CVE-2023-45372

CVE-2023-45372 affects the Wikibase extension for MediaWiki. During item merging, ItemMergeInteractor runs without an edit filter (e.g., AbuseFilter), enabling potential unfiltered edits. Affected versions: MediaWiki Wikibase extension before 1.35.12; 1.36.x through 1.39.x before 1.39.5; and 1.40...

CVE-2023-45372

An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. During item merging, ItemMergeInteractor does not have an edit filter running e.g., AbuseFilter...

MediaWiki Security Breach

MediaWiki is a suite of free and freely available web-based Wiki engines from the MediaWiki Foundation. The product can be used to deploy internal knowledge management and content management systems. A security vulnerability exists in MediaWiki that stems from a Wikibase extension that does not r...

CVE-2023-45372

An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. During item merging, ItemMergeInteractor does not have an edit filter running e.g., AbuseFilter...

PT-2023-8947 · Mediawiki +2 · Wikibase Extension For Mediawiki +2

Name of the Vulnerable Software and Affected Versions: Wikibase extension for MediaWiki versions prior to 1.35.12 Wikibase extension for MediaWiki versions 1.36.x through 1.39.x before 1.39.5 Wikibase extension for MediaWiki versions 1.40.x before 1.40.1 Description: The issue is related to the...

CVE-2023-44061

File Upload vulnerability in Simple and Nice Shopping Cart Script v.1.0 allows a remote attacker to execute arbitrary code via the upload function in the edit profile component...

CVE-2023-44061

File Upload vulnerability in Simple and Nice Shopping Cart Script v.1.0 allows a remote attacker to execute arbitrary code via the upload function in the edit profile component...

Simple and Nice Shopping Cart Script Code Issue Vulnerability

Simple and Nice Shopping Cart Script is simple and nice PHP shopping cart script. A security vulnerability exists in Simple and Nice Shopping Cart Script v.1.0, which originates from a file upload vulnerability. The vulnerability can be exploited to execute arbitrary code via the edit profile...

CVE-2023-44061

File Upload vulnerability in Simple and Nice Shopping Cart Script v.1.0 allows a remote attacker to execute arbitrary code via the upload function in the edit profile component...

CVE-2023-44061

File Upload vulnerability in Simple and Nice Shopping Cart Script v.1.0 allows a remote attacker to execute arbitrary code via the upload function in the edit profile component...

PT-2023-13469 · Tcman Gim · Tcman Gim

Name of the Vulnerable Software and Affected Versions: TCMAN GIM version 8.0.1 Description: The issue concerns the sReferencia, sDescripcion, txtCodigo, and txtDescripcion parameters in the "frmGestionStock.aspx" and "frmEditServicio.aspx" files, which could allow an attacker to perform persisten...

CVE-2023-32790

Cross-Site Scripting XSS vulnerability in NXLog Manager 5.6.5633 version. This vulnerability allows an attacker to inject a malicious JavaScript payload into the 'Full Name' field during a user edit, due to improper sanitization of the input parameter...

PT-2023-24024 · Nxlog · Nxlog Manager

Name of the Vulnerable Software and Affected Versions: NXLog Manager version 5.6.5633 Description: A Cross-Site Scripting XSS issue allows an attacker to inject malicious JavaScript into the Full Name field during user edit, due to improper sanitization of the input parameter. This enables the...

CVE-2023-5322

UNSUPPORTED WHEN ASSIGNED A vulnerability was found in D-Link DAR-7000 up to 20151231. It has been rated as critical. Affected by this issue is some unknown functionality of the file /sysmanage/editmanageadmin.php. The manipulation of the argument id leads to sql injection. The attack may be...

PT-2023-6502 · D Link · D-Link Dar-7000

Name of the Vulnerable Software and Affected Versions: D-Link DAR-7000 versions up to 20151231 Description: The issue is related to the lack of validation of XML object sequences in the /sysmanage/edit manageadmin.php component of the D-Link DAR-7000 router's firmware. This can be exploited by a...

Store XSS when Edit label set

Description Store XSS when Edit label set. I noticed, you have filtered the input when creating the label set. But, perhaps you forgot to filter when editing the label set. Proof of Concept 1 .Create a label set 2 .Edit label set with payload : haidoalertdocument.domain 3 .Click Export multiple...

CVE-2023-5272

A vulnerability classified as critical has been found in SourceCodester Best Courier Management System 1.0. This affects an unknown part of the file editparcel.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to...

CVE-2023-5271

A vulnerability was found in SourceCodester Best Courier Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file editparcel.php. The manipulation of the argument email leads to sql injection. The exploit has been disclosed to the publ...

Sql injection

A vulnerability was found in SourceCodester Best Courier Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file editparcel.php. The manipulation of the argument email leads to sql injection. The exploit has been disclosed to the publ...

CVE-2023-5159 A User Manager role with user edit permissions could manage/update bots

Mattermost fails to properly verify the permissions when managing/updating a bot allowing a User Manager role with user edit permissions to manage/update bots...