store to DB plugin to the latest available version at least 1.1.1...

Form Store to DB < 1.1.1 - Unauthenticated Stored Cross-Site Scripting

The plugin does not sanitise and escape parameter keys before outputting it back in the created entry, allowing unauthenticated attacker to perform Cross-Site Scripting attacks against admin POST /wp-json/contact-form-7/v1/contact-forms/1337/feedback HTTP/2 Content-Type: multipart/form-data;...

Form Store to DB < 1.1.1 - Unauthenticated Stored Cross-Site Scripting

The plugin does not sanitise and escape parameter keys before outputting it back in the created entry, allowing unauthenticated attacker to perform Cross-Site Scripting attacks against admin PoC POST /wp-json/contact-form-7/v1/contact-forms/1337/feedback HTTP/2 Content-Type: multipart/form-data;...

OpenBMCS 2.4 Authenticated SQL Injection

Summary Building Management & Controls System BMCS. No matter what the size of your business, the OpenBMCS software has the ability to expand to hundreds of controllers. Our product can control and monitor anything from a garage door to a complete campus wide network, with everything you need on...

PT-2022-12505 · Gnu +3 · Gnu Recutils +3

Name of the Vulnerable Software and Affected Versions: GNU Recutils version 1.8.90 Description: The issue is related to an untrusted pointer dereference in the rec db destroy function at rec-db.c, which can cause a segmentation fault or application crash. Recommendations: For GNU Recutils version...

Rocket.Chat: API route chat.getThreadsList leaks private message content

Summary The /api/v1/chat.getThreadsList does not sanitize user inputs and can therefore leak private thread messages to unauthorized users via Mongo DB injection. Description The chat.getThreadsList API route is defined in app/api/server/v1/chat.jsL522-L572: javascript const rid, type, text =...

SQL Injection

johnpbloch/wordpress-core is vulnerable to sql injection. The vulnerability exists due to the lack of sanitization in the WPMetaQuery , allowing an attacker to inject and execute malicious SQL queries to the DB...

bronzedb (0.1.0), bronzedb-client (>=0.1.0, <=0.1.1) +3 more potentially affected by CVE-2021-45682 via bronzedb-protocol (0.1.0)

bronzedb-protocol CARGO version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on bronzedb-protocol and may be impacted: - bronzedb 0.1.0 - bronzedb-client =0.1.0, =0.1.1 - bronzedb-memory-db-server 0.1.0 - bronzedb-server 0.1.0 -...

Cross-site Scripting (XSS) - Stored in admidio/admidio

Description When adding a menu after logging in with an administrator account, there is no verification of the URL value, so the XSS payload is stored in the DB. After that, when you click the saved menu, XSS is triggered. If an administrator adds a menu, normal users can click it too. Proof of...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

Log4jCenter Exploiting CVE-2021-44228 in vCenter for remote c...

KLA12392 RCE vulnerability in Microsoft Azure

Remote code execution vulnerability was found in Microsoft Azure. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories CVE-2021-44228 Exploitation Public exploits exist for this vulnerability. Malware exists for this vulnerability. Usually such malware is...