WordPress plugin Wicked Folders 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. The WordPress plugin Wicked Folders suffers from a...

VulnCheck KEV: CVE-2023-0716

The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajaxeditfolder function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this...

WordPress plugin Wicked Folders 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A security vulnerability exists in the WordPress plugin...

CVE-2021-36484: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in JIZHICMS 1.9.5 allows attackers to run arbitrary SQL commands via add or edit article page...

CVE-2022-45588: Improper Restriction of XML External Entity Reference

All versions before R2022-09 of Talend's Remote Engine Gen 2 are potentially vulnerable to XML External Entity XXE type of attacks. Users should download the R2022-09 release or later and use it in place of the previous version. Talend Remote Engine Gen 1 and Talend Cloud Engine for Design are no...

Desdev DedeCMS 跨站脚本漏洞

Desdev DedeCMS Dream Weaving Content Management System is a PHP-based open-source content management system CMS of China Zhuozhuo network Desdev company. The system has content publishing, content management, content editing and content retrieval functions. A security vulnerability exists in...

CVE-2022-48140

DedeCMS v5.7.97 is reported to have a cross-site scripting (XSS) vulnerability in the component /file_manage_view.php?fmdo=edit&filename. The issue is documented across multiple sources (e.g., CVE-2022-48140, NVD, RH, CNNVD, OpenVAS) with a CVSS v3.1 base score of 5.4 (Medium) and attributes: AV:...

CVE-2022-48140: Improper Neutralization of Input During Web Page Generation

DedeCMS v5.7.97 was discovered to contain a cross-site scripting XSS vulnerability in the component /filemanageview.php?fmdo=edit&filename...

Malicious Package

Overview @nelio-content/edit-post is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

Malicious Package

Overview editsession is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

CVE-2022-48116

AyaCMS v3.1.2 was discovered to contain a remote code execution RCE vulnerability via the component /admin/tpledit.inc.php...

AyaCMS 安全漏洞

AyaCMS is an extremely simple and free open source PHP website builder. A security vulnerability exists in AyaCMS version v3.1.2, which stems from its /admin/tpledit.inc.php component that allows an attacker to achieve remote code execution...

Cross site scripting

Cross Site Scripting XSS vulnerability in yapi 1.9.1 allows attackers to execute arbitrary code via the /interface/api edit page...

YMFE YApi 跨站脚本漏洞

YMFE YApi is a visual interface management platform from YMFE Corporation. A security vulnerability exists in YMFE YApi version 1.9.1. An attacker can exploit this vulnerability to execute arbitrary code via the /interface/api edit page...

PT-2023-12296 · Yapi · Yapi

Name of the Vulnerable Software and Affected Versions: yapi version 1.9.1 Description: A Cross Site Scripting XSS issue allows attackers to execute arbitrary code via the "interface/api" edit page. Recommendations: For yapi version 1.9.1, update to a newer version that contains a fix for this iss...

CVE-2021-36686: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability in yapi 1.9.1 allows attackers to execute arbitrary code via the /interface/api edit page...

CVE-2021-36686

Cross Site Scripting XSS vulnerability in yapi 1.9.1 allows attackers to execute arbitrary code via the /interface/api edit page...

CVE-2021-43447

ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An authentication bypass in the document editor allows attackers to edit documents without authentication...

Authentication flaw

ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An authentication bypass in the document editor allows attackers to edit documents without authentication...

sudo: arbitrary file write with privileges of the RunAs user

A vulnerability was found in sudo. Exposure in how sudoedit handles user-provided environment variables leads to arbitrary file writing with privileges of the RunAs user usually root. The prerequisite for exploitation is that the current user must be authorized by the sudoers policy to edit a fil...