CVE-2023-49847

CVE-2023-49847 is a WordPress vulnerability in the Twinpictures Annual Archive plugin (affected versions: n/a through 1.6.0) where improper neutralization of input during web page generation allows stored XSS. The issue affects the plugin on WordPress sites using 1.6.0 and earlier; Patch status i...

CVE-2023-41844

A improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0.4 and above...

CVE-2023-40716

An improper neutralization of special elements used in an OS command vulnerability CWE-78 in the command line interpreter of FortiTester 2.3.0 through 7.2.3 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments when running execute restore/backup...

CVE-2023-49692

A vulnerability has been identified in RUGGEDCOM RM1224 LTE4G EU 6GK6108-4AM00-2BA2 All versions V7.2.2, RUGGEDCOM RM1224 LTE4G NAM 6GK6108-4AM00-2DA2 All versions V7.2.2, SCALANCE M804PB 6GK5804-0AP00-2AA2 All versions V7.2.2, SCALANCE M812-1 ADSL-Router 6GK5812-1AA00-2AA2 All versions V7.2.2,...

GHSA-CXFR-5Q3R-2RC2 Jinja2 template injection in mlflow

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2...

PYSEC-2023-281

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2...

CVE-2023-6709

CVE-2023-6709 affects mlflow/mlflow up to version 2.9.1 (prior to 2.9.2). The issue is improper neutralization of special elements used in a template engine (Jinja2), enabling template injection with potential arbitrary code execution. Affected component: mlflow/mlflow templates; root cause: inse...

The vulnerability of the tagDiv Composer Plugin, a plugin for WordPress content management systems, allows attackers to carry out cross-site scripting attacks.

The vulnerability of the tagDiv Composer Plugin of the WordPress content management system exists because measures to neutralize special elements have not been taken. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks...

The vulnerability of the Traffic Analyzer – Statistical function in the microprogramming software for Wi-Fi routers from ASUS’ RT-AC86U allows a hacker to execute arbitrary commands or cause service failures.

The vulnerability of the Traffic Analyzer – Statistical function in ASUS’ Wi-Fi router software, the RT-AC86U, exists due to the lack of measures taken to neutralize certain components. Exploiting this vulnerability could allow a remote attacker to execute arbitrary commands or cause service...

WordPress Accelerated Mobile Pages Plugin < 1.0.89 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:ampforwp:acceleratedmobilepages"; if description...

WordPress Events Manager Plugin < 6.4.6 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wp-events-plugin:eventsmanager"; if description...

CVE-2023-5634

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in ArslanSoft Education Portal allows SQL Injection. This issue affects Education Portal: before v1.1...

CVE-2023-47877

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Perfmatters allows Stored XSS.This issue affects Perfmatters: from n/a before 2.2.0...

CVE-2023-48317

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Vikas Vatsa Display Custom Post allows Stored XSS.This issue affects Display Custom Post: from n/a through 2.2.1...

CVE-2023-47848

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Tainacan.Org Tainacan allows Reflected XSS.This issue affects Tainacan: from n/a through 0.20.4...

CVE-2023-38400

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Kriesi Enfold - Responsive Multi-Purpose Theme allows Reflected XSS.This issue affects Enfold - Responsive Multi-Purpose Theme: from n/a through 5.6.4...

CVE-2023-47521

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Max Bond, AndreSC Q2W3 Post Order allows Reflected XSS.This issue affects Q2W3 Post Order: from n/a through 1.2.8...

CVE-2023-31177

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in the Schweitzer Engineering Laboratories SEL-451 could allow an attacker to craft a link that could execute arbitrary code on a victim's system. See product Instruction Manual Appendix A dated 20230830 for mor...

CVE-2023-48742

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in LicenseManager License Manager for WooCommerce license-manager-for-woocommerce allows SQL Injection.This issue affects License Manager for WooCommerce: from n/a through 2.2.10...

Sql injection

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in LicenseManager License Manager for WooCommerce license-manager-for-woocommerce allows SQL Injection.This issue affects License Manager for WooCommerce: from n/a through 2.2.10...