Wedding Management System Arbitrary File Upload Vulnerability (CNVD-2022-54291)

Wedding Management System v1.0 is a wedding planning management system by John Paul Lim Gabule, a personal developer. The vulnerability is caused by a lack of validation of the uploaded files in the photosedit.php page, which could be exploited to upload malicious files and remotely execute...

Simple Inventory System SQL Injection Vulnerability (CNVD-2022-66664)

Simple Inventory System is an inventory system. version 1.0 of Simple Inventory System is vulnerable to SQL injection, which can be exploited by attackers to conduct SQL injection attacks via /inventory/tableeditajax.php...

CVE-2022-30920

H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the EditBasicSSID parameter at /goform/aspForm...

CVE-2022-30919

H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the EditBasicSSID5G parameter at /goform/aspForm...

CVE-2022-30919

H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the EditBasicSSID5G parameter at /goform/aspForm...

CVE-2022-30926

H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the EditMacList parameter at /goform/aspForm...

CVE-2022-30920

H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the EditBasicSSID parameter at /goform/aspForm...

CVE-2022-30922

H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the EditWlanMacList parameter at /goform/aspForm...

CVE-2022-1691

The Realty Workstation WordPress plugin before 1.0.15 does not sanitise and escape the transedit parameter before using it in a SQL statement when an agent edit a transaction, leading to an SQL injection...

CVE-2022-1686

The Five Minute Webshop WordPress plugin through 1.3.2 does not sanitise and escape the id parameter before using it in a SQL statement when editing a product via the admin dashboard, leading to an SQL Injection...

CVE-2022-1241

The Ask me WordPress theme before 6.8.2 does not properly sanitise and escape several of the fields in the Edit Profile page, leading to Reflected Cross-Site Scripting issues...

CVE-2022-1241

The Ask me WordPress theme before 6.8.2 does not properly sanitise and escape several of the fields in the Edit Profile page, leading to Reflected Cross-Site Scripting issues...

CVE-2022-1241

The Ask me WordPress theme before 6.8.2 does not properly sanitise and escape several of the fields in the Edit Profile page, leading to Reflected Cross-Site Scripting issues...

WordPress plugin Realty Workstation SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plug-in. SQL injection vulnerability exists in versions prior to WordPress Realty Workstation plugin 1.0.15,...

H3C Magic R100 缓冲区错误漏洞

H3C Magic R100 is a router from H3C. H3C Magic R100 R100V100R005 version has a buffer overflow vulnerability, which originates from a buffer overflow issue in the EditBasicSSID parameter of the /goform/aspForm page. No detailed vulnerability details are currently available...

WordPress theme Ask me 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The WordPress plugin is an application plugin. WordPress theme Ask me plugin version 6.8.2 previously contained a cross-site scripting...

CVE-2022-31486

An authenticated attacker can send a specially crafted route to the “editroute.cgi” binary and have it execute shell commands. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.303...

CVE-2021-42245

FlatCore-CMS 2.0.9 has a cross-site scripting XSS vulnerability in pages.edit.php through meta tags and content sections...

CVE-2021-42245

FlatCore-CMS 2.0.9 has a cross-site scripting XSS vulnerability in pages.edit.php through meta tags and content sections...

NextCellent Gallery <= 1.9.35 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its image settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed for example in multisite setup Create/edit a gallery with at least one image, pu...