URL Shortify < 1.7.9.1 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup Multiple parameters in the plugin's...

CVE-2023-45856

qdPM 9.2 allows remote code execution by using the Add Attachments feature of Edit Project to upload a .php file to the /uploads URI...

CVE-2023-45856

qdPM 9.2 allows remote code execution by using the Add Attachments feature of Edit Project to upload a .php file to the /uploads URI...

Remote code execution

qdPM 9.2 allows remote code execution by using the Add Attachments feature of Edit Project to upload a .php file to the /uploads URI...

CVE-2023-45856

qdPM 9.2 allows remote code execution by using the Add Attachments feature of Edit Project to upload a .php file to the /uploads URI...

CVE-2023-45856

CVE-2023-45856 affects qdPM 9.2. An RCE is possible by using the Add Attachments feature in Edit Project to upload a PHP file to the /uploads URI. Impact and exploitation context are described in the sources; no remediation details are provided in the supplied documents. Processed references incl...

The vulnerability of the file edit_update.php script in the SourceCodester Inventory Management System allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the file editupdate.php script in the SourceCodester Inventory Management System is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected...

CVE-2023-45372

An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. During item merging, ItemMergeInteractor does not have an edit filter running e.g., AbuseFilter...

CVE-2023-45372

An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. During item merging, ItemMergeInteractor does not have an edit filter running e.g., AbuseFilter...

Design/Logic Flaw

An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. During item merging, ItemMergeInteractor does not have an edit filter running e.g., AbuseFilter...

Cross-Site Request Forgery (CSRF) in

Description CSRF led to change permissions of participant in Edit Assignment sessions. Proof of Concept Payload: https://drive.google.com/file/d/1dHY9CS6R4mKM4F0im5n1aUxFamMEjbAa/view?usp=sharing Video PoC: https://drive.google.com/file/d/1AdDFE-qOF-EvVEJzzXKguMfr6ZkXXEx/view?usp=drivelink...

CVE-2023-45372

CVE-2023-45372 affects the Wikibase extension for MediaWiki. During item merging, ItemMergeInteractor runs without an edit filter (e.g., AbuseFilter), enabling potential unfiltered edits. Affected versions: MediaWiki Wikibase extension before 1.35.12; 1.36.x through 1.39.x before 1.39.5; and 1.40...

CVE-2023-45372

An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. During item merging, ItemMergeInteractor does not have an edit filter running e.g., AbuseFilter...

CVE-2023-45372

An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. During item merging, ItemMergeInteractor does not have an edit filter running e.g., AbuseFilter...

MediaWiki Security Breach

MediaWiki is a suite of free and freely available web-based Wiki engines from the MediaWiki Foundation. The product can be used to deploy internal knowledge management and content management systems. A security vulnerability exists in MediaWiki that stems from a Wikibase extension that does not r...

CVE-2023-45372

An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. During item merging, ItemMergeInteractor does not have an edit filter running e.g., AbuseFilter...

PT-2023-8947 · Mediawiki +2 · Wikibase Extension For Mediawiki +2

Name of the Vulnerable Software and Affected Versions: Wikibase extension for MediaWiki versions prior to 1.35.12 Wikibase extension for MediaWiki versions 1.36.x through 1.39.x before 1.39.5 Wikibase extension for MediaWiki versions 1.40.x before 1.40.1 Description: The issue is related to the...

CVE-2023-44061

File Upload vulnerability in Simple and Nice Shopping Cart Script v.1.0 allows a remote attacker to execute arbitrary code via the upload function in the edit profile component...

CVE-2023-44061

File Upload vulnerability in Simple and Nice Shopping Cart Script v.1.0 allows a remote attacker to execute arbitrary code via the upload function in the edit profile component...

Simple and Nice Shopping Cart Script Code Issue Vulnerability

Simple and Nice Shopping Cart Script is simple and nice PHP shopping cart script. A security vulnerability exists in Simple and Nice Shopping Cart Script v.1.0, which originates from a file upload vulnerability. The vulnerability can be exploited to execute arbitrary code via the edit profile...