11668 matches found
CVE-2023-42326
An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfacesgifedit.php and interfacesgreedit.php components...
CVE-2023-46580
Cross-Site Scripting XSS vulnerability in Inventory Management V1.0 allows attackers to execute arbitrary code via the pname parameter of the editProduct.php component...
WordPress Plugin WP Edit Username Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...
CLSA-2023-1699907659 Fix CVE(s): CVE-2023-32360
SECURITY UPDATE: An unauthenticated user may be able to access recently printed documents. The config file /etc/cups/cupsd.conf should be edited manually in case the cups has been already installed in the system: the and sections should be changed according to the patch. -...
CVE-2023-46743
application-collabora is an integration of Collabora Online in XWiki. As part of the application use cases, depending on the rights that a user has over a document, they should be able to open the office attachments files in view or edit mode. Currently, if a user opens an attachment file in edit...
CVE-2023-46743
Affected: application-collabora (Collabora Online integration in XWiki). Issue: when a user opens an attachment in edit mode, the userCanWrite result was cached on the Collabora server, causing the edit-right to persist for subsequent users even if they have only view rights. Consequence: the sam...
CVE-2023-46743 The same file cannot be opened with different rights
application-collabora is an integration of Collabora Online in XWiki. As part of the application use cases, depending on the rights that a user has over a document, they should be able to open the office attachments files in view or edit mode. Currently, if a user opens an attachment file in edit...
XWiki Platform vulnerable to privilege escalation and remote code execution via the edit action
Impact In XWiki Platform, it's possible for a user to execute any content with the right of an existing document's content author, provided the user have edit right on it. The reason for this is that the edit action sets the content without modifying the content author. To reproduce: Log in as a...
GHSA-G2QQ-C5J9-5W5W XWiki Platform vulnerable to privilege escalation and remote code execution via the edit action
Impact In XWiki Platform, it's possible for a user to execute any content with the right of an existing document's content author, provided the user have edit right on it. The reason for this is that the edit action sets the content without modifying the content author. To reproduce: Log in as a...
CVE-2023-46243 Code execution via the edit action in XWiki platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible for a user to execute any content with the right of an existing document's content author, provided the user have edit right on it. A crafted URL of the form...
CVE-2023-46243 Code execution via the edit action in XWiki platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible for a user to execute any content with the right of an existing document's content author, provided the user have edit right on it. A crafted URL of the form...
CVE-2023-33479
RemoteClinic version 2.0 contains a SQL injection vulnerability in the /staff/edit.php file...
CVE-2023-33480
RemoteClinic 2.0 contains a critical vulnerability chain that can be exploited by a remote attacker with low-privileged user credentials to create admin users, escalate privileges, and execute arbitrary code on the target system via a PHP shell. The vulnerabilities are caused by a lack of input...
CVE-2023-33479
RemoteClinic version 2.0 contains a SQL injection vulnerability in the /staff/edit.php file...
Design/Logic Flaw
RemoteClinic 2.0 contains a critical vulnerability chain that can be exploited by a remote attacker with low-privileged user credentials to create admin users, escalate privileges, and execute arbitrary code on the target system via a PHP shell. The vulnerabilities are caused by a lack of input...
WordPress Edit WooCommerce Templates Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS)
Software Edit WooCommerce Templates Type Plugin Vulnerable versions = 1.1.1 Fixed in 1.1.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-47509 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 1d751e50449c Credits LEE SE...
WordPress WP Edit Username Plugin <= 1.0.5 is vulnerable to Cross Site Scripting (XSS)
Software WP Edit Username Type Plugin Vulnerable versions = 1.0.5 Fixed in 1.0.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-47528 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 14cb38e0a9a6 Credits Jeongwoo-LeeRoronoa Required privileg...
PT-2023-24354 · Unknown · Remote Clinic
Name of the Vulnerable Software and Affected Versions: RemoteClinic version 2.0 Description: The issue is a SQL injection vulnerability located in the /staff/edit.php file. This vulnerability can be exploited through the username and password variables. Recommendations: For RemoteClinic version...
Saad Irfan RemoteClinic Security Vulnerability
Saad Irfan RemoteClinic is a Saad Irfan open source application. Provides the ability to remotely manage your clinic via the Web. A security vulnerability exists in RemoteClinic version 2.0, which stems from a SQL injection vulnerability in the file /staff/edit.php...