PT-2023-3198 · Microsoft +1 · Visual Studio +3

Name of the Vulnerable Software and Affected Versions: .NET, .NET Framework, and Visual Studio affected versions not specified Description: The issue is related to insufficient input validation in the .NET, .NET Framework, and Visual Studio software platforms. This can be exploited by an attacker...

PT-2023-3127 · Microsoft · Exchange Server

Name of the Vulnerable Software and Affected Versions: Microsoft Exchange Server affected versions not specified Description: The issue is related to insufficient input validation in Microsoft Exchange Server, allowing a remote attacker to execute arbitrary code. This can affect the system...

PT-2023-3197 · Microsoft · .Net Framework

Name of the Vulnerable Software and Affected Versions: Microsoft .NET Framework affected versions not specified Description: The issue is related to insufficient input validation in the Microsoft .NET Framework, which can be exploited by a remote attacker to cause a denial of service using...

PT-2023-3190 · Microsoft · Windows Geolocation Service +1

Name of the Vulnerable Software and Affected Versions: Windows Geolocation Service affected versions not specified Description: The issue is related to insufficient input validation in the Windows Geolocation Service, which can be exploited by an attacker to execute arbitrary code using a special...

PT-2023-3400 · Microsoft · Office Excel

Name of the Vulnerable Software and Affected Versions: Microsoft Excel affected versions not specified Description: The issue is related to insufficient input validation in Microsoft Excel, allowing an attacker to execute arbitrary code. This can enable remote attackers to affect the system...

PT-2023-3399 · Microsoft · Office Excel

Name of the Vulnerable Software and Affected Versions: Microsoft Excel affected versions not specified Description: The issue is related to insufficient input validation in Microsoft Excel. It allows remote attackers to execute arbitrary code, potentially affecting the system. Recommendations: At...

PT-2023-3124 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to insufficient input validation in the Windows Hello biometric authentication function of Windows operating systems. This can be exploited to execute arbitrary code...

PT-2023-3099

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server affected versions not specified Description The vulnerability in Microsoft Exchange Server is related to insufficient input validation, allowing a remote attacker to execute arbitrary code using specially crafted inpu...

PT-2023-3115 · Microsoft +1 · Visual Studio +3

Name of the Vulnerable Software and Affected Versions: .NET Framework versions affected versions not specified .NET versions affected versions not specified Visual Studio versions affected versions not specified Description: The issue is related to insufficient input validation in the software...

Cross site scripting

The FiboSearch - AJAX Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.23.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2023-2031 Locatoraid Store Locator <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Locatoraid Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 3.9.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2023-2305 Download Manager <= 3.2.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdmmembers', 'wpdmloginform', 'wpdmregform' shortcodes in versions up to, and including, 3.2.70 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2023-1917 PowerPress <= 10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The PowerPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

Cross site scripting

The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with minimal permissions like subscribers, to inject...

Cross site scripting

The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting via the updatelayout function in versions up to, and including, 6.2.3 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers, and above, to inject arbitrary web...

Input validation

The WP HTML Mail plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 2.2.10 due to insufficient input sanitization. This makes it possible for unauthenticated attackers to inject arbitrary HTML in pages that execute if they can successfully trick a administrator...

Cross site scripting

The Flo Forms – Easy Drag & Drop Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Options Change by using the floimportformsoptions AJAX action in versions up to, and including, 1.0.35 due to insufficient input sanitization and output escaping along with missing...

Cross site scripting

The WP DSGVO Tools GDPR plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in versions up to, and including, 3.1.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2019-25148 WP HTML Mail < 2.9.1 - HTML Injection

The WP HTML Mail plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 2.9.0.3 due to insufficient input sanitization. This makes it possible for unauthenticated attackers to inject arbitrary HTML in pages that execute if they can successfully trick a administrato...

CVE-2019-25147 Pretty Links <= 2.1.9 - Unauthenticated Stored Cross-Site Scripting via track_link

The Pretty Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via various IP headers as well as the referer header in versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping in the tracklink function. This makes it possible for...