CVE-2023-22710

Unauth. Reflected Cross-Site Scripting XSS vulnerability in chilidevs Return and Warranty Management System for WooCommerce plugin = 1.2.3 versions...

CVE-2023-26535

Cross-Site Request Forgery CSRF vulnerability in WPPOOL Sheets To WP Table Live Sync plugin = 2.12.15 versions...

CVE-2023-35044

Cross-Site Request Forgery CSRF vulnerability in Drew Phillips Securimage-WP plugin = 3.6.16 versions...

CVE-2023-45071

Unauth. Stored Cross-Site Scripting XSS vulnerability in 10Web Form Builder Team Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin = 1.15.18 versions...

CVE-2023-35040

Missing Authorization vulnerability in SendPress SendPress Newsletters.This issue affects SendPress Newsletters: from n/a through 1.23.11.6...

CVE-2023-37892

Cross-Site Request Forgery CSRF vulnerability in Kemal YAZICI - PluginPress Shortcode IMDB plugin = 6.0.8 versions...

CVE-2023-45371

An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. There is no rate limit for merging items...

CVE-2023-28821

Concrete CMS previously concrete5 before 9.1 did not have a rate limit for password resets...

CVE-2023-27152

DECISO OPNsense 23.1 does not impose rate limits for authentication, allowing attackers to perform a brute-force attack to bypass authentication...

CVE-2023-1861

The Limit Login Attempts WordPress plugin through 1.7.2 does not sanitize and escape usernames when outputting them back in the logs dashboard, which could allow any authenticated users, such as subscriber to perform Stored Cross-Site Scripting attacks...

CVE-2023-23616

Discourse is an open-source discussion platform. Prior to version 3.0.1 on the stable branch and 3.1.0.beta2 on the beta and tests-passed branches, when submitting a membership request, there is no character limit for the reason provided with the request. This could potentially allow a user to...

CVE-2023-45130

Frontier is Substrate's Ethereum compatibility layer. Prior to commit aea528198b3b226e0d20cce878551fd4c0e3d5d0, at the end of a contract execution, when opcode SUICIDE marks a contract to be deleted, the software uses storage::removeprefix now renamed to storage::clearprefix to remove all storage...

CVE-2023-38684

Discourse is an open source discussion platform. Prior to version 3.0.6 of the stable branch and version 3.1.0.beta7 of the beta and tests-passed branches, in multiple controller actions, Discourse accepts limit params but does not impose any upper bound on the values being accepted. Without an...

CVE-2023-34033

Cross-Site Request Forgery CSRF vulnerability in Malinky Ajax Pagination and Infinite Scroll plugin = 2.0.1 versions...

CVE-2023-24051

A client side rate limit issue discovered in Connectize AC21000 G6 641.139.1.1256 allows attackers to gain escalated privileges via brute force style attacks...

CVE-2022-31184

Discourse is the an open source discussion platform. In affected versions an email activation route can be abused to send mass spam emails. A fix has been included in the latest stable, beta and tests-passed versions of Discourse which rate limits emails. Users are advised to upgrade. Users unabl...

CVE-2022-47138

Cross-Site Request Forgery CSRF vulnerability in German Krutov LOGIN AND REGISTRATION ATTEMPTS LIMIT plugin = 2.1 versions...

CVE-2022-47443

Cross-Site Request Forgery CSRF vulnerability in Daniel Powney Multi Rating plugin = 5.0.5 versions...

CVE-2022-41785

Auth. contributor+ Stored Cross-Site Scripting vulnerability in Galleryape Gallery Images Ape plugin = 2.2.8 versions...

CVE-2022-45091

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Group Arge Energy and Control Systems Smartpower Web allows Cross-Site Scripting XSS. This issue affects Smartpower Web: before 23.01.01...