15967 matches found
WooCommerce PensoPay < 6.3.2 - Reflected XSS
Description The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
PT-2023-6084 · Fortinet · Fortiwlm
Name of the Vulnerable Software and Affected Versions: Fortinet FortiWLM versions 8.5.0 through 8.5.4 Fortinet FortiWLM versions 8.6.0 through 8.6.5 Description: The issue is related to an improper neutralization of special elements used in an os command, also known as 'os command injection'. Thi...
Goods Catalog <= 2.4.1 - Contributor+ Stored XSS
Description The plugin does not validate and escape some parameters, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
PT-2023-6088 · Fortinet · Fortiwlm
Name of the Vulnerable Software and Affected Versions: Fortinet FortiWLM versions 8.5.0 through 8.5.4 Fortinet FortiWLM versions 8.6.0 through 8.6.5 Description: The issue exists due to improper neutralization of special elements used in an operating system command, allowing an attacker to execut...
User Feedback < 1.0.8 - Unauthenticated Stored XSS
Description The plugin does not validate and escape some parameters, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks...
OESA-2023-1696 ghostscript security update
Ghostscript is an interpreter for PostScript™ and Portable Document Format PDF files. Ghostscript consists of a PostScript interpreter layer, and a graphics library. Security Fixes: In Artifex Ghostscript through 10.01.2, gdevijs.c in GhostPDL can lead to remote code execution via crafted...
PT-2023-28665 · Unknown · Asset Management System
Name of the Vulnerable Software and Affected Versions: Asset Management System version 1.0 Description: The issue is an Authenticated SQL Injection vulnerability that affects the first name and last name parameters of the user.php page. This allows an authenticated attacker to dump all the conten...
The vulnerability of the SetHostIPv6StaticSettings function in the D-Link DAP-1325 wireless signal booster software allows a hacker to execute arbitrary code.
The vulnerability of the SetHostIPv6StaticSettings function in the D-Link DAP-1325 wireless signal booster software relates to the lack of measures taken to neutralize special elements during the processing of request parameters. Exploiting this vulnerability could allow a remote attacker to...
CVE-2023-43323
mooSocial 3.1.8 is vulnerable to external service interaction on post function. When executed, the server sends a HTTP and DNS request to external server. The Parameters effected are multiple - messageText, datawallphoto, datauserShareVideo and datauserShareLink...
CVE-2023-43323
mooSocial 3.1.8 is vulnerable to external service interaction on post function. When executed, the server sends a HTTP and DNS request to external server. The Parameters effected are multiple - messageText, datawallphoto, datauserShareVideo and datauserShareLink...
ShokoServer Path Traversal Vulnerability
ShokoServer is an anime collection management platform. ShokoServer suffers from a path traversal vulnerability that stems from not cleaning parameters. An attacker can read arbitrary files by exploiting this vulnerability...
CVE-2023-43192
SQL injection can exist in a newly created part of the SpringbootCMS 1.0 background, and the parameters submitted by users are not filtered. As a result, special characters in parameters destroy the original logic of SQL statements. Attackers can use this vulnerability to execute any SQL statemen...
CVE-2023-43192
SQL injection can exist in a newly created part of the SpringbootCMS 1.0 background, and the parameters submitted by users are not filtered. As a result, special characters in parameters destroy the original logic of SQL statements. Attackers can use this vulnerability to execute any SQL statemen...
Sql injection
SQL injection can exist in a newly created part of the SpringbootCMS 1.0 background, and the parameters submitted by users are not filtered. As a result, special characters in parameters destroy the original logic of SQL statements. Attackers can use this vulnerability to execute any SQL statemen...
WordPress Plugin WP Event Manager Cross-Site Scripting Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
PT-2023-5572 · Tenda · Tenda Ac10
Name of the Vulnerable Software and Affected Versions: Tenda AC10U version 1.0 US AC10UV1.0RTL V15.03.06.49 multi TDE01 Description: The issue is related to multiple stack overflows in the formSetMacFilterCfg function, which can be exploited via the macFilterType and deviceList parameters. This c...
Simple Staff List < 2.2.4 - Editor+ Stored XSS
Description The plugin does not validate and escape some parameters, which could allow users with the editor role and above to perform Stored Cross-Site Scripting attacks...
Save as Image by Pdfcrowd < 2.16.1 - Admin+ Stored XSS
Description The plugin does not validate and escape some parameters, which could allow users with the admin role and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
Sermon'e – Sermons Online <= 1.0.0 - Reflected XSS
Description The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
Slimstat Analytics < 5.0.9 - Admin+ Stored XSS
Description The plugin does not validate and escape some parameters, which could allow users with the admin role and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...