VulnCheck KEV: CVE-2022-27926

Synacor Zimbra Collaboration Suite ZCS contains a cross-site scripting vulnerability by allowing an endpoint URL to accept parameters without sanitizing...

Easy Forms for MailChimp < 6.8.8 - Reflected XSS

The plugin does not sanitise and escape some parameters before outputting them back in the response, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC Make a logged in admin open a page with the following code this requires the attacker...

SUSE CVE-2023-1625

An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reveal parameters which are supposed to remain hidden. This has a low impact to the confidentiality, integrity, and availability of the system...

PT-2023-7387 · Unknown · Osprey Pump Controller

Name of the Vulnerable Software and Affected Versions: Osprey Pump Controller version 1.01 Description: The issue exists due to inadequate protection of the web page structure, allowing a remote attacker to execute arbitrary code. Specifically, inputs passed to a GET parameter are not properly...

Product Specifications for Woocommerce < 0.7.0 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape URL parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

Apache OpenOffice Code Execution Vulnerability (CNVD-2023-25931)

Apache OpenOffice is an open source office software suite from the U.S. Apache Apache Foundation. The suite contains text documents , spreadsheets , presentations , drawings , databases and so on. A code execution vulnerability exists in Apache OpenOffice that originates from a link containing an...

ReQlogic v11.3 - Reflected Cross-Site Scripting Vulnerability

Exploit Title: ReQlogic v11.3 - Reflected Cross-Site Scripting XSS Exploit Author: Okan Kurtulus Vendor Homepage: https://reqlogic.com Version: 11.3 Tested on: Linux CVE : 2022-41441 Proof of Concept: 1- Install ReQlogic v11.3 2- Go to...

CVE-2023-26549

The SystemUI module has a vulnerability of repeated app restart due to improper parameters. Successful exploitation of this vulnerability may affect confidentiality...

CVE-2023-0589

The WP Image Carousel WordPress plugin through 1.0.2 does not sanitise and escape some parameters, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks...

CVE-2023-0589 WP Image Carousel <= 1.0.2 - Contributor+ Stored XSS

The WP Image Carousel WordPress plugin through 1.0.2 does not sanitise and escape some parameters, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks...

CVE-2023-0955 WP Statistics < 14.0 - Authenticated SQLi

The WP Statistics WordPress plugin before 14.0 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks. By default, the affected feature is available to users with the manageoptions capability admin+, however the plugin has a settings to allow low...

CVE-2023-24842

HGiga MailSherlock has vulnerability of insufficient access control. An unauthenticated remote user can exploit this vulnerability to access partial content of another user’s mail by changing user ID and mail ID within URL...

CVE-2023-26549

The SystemUI module has a vulnerability of repeated app restart due to improper parameters. Successful exploitation of this vulnerability may affect confidentiality...

Contact Forms by Cimatti < 1.5.5 - Unauthenticated Stored XSS

The plugin does not sanitise and escape some parameters, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks...

Continuous Image Carousel With Lightbox < 1.0.16 - Reflected XSS

The plugin does not sanitise and escape some parameters before outputting them back, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

UBUNTU-CVE-2023-1625

An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reveal parameters which are supposed to remain hidden. This has a low impact to the confidentiality, integrity, and availability of the system...

PT-2023-20723 · Systemui · Systemui

Name of the Vulnerable Software and Affected Versions: SystemUI affected versions not specified Description: The issue is related to the SystemUI module, which has a problem with repeated app restarts due to improper parameters. This could potentially affect confidentiality. Recommendations: At t...

CVE-2023-26549

CVE-2023-26549 involves Huawei HarmonyOS SystemUI. Affected component is the SystemUI module; root cause described as improper parameters causing repeated app restarts. As stated, exploitation may affect confidentiality (I = High, others not indicated). CVSS v3.1 metrics show Confidentiality Impa...

CVE-2023-27796

RG-EW1200G PRO Wireless Routers EW3.01B11P204, RG-EW1800GX PRO Wireless Routers EW3.01B11P204, and RG-EW3200GX PRO Wireless Routers EW3.01B11P204 were discovered to contain multiple command injection vulnerabilities via the data.ip, data.protocal, data.iface and data.package parameters in the...

Command injection

RG-EW1200G PRO Wireless Routers EW3.01B11P204, RG-EW1800GX PRO Wireless Routers EW3.01B11P204, and RG-EW3200GX PRO Wireless Routers EW3.01B11P204 were discovered to contain multiple command injection vulnerabilities via the data.ip, data.protocal, data.iface and data.package parameters in the...