Delta Electronics DIAEnergie SQL注入漏洞

A SQL blind injection vulnerability exists in the /DataHandler/HandlerCFG.ashx endpoint in DIAEnergie 1.7.5 and earlier versions. The vulnerability stems from the application not properly validating the value provided by the user via the parameter keyword before using the value as part of a SQL...

SQL Injection

Overview s-cart/core is a free Laravel e-commerce for business. Affected versions of this package are vulnerable to SQL Injection via the keyword parameter in /scadmin/currency. Remediation Upgrade s-cart/core to version 6.3.0.3 or higher. References - GitHub Additional Information - GitHub Commi...

WordPress Keyword Meta plugin <= 3.0 - Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS)

Cross-Site Request Forgery CSRF leading to Stored Cross-Site Scripting XSS discovered by Genubhau Wayal in WordPress Keyword Meta plugin versions = 3.0. Solution This plugin has been closed as of June 2, 2021 and is not available for download. Reason: Security Issue...

CVE-2020-22200

Directory Traversal vulnerability in phpCMS 9.1.13 via the q parameter to publicgetsuggestkeyword...

PT-2021-10744

Name of the Vulnerable Software and Affected Versions phpCMS version 9.1.13 Description The issue is related to a Directory Traversal vulnerability. It can be exploited via the q parameter to the "public get suggest keyword" endpoint. Recommendations For phpCMS version 9.1.13, consider restrictin...

Incorrect Permission Assignment for Critical Resource in Plone

Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script...

PT-2021-15837

Name of the Vulnerable Software and Affected Versions PickPlugins Product Slider for WooCommerce WordPress plugin versions prior to 1.13.22 Description The issue is related to the slider import search feature, which did not properly sanitize the keyword GET parameter, leading to a reflected...

WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in the WooCommerce WordPress plugin for PickPlugins Product slider...

CVE-2021-24300: Improper Neutralization of Input During Web Page Generation

The slider import search feature of the PickPlugins Product Slider for WooCommerce WordPress plugin before 1.13.22 did not properly sanitised the keyword GET parameter, leading to reflected Cross-Site Scripting issue...

CVE-2021-33509

Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script...

PYSEC-2021-81

Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script...

CVE-2020-16632

A XSS Vulnerability in /uploads/dede/actionsearch.php in DedeCMS V5.7 SP2 allows an authenticated user to execute remote arbitrary code via the keyword parameter...

Cross site scripting

A XSS Vulnerability in /uploads/dede/actionsearch.php in DedeCMS V5.7 SP2 allows an authenticated user to execute remote arbitrary code via the keyword parameter...

PT-2021-9873

Name of the Vulnerable Software and Affected Versions DedeCMS version V5.7 SP2 Description A XSS issue in the "/uploads/dede/action search.php" endpoint allows an authenticated user to execute remote arbitrary code via the keyword parameter. Recommendations For DedeCMS version V5.7 SP2, as a...

CVE-2020-16632: Improper Neutralization of Input During Web Page Generation

A XSS Vulnerability in /uploads/dede/actionsearch.php in DedeCMS V5.7 SP2 allows an authenticated user to execute remote arbitrary code via the keyword parameter...

PT-2021-15780

Name of the Vulnerable Software and Affected Versions Realteo WordPress plugin versions prior to 1.2.4 Description The issue is related to an unauthenticated reflected Cross-Site Scripting problem. It occurs because the keyword search, search radius, bedrooms, and bathrooms GET parameters are not...

WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress plugin Realteo prior to version 1.2.4, whic...

Realteo < 1.2.4 - Unauthenticated Reflected Cross-Site Scripting (XSS)

The plugin, used by the Findeo Theme, did not properly sanitise the keywordsearch, searchradius. bedrooms and bathrooms GET parameters before outputting them in its properties page, leading to an unauthenticated reflected Cross-Site Scripting issue. PoC...

CVE-2021-20270

An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML SML source file, as demonstrated by input that only contains the "exception" keyword...

fio:fuzz_parseini: Heap-buffer-overflow in fio_keyword_replace

Project: https://github.com/axboe/fio.git Detailed Report: https://oss-fuzz.com/testcase?key=5913552609214464 Project: fio Fuzzing Engine: libFuzzer Fuzz Target: fuzzparseini Job Type: libfuzzerasanfio Platform Id: linux Crash Type: Heap-buffer-overflow READ 5 Crash Address: 0x602000001638 Crash...