D-Link Go-RT-AC750 命令注入漏洞

The D-Link GO-RT-AC750 is a wireless dual-band simple router from China-based AUO D-Link. A security vulnerability exists in the D-Link Go-RT-AC750 revAv101b03 version, which was discovered to contain a command injection vulnerability via the service parameter of soapcgi.main...

PT-2023-17233 · Rockoa · Rockoa

Name of the Vulnerable Software and Affected Versions: Rockoa version 2.3.2 Description: A critical issue has been found in the Configuration File Handler component, specifically affecting the webmainConfig.php file. This issue leads to code injection and can be initiated remotely. The exploit fo...

Node.js: Permissions policies can be bypassed via process.mainModule

A privilege escalation vulnerability exists in Node.js 19.6.1, 18.14.1, 16.19.1 and 14.21.3 that made it possible to bypass the experimental Permissions https://nodejs.org/api/permissions.html feature in Node.js and access non authorized modules by using process.mainModule.require. This only...

CVE-2023-1575

The Mega Main Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parameters in versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2023-1680

A vulnerability, which was classified as problematic, has been found in Xunrui CMS 4.61. This issue affects some unknown processing of the file /dayrui/My/View/main.html. The manipulation leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed to the...

CVE-2023-1575

The Mega Main Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parameters in versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

Cross site scripting

The Mega Main Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parameters in versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2023-1575

The CVE-2023-1575 entry describes a Stored XSS flaw in the Mega Main Menu WordPress plugin up to version 2.2.2, stemming from insufficient input sanitization and output escaping. Exploitation requires authenticated admin-level access and affects multisite installs or sites with unfiltered_html di...

CVE-2023-1575 Mega Main Menu <= 2.2.2 - Authenticated (Administrator+) Cross-Site Scripting

The Mega Main Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parameters in versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

WordPress Plugin Mega Main Menu 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

PT-2023-17091 · WordPress · Mega Main Menu

Name of the Vulnerable Software and Affected Versions: Mega Main Menu plugin for WordPress versions up to, and including, 2.2.2 Description: The issue is related to Stored Cross-Site Scripting via some of the plugin's settings parameters due to insufficient input sanitization and output escaping...

CVE-2023-1556

A vulnerability was found in SourceCodester Judging Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file summaryresults.php. The manipulation of the argument maineventid leads to sql injection. The attack can be launched...

Judging Management System SQL注入漏洞

Judging Management System is a Judging Management System by Carlo Montero Personal Developer. A SQL injection vulnerability exists in the SourceCodester Judging Management System version 1.0, which stems from a security issue with an unknown function in the file summaryresults.php, which leads to...

PT-2023-17072 · Unknown · Sourcecodester Judging Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Judging Management System version 1.0 Description: A critical issue has been found in the system, affecting an unknown functionality of the file summary results.php. The manipulation of the main event id argument leads to SQL...

Linux kernel 代码问题漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A code issue vulnerability exists in Linux kernel version 6.2.6 and earlier versions, which stems from a missing locksock call in the dotlsgetsockopt function in...

Malicious Package

Overview browser-main-obj-redirect is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

Malicious Package

Overview browser-main is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

Malicious Package

Overview browser-main-unmodified is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

The vulnerability of the soapcgi_main() function in the D-Link DIR-859 A1 router’s microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the soapcgimain function in the D-Link DIR-859 A1 router’s microprogramming software is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

UBUNTU-CVE-2023-23918

A privilege escalation vulnerability exists in Node.js 19.6.1, 18.14.1, 16.19.1 and 14.21.3 that made it possible to bypass the experimental Permissions https://nodejs.org/api/permissions.html feature in Node.js and access non authorized modules by using process.mainModule.require. This only...