PT-2026-113667

The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or input sanitization before storing certain values from a request, allowing unauthenticated users to inject HTML and links that are rendered to visitors on the storefront...

PT-2025-27538

Name of the Vulnerable Software and Affected Versions: AVTECH DVR devices affected versions not specified Description: An unauthenticated command injection issue exists in AVTECH DVR devices. This is due to the lack of input sanitization when using wget in the "Search.cgi?action=cgi query"...

CVE-2024-51569 Apache NimBLE: Lack of input sanitization leading to out-of-bound reads in Number of Completed Packets HCI event handler

Out-of-bounds Read vulnerability in Apache NimBLE. Missing proper validation of HCI Number Of Completed Packets could lead to out-of-bound access when parsing HCI event and invalid read from HCI transport memory. This issue requires broken or bogus Bluetooth controller and thus severity is...

CVE-2024-46326: URL Redirection to Untrusted Site

Public Knowledge Project pkp-lib 3.4.0-7 and earlier is vulnerable to Open redirect due to a lack of input sanitization in the logout function...

CVE-2024-9148: Improper Neutralization of Input During Web Page Generation

Flowise 2.1.1 suffers from a Stored Cross-Site vulnerability due to a lack of input sanitization in Flowise Chat Embed 2.0.0...

Exploit for CVE-2024-41453

CVE-2024-41453 CVE-2024-41454 ProcessMaker Vulnerabilites...

CVE-2024-3028

CVE-2024-3028 affects mintplex-labs/anything-llm. The issue is improper input validation in the system-preferences API where manipulating the logo_filename parameter can cause reading of arbitrary files (including .env) and deletion via remove-logo. Root cause: lack of proper sanitization of user...

CVE-2023-36463

Meldekarten generator is an open source project to create a program, running locally in the browser without the need for an internet-connection, to create, store and print registration cards for volunteers. All text fields on the webpage are vulnerable to XSS attacks. The user input isn't fully...

CVE-2023-28839

Shoppingfeed PrestaShop is an add-on to the PrestaShop ecommerce platform to synchronize data. The module Shoppingfeed for PrestaShop is vulnerable to SQL injection between version 1.4.0 and 1.8.2 due to a lack of input sanitization. This issue has been addressed in version 1.8.3. Users are advis...

CVE-2023-28839: Improper Neutralization of Special Elements used in an SQL Command

Shoppingfeed PrestaShop is an add-on to the PrestaShop ecommerce platform to synchronize data. The module Shoppingfeed for PrestaShop is vulnerable to SQL injection between version 1.4.0 and 1.8.2 due to a lack of input sanitization. This issue has been addressed in version 1.8.3. Users are advis...

PT-2022-14854

Name of the Vulnerable Software and Affected Versions WP Duplicate Page WordPress plugin versions prior to 1.3 Description The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks, even when unfiltered html is disallowed, due to the plugin not sanitizing and...

CVE-2021-23429: Improper Handling of Exceptional Conditions

All versions of package transpile are vulnerable to Denial of Service DoS due to a lack of input sanitization or whitelisting, coupled with improper exception handling in the .to function...

PT-2021-4143

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 5.8.5 Description The issue is related to insecure privilege management in the clean.php file of the Nagios XI monitoring tool. It allows an attacker to escalate their privileges due to the lack of input sanitizatio...

PT-2021-1878

Name of the Vulnerable Software and Affected Versions Cisco Data Center Network Manager DCNM affected versions not specified Description The issue is related to multiple vulnerabilities in the web-based management interface of Cisco Data Center Network Manager DCNM, which could allow a remote...

PT-2020-20271

Name of the Vulnerable Software and Affected Versions ALEOS versions 4.11 and later Description The issue is related to a lack of input sanitization in the UpdateRebootMgr service, allowing an escalation to root from a low-privilege process. Recommendations For ALEOS versions 4.11 and later, at t...

PT-2020-6831 · Unknown +5 · Cifs-Utils +5

Name of the Vulnerable Software and Affected Versions: cifs-utils affected versions not specified Description: The issue is related to the mount.cifs command in cifs-utils, which invokes a shell when requesting the Samba password. This could allow an attacker to inject arbitrary commands,...

CVE-2017-1002017

Vulnerability in wordpress plugin gift-certificate-creator v1.0, The code in gc-list.php doesn't sanitize user input to prevent a stored XSS vulnerability...

PT-2013-1313

Name of the Vulnerable Software and Affected Versions node-printer versions 0.0.1 and earlier Description The issue is related to the printDirect function in the node-printer module, which allows remote attackers to execute arbitrary commands via unspecified characters in the lpr command. This is...

Torrential 1.2 - 'Getdox.php' Directory Traversal

source: https://www.securityfocus.com/bid/15530/info Torrential is prone to a directory traversal vulnerability. This is due to a lack of proper sanitization of user-supplied input. An attacker can exploit this issue to retrieve arbitrary remote PHP code on an affected computer with the privilege...