MAL-2023-7996 Malicious code in @pagseguro/nest (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx b16a70a89161283b99538bb25fdbaecc235a75a73c7a471c98ad831fc08a7cdf Malicious packages campaign since 2021 targeting developers, steals source code and secrets...

ReviewX < 1.6.4 - Subscriber+ SQLi

The plugin does not properly sanitise and escape the filterValue and selectedColumns parameters before using them in SQL statements via the rxexportreview AJAX action available to any authenticated users, leading to a SQL injection exploitable by users with a role as low as subscriber Run the bel...

CVE-2022-39983

File upload vulnerability in Pro Gamma Instant Developer RD3 22.5 r23, r30, and possibly earlier versions, allows attackers to execute arbitrary code...

Instant Developer RD3 Framework Code Issues and Vulnerabilities

Instant Developer RD3 Framework is a framework from Instant Developer, Inc. A code issue vulnerability exists in Instant Developer RD3 Framework version 22.0.8500, which stems from the presence of a file upload vulnerability. An attacker can exploit this vulnerability to execute arbitrary code...

WordPress Client Portal – Private user pages and login Plugin <= 1.1.8 is vulnerable to Cross Site Request Forgery (CSRF)

Software Client Portal – Private user pages and login Type Plugin Vulnerable versions = 1.1.8 Fixed in 1.1.9 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-25968 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 41903f8c3f9...

WordPress Redirect Redirection Plugin <= 1.1.3 is vulnerable to Broken Access Control

Software Redirect Redirection Type Plugin Vulnerable versions = 1.1.3 Fixed in 1.1.4 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE N/A Patch priority High CVSS severity High 6.3 Developer Claim ownership PSID acc4d402d165 Credits WordFence Required privilege...

CVE-2022-39983: Unrestricted Upload of File with Dangerous Type

File upload vulnerability in Pro Gamma Instant Developer RD3 22.5 r23, r30, and possibly earlier versions, allows attackers to execute arbitrary code...

K25570584: Apache Struts vulnerability CVE-2012-0394

Security Advisory Description DISPUTED The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability...

WP OAuth Server < 4.3.0 - Subscriber+ Arbitrary Client Deletion

The plugin has a flawed CSRF and authorisation check when deleting a client, which could allow any authenticated users, such as subscriber to delete arbitrary client. Run the below command in the developer console of the web browser while being on the blog as any authenticated users, such as...

WordPress ProfilePress Plugin <= 4.5.4 is vulnerable to Cross Site Scripting (XSS)

Software ProfilePress Type Plugin Vulnerable versions = 4.5.4 Fixed in 4.5.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23830 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID b724881f96bc Credits Rafie Muhammad...

WordPress Markup (JSON-LD) structured in schema.org Plugin <= 4.8.1 is vulnerable to Cross Site Scripting (XSS)

Software Markup JSON-LD structured in schema.org Type Plugin Vulnerable versions = 4.8.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4666 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID f683250d0657...

WordPress Read More Excerpt Link Plugin <= 1.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software Read More Excerpt Link Type Plugin Vulnerable versions = 1.6 Fixed in 1.6.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-26011 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 838704e6067f Credits Mika Required...

Music Gallery Site SQL Injection Vulnerability

Music Gallery Site is a music gallery site by the individual developer Carlo Montero. A SQL injection vulnerability exists in Music Gallery Site version 1.0, which stems from an incorrect manipulation of the parameter cid resulting in sql injection...

WordPress Clio Grow Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Clio Grow Type Plugin Vulnerable versions = 1.0.0 Fixed in 1.0.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-22683 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 5da0567f175d Credits Rio Darmawan Required privile...

WordPress Stock market charts from finviz Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)

Software Stock market charts from finviz Type Plugin Vulnerable versions = 1.0.1 Fixed in 1.0.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23809 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 206bbc36367f Credits Rio...

WordPress Uncanny Toolkit for LearnDash Plugin <= 3.6.4.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Uncanny Toolkit for LearnDash Type Plugin Vulnerable versions = 3.6.4.1 Fixed in 3.6.4.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-23714 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 7ec3b9ffa1ec Credits...

WordPress MPG Plugin <= 3.3.9 is vulnerable to Cross Site Request Forgery (CSRF)

Software MPG Type Plugin Vulnerable versions = 3.3.9 Fixed in 3.3.10 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-47143 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID eb3263f87956 Credits rezaduty Required privilege...

WordPress CSS JS Manager Plugin <= 2.4.49 is vulnerable to Cross Site Request Forgery (CSRF)

Software CSS JS Manager Type Plugin Vulnerable versions = 2.4.49 Fixed in 2.4.49.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-47154 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d901e9767d13 Credits rezaduty Require...

WordPress Zeno Font Resizer Plugin <= 1.7.9 is vulnerable to Cross Site Scripting (XSS)

Software Zeno Font Resizer Type Plugin Vulnerable versions = 1.7.9 Fixed in 1.8.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-25442 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 9818bffc879d Credits Rio Darmawan Required...

WordPress Campaign URL Builder Plugin < 1.8.2 is vulnerable to Cross Site Scripting (XSS)

Software Campaign URL Builder Type Plugin Vulnerable versions 1.8.2 Fixed in 1.8.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0538 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 650b985168de Credits Lana Codes...