Malicious user can create a dummy Lendgine contract by mimicing a salt with same encoding format but using a malicious AMM invariant function

Lines of code Vulnerability details Impact Lendgine contract address is created using a salt that is generated by a hash of pool parameters in Factory.sol. A malicious user can create a Lendgine exploit contract that uses the salt generated by exact same encoding but this contract inherits a Pair...

WordPress GS Portfolio for Envato Plugin < 1.4.0 is vulnerable to Cross Site Scripting (XSS)

Software GS Portfolio for Envato Type Plugin Vulnerable versions 1.4.0 Fixed in 1.4.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0559 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID abe3328dc56e Credits István Márto...

WordPress EmbedSocial Plugin < 1.1.28 is vulnerable to Cross Site Scripting (XSS)

Software EmbedSocial Type Plugin Vulnerable versions 1.1.28 Fixed in 1.1.28 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0371 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 80b948605bdb Credits István Márton Required...

WordPress WP Dark Mode Plugin < 4.0.0 is vulnerable to Cross Site Scripting (XSS)

Software WP Dark Mode Type Plugin Vulnerable versions 4.0.0 Fixed in 4.0.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4714 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 41e59045340d Credits István Márton Required...

CVE-2022-27537

Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure. HP is releasing BIOS updates to mitigate these potential vulnerabilities...

WordPress WP Responsive Testimonials Slider And Widget Plugin <= 1.5 is vulnerable to Cross Site Scripting (XSS)

Software WP Responsive Testimonials Slider And Widget Type Plugin Vulnerable versions = 1.5 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4750 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 98b84c639eda...

WordPress Shortcode for Font Awesome Plugin < 1.4.1 is vulnerable to Cross Site Scripting (XSS)

Software Shortcode for Font Awesome Type Plugin Vulnerable versions 1.4.1 Fixed in 1.4.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0419 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 6bad482aa401 Credits István...

WordPress Easy Affiliate Links Plugin < 3.7.1 is vulnerable to Cross Site Scripting (XSS)

Software Easy Affiliate Links Type Plugin Vulnerable versions 3.7.1 Fixed in 3.7.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0375 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 6cffde070434 Credits István Márton...

PT-2023-8231

Name of the Vulnerable Software and Affected Versions Ivanti Connect Secure versions 9.x Ivanti Connect Secure versions 22.x Ivanti Policy Secure versions 9.x Ivanti Policy Secure versions 22.x Description A command injection issue exists in the web components of the software. This occurs because...

WordPress Page Builder: Live Composer Plugin <= 1.5.22 is vulnerable to Cross Site Scripting (XSS)

Software Page Builder: Live Composer Type Plugin Vulnerable versions = 1.5.22 Fixed in 1.5.23 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4669 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 3a851e56815e Credits Istv...

WordPress Timed Content Plugin < 2.73 is vulnerable to Cross Site Scripting (XSS)

Software Timed Content Type Plugin Vulnerable versions 2.73 Fixed in 2.73 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0067 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 0d11099524d5 Credits István Márton Required...

WordPress Upfrontwp Theme <= 1.1 is vulnerable to Cross Site Scripting (XSS)

Software Upfrontwp Type Theme Vulnerable versions = 1.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-24009 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID 4e64aada38f6 Credits Dave Jong Patchstack Required...

WordPress WP Airbnb Review Slider Plugin < 3.3 is vulnerable to SQL Injection

Software WP Airbnb Review Slider Type Plugin Vulnerable versions 3.3 Fixed in 3.3 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-0262 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID e5bb0170c3f4 Credits István Márton Required privilege Subscriber...

WordPress Contact Form 7 Dynamic Text Extension Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS)

Software Contact Form 7 Dynamic Text Extension Type Plugin Vulnerable versions = 2.0.3 Fixed in 3.0.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 64fbad36bbc4 Credits Unknow...

WordPress RegistrationMagic Plugin <= 5.1.9.2 is vulnerable to Other Vulnerability Type

Software RegistrationMagic Type Plugin Vulnerable versions = 5.1.9.2 Fixed in 5.1.9.3 OWASP Top 10 A6: Security Misconfiguration Classification Other Vulnerability Type CVE CVE-2023-23976 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID f7bad77a6622 Credits yuyudhn Requir...

WordPress M Chart Plugin <= 1.9.4 is vulnerable to Cross Site Scripting (XSS)

Software M Chart Type Plugin Vulnerable versions = 1.9.4 Fixed in 1.10 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23892 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 383eb1775479 Credits thiennv Required privilege...

ReDoS based DoS vulnerability in Action Dispatch

There is a possible regular expression based DoS vulnerability in Action Dispatch. This vulnerability has been assigned the CVE identifier CVE-2023-22792. Versions Affected: = 3.0.0 Not affected: 3.0.0 Fixed Versions: 5.2.8.15 Rails LTS, 6.1.7.1, 7.0.4.1 Impact Specially crafted cookies, in...

WordPress MainWP Rocket Extension Plugin <= 4.0.3 is vulnerable to Settings Change

Software MainWP Rocket Extension Type Plugin Vulnerable versions = 4.0.3 Fixed in 4.0.4 OWASP Top 10 A5: Broken Access Control Classification Settings Change CVE CVE-2023-23665 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 5dab77b10cf4 Credits Dave Jong Patchstack...

WordPress MainWP White Label Extension Plugin <= 4.1.1 is vulnerable to Broken Access Control

Software MainWP White Label Extension Type Plugin Vulnerable versions = 4.1.1 Fixed in 4.1.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-23748 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 4cf93d58a995 Credits Dave Jong...

WordPress MainWP iThemes Security Extension Plugin <= 4.1.1 is vulnerable to Broken Access Control

Software MainWP iThemes Security Extension Type Plugin Vulnerable versions = 4.1.1 Fixed in 4.1.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-23643 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 4ac1fa6eea51 Credits Dave...