CVE-2019-17230: Undefined Security Weakness

includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress allows unauthenticated options changes...

PT-2020-9884

Name of the Vulnerable Software and Affected Versions OneTone theme versions 3.0.6 and earlier for WordPress Description The issue allows unauthenticated options changes due to a problem in the includes/theme-functions.php file. Recommendations For OneTone theme versions 3.0.6 and earlier, update...

PT-2020-9885

Name of the Vulnerable Software and Affected Versions OneTone theme versions 3.0.6 and earlier for WordPress Description The issue concerns multiple stored XSS problems. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world...

CVE-2019-17231: Improper Neutralization of Input During Web Page Generation

includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress has multiple stored XSS issues...

squid: Incorrect pointer handling when processing ESI Responses can lead to denial of service

The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a Incorrect Pointer Handling vulnerability in ESI Response Processing that can result in Denial of Service for all clients using the proxy.. This attack appear to be exploitable via Remote server...

PT-2020-12343

Name of the Vulnerable Software and Affected Versions Nagios XI version 5.6.11 Description The issue allows for XSS via the username parameter in the includes/components/ldap ad integration/ endpoint. Recommendations For Nagios XI version 5.6.11, avoid using the username parameter in the affected...

CVE-2020-9425

An issue was discovered in includes/head.inc.php in rConfig before 3.9.4. An unauthenticated attacker can retrieve saved cleartext credentials via a GET request to settings.php. Because the application was not exiting after a redirect is applied, the rest of the page still executed, resulting in...

CVE-2020-9425: Always-Incorrect Control Flow Implementation

An issue was discovered in includes/head.inc.php in rConfig before 3.9.4. An unauthenticated attacker can retrieve saved cleartext credentials via a GET request to settings.php. Because the application was not exiting after a redirect is applied, the rest of the page still executed, resulting in...

PT-2020-20649

Name of the Vulnerable Software and Affected Versions rConfig versions prior to 3.9.4 Description An issue in the includes/head.inc.php file allows an unauthenticated attacker to retrieve saved cleartext credentials via a GET request to the "settings.php" endpoint. This occurs because the...

CVE-2020-10568: Cross-Site Request Forgery (CSRF)

The sitepress-multilingual-cms WPML plugin before 4.3.7-b.2 for WordPress has CSRF due to a loose comparison. This leads to remote code execution in includes/class-wp-installer.php via a series of requests that leverage unintended comparisons of integers to strings...

PT-2020-12209

Name of the Vulnerable Software and Affected Versions sitepress-multilingual-cms WPML plugin versions prior to 4.3.7-b.2 Description The issue is due to a loose comparison, leading to CSRF, which can result in remote code execution in includes/class-wp-installer.php via a series of requests that...

PT-2020-12010

Name of the Vulnerable Software and Affected Versions ThemeREX Addons plugin versions prior to 2020-03-09 Description The issue concerns a lack of access control on the "/trx addons/v2/get/sc layout" API endpoint, allowing any user to execute PHP functions. This is due to the trx addons rest get ...

CVE-2019-17228

includes/options.php in the motors-car-dealership-classified-listings aka Motors - Car Dealer & Classified Ads plugin through 1.4.0 for WordPress allows unauthenticated options changes...

CVE-2019-17229: Improper Neutralization of Input During Web Page Generation

includes/options.php in the motors-car-dealership-classified-listings aka Motors - Car Dealer & Classified Ads plugin through 1.4.0 for WordPress has multiple stored XSS issues...

CVE-2019-17228: Insufficient Verification of Data Authenticity

includes/options.php in the motors-car-dealership-classified-listings aka Motors - Car Dealer & Classified Ads plugin through 1.4.0 for WordPress allows unauthenticated options changes...

Exploit for Unrestricted Upload of File with Dangerous Type in Whmcssmarters Web_Tv_Player

PoC IPTV Smarters Exploit Usage python gld.py -u http://w...

Code injection

A vulnerability exits in Status2K 2.5 Server Monitoring Software via the multies parameter to includes/functions.php, which could let a malicious user execute arbitrary PHP code...

PT-2020-7705

Name of the Vulnerable Software and Affected Versions Status2K Server Monitoring Software version 2.5 Description A vulnerability exists in the software via the multies parameter to "includes/functions.php", which could let a malicious user execute arbitrary PHP code. Recommendations For version...

CVE-2014-5091: Improper Input Validation

A vulnerability exits in Status2K 2.5 Server Monitoring Software via the multies parameter to includes/functions.php, which could let a malicious user execute arbitrary PHP code...

CVE-2020-8498

XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id parameter. This allows an attacker with the WordPress Contributor role to execute arbitrary JavaScript code with the privileges of other users e.g., ones who have t...