9627 matches found
PT-2024-16751 · WordPress · Podlove Podcast Publisher
Name of the Vulnerable Software and Affected Versions: Podlove Podcast Publisher plugin for WordPress versions prior to 4.0.12 Description: The issue arises from a missing capability check on the init download and init functions, allowing unauthorized access to data. This enables unauthenticated...
PT-2024-13389 · Unknown · Rm Bookingcalendar Module +1
Name of the Vulnerable Software and Affected Versions: PrestaShop versions 2.7.9 and before Description: The issue allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via the ics export.php file. This is a result of a SQL Injection vulnerabilit...
Podlove Podcast Publisher < 4.0.12 - Missing Authorization to Unauthenticated Data Export
Description The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the initdownload and init functions in all versions up to, and including, 4.0.11. This makes it possible for unauthenticated attackers to export the...
CVE-2024-1121
The Advanced Forms for ACF plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportjsonfile function in all versions up to, and including, 1.9.3.2. This makes it possible for unauthenticated attackers to export form settings...
CVE-2024-1121 Advanced Forms for ACF <= 1.9.3.2 - Missing Authorization to Unauthenticated Form Settings Export
The Advanced Forms for ACF plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportjsonfile function in all versions up to, and including, 1.9.3.2. This makes it possible for unauthenticated attackers to export form settings...
PT-2024-16827 · WordPress · Advanced Forms For Acf
Name of the Vulnerable Software and Affected Versions: Advanced Forms for ACF plugin for WordPress versions prior to 1.9.3.3 Description: The issue is related to unauthorized access of data due to a missing capability check on the export json file function. This allows unauthenticated attackers t...
CVE-2024-0685 Ninja Forms Contact Form <= 3.7.1 - Unauthenticated Second Order SQL Injection
The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Second Order SQL Injection via the email address value submitted through forms in all versions up to, and including, 3.7.1 due to insufficient escaping on the user supplied parameter...
CVE-2023-48792
Zoho ManageEngine ADAudit Plus through 7250 is vulnerable to SQL Injection in the report export option...
CVE-2023-48792
Zoho ManageEngine ADAudit Plus through 7250 is vulnerable to SQL Injection in the report export option...
Sql injection
Zoho ManageEngine ADAudit Plus through 7250 is vulnerable to SQL Injection in the report export option...
Ninja Forms Contact Form < 3.7.2 - Unauthenticated Second Order SQL Injection
Description The plugin is vulnerable to Second Order SQL Injection via the email address value submitted through forms due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to...
CVE-2023-48792
Zoho ManageEngine ADAudit Plus through 7250 is vulnerable to SQL Injection in the report export option...
CVE-2023-48792
Zoho ManageEngine ADAudit Plus through 7250 is vulnerable to SQL Injection in the report export option...
Typora 1.7.4 Command Injection
Exploit Title: Typora v1.7.4 - OS Command Injection Discovered by: Ahmet Ümit BAYRAM Discovered Date: 13.09.2023 Vendor Homepage: http://www.typora.io Software Link: https://download.typora.io/windows/typora-setup-ia32.exe Tested Version: v1.7.4 latest Tested on: Windows 2019 Server 64bit Steps t...
ZOHO ManageEngine ADAudit Plus SQL Injection Vulnerability
ZOHO ManageEngine ADAudit Plus is used by ZOHO to simplify auditing, demonstrate compliance and detect threats. A SQL injection vulnerability exists in ZOHO ManageEngine ADAudit Plus prior to Build 7271, which stems from the report export option that is susceptible to SQL injection attacks...
PT-2024-15748 · WordPress · The Ninja Forms Contact Form – The Drag/Drop Form Builder For Wordpress
Name of the Vulnerable Software and Affected Versions: The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress versions up to, and including, 3.7.1 Description: The issue is related to Second Order SQL Injection via the email address value submitted throug...
PT-2024-13652 · Zoho · Zoho Manageengine Adaudit Plus
Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADAudit Plus versions through 7250 Description: The issue is related to SQL Injection in the report export option. Recommendations: For Zoho ManageEngine ADAudit Plus versions through 7250, update to a version later than 725...
C5 Firefly III CSV Injection.
Summary CSV injection is a vulnerability where untrusted user input in CSV files can lead to unauthorized access or data manipulation. In my subsequent testing of the application. Details I discovered that there is an option to "Export Data" from the web app to your personal computer, which expor...
The vulnerability of the Export component of the Oracle Agile PLM application, which allows a hacker to trigger a service failure.
The vulnerability of the Export component in the Oracle Agile PLM application is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...