PT-2023-30999 · Jupiter · Jupiterx

Name of the Vulnerable Software and Affected Versions: Jupiter version 1.3.1 Description: A deserialization vulnerability allows attackers to execute arbitrary commands via sending a crafted RPC request. Recommendations: For Jupiter version 1.3.1, consider disabling the deserialization...

PT-2023-29038 · Emsigner · Emsigner

Name of the Vulnerable Software and Affected Versions: EMSigner version 2.8.7 Description: The issue is related to incorrect access control in the AdHoc User creation form, allowing unauthenticated attackers to modify usernames and privileges using the email address of a registered user...

Input validation

The MStore API plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation in versions up to, and including, 4.10.7 due to improper implementation of the Apple login feature. This allows unauthenticated attackers to log in as any user as long as they know the user's...

PT-2023-26629 · Unknown · Tire-Sales Line

Name of the Vulnerable Software and Affected Versions: tire-sales Line version 13.6.1 Description: An issue in the software allows a remote attacker to obtain sensitive information via a crafted GET request. Recommendations: For version 13.6.1, consider restricting access to sensitive information...

PT-2023-25752 · Totolink · Totolink Cp300+

Name of the Vulnerable Software and Affected Versions: TOTOLINK CP300+ version 5.2cu.7594 B20200910 Description: A stack overflow issue was discovered via the pingIp parameter in the setDiagnosisCfg function. This allows for potential exploitation. Recommendations: For TOTOLINK CP300+ version...

PT-2023-29032 · Netis · Netis N3Mv2

Name of the Vulnerable Software and Affected Versions: Netis N3Mv2 version 1.0.1.865 Description: A command injection issue was discovered in the Wake-On-LAN WoL function via the wakeup mac parameter. This issue can be exploited using a crafted payload. Recommendations: For Netis N3Mv2 version...

PT-2023-28739 · Yzncms · Yzncms

Name of the Vulnerable Software and Affected Versions: YZNCMS version 1.3.0 Description: A stored cross-site scripting XSS issue in the cms/content/edit component allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title parameter. This enables...

PT-2023-23431 · Fuxa · Fuxa

Name of the Vulnerable Software and Affected Versions: FUXA versions 1.1.12 and earlier Description: The issue allows for Local File Inclusion via the "/api/download" API endpoint. This could potentially be exploited to access sensitive files on the system. Recommendations: For versions 1.1.12 an...

PT-2023-27665 · Tenda · Tenda Ac6

Name of the Vulnerable Software and Affected Versions: Tenda AC6 version US AC6V1.0BR V15.03.05.16 multi TD01.bin Description: The issue concerns a command execution vulnerability in the sub ADF3C function. This vulnerability is exploited through the formSetIptv function, which obtains the list a...

PT-2023-8337 · Unknown · Smartnode Sn200

Name of the Vulnerable Software and Affected Versions: SmartNode SN200 aka SN200 version 3.21.2-23021 Description: The issue is related to the Network Diagnostic Commands function of the SmartNode SN200 analog telephone adapter's firmware, which fails to neutralize special elements used in an...

PT-2023-25687 · 3S Smart Software Solutions · Codesys Development System +1

Name of the Vulnerable Software and Affected Versions: CODESYS Development System versions 3.5.9.0 through 3.5.17.0 CODESYS Scripting versions 4.0.0.0 through 4.1.0.0 Description: The issue is related to unsafe directory permissions in the affected software. This could allow an attacker with loca...

PT-2023-26247 · Unknown · Chengdu Flash Flood Disaster Monitoring/Warning System

Name of the Vulnerable Software and Affected Versions: Chengdu Flash Flood Disaster Monitoring and Warning System version 2.0 Description: A vulnerability was found in the Chengdu Flash Flood Disaster Monitoring and Warning System. It affects some unknown functionality of the file...

PT-2023-6541 · Icewarp · Icewarp

Name of the Vulnerable Software and Affected Versions: IceWarp version 10.2.1 Description: The issue is related to a cross-site scripting XSS vulnerability. This vulnerability can be exploited via the color parameter, allowing a remote attacker to conduct cross-site scripting attacks...

PT-2023-24975 · Eyoucms · Eyoucms

Name of the Vulnerable Software and Affected Versions: Eyoucms version 1.6.2 Description: A stored cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the web recordnum parameter. This enables attackers to potentially...

PT-2023-23998 · Unknown · Phpgurukul Rail Pass Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Rail Pass Management System version 1.0 Description: A critical vulnerability was found in the PHPGurukul Rail Pass Management System. The issue affects an unknown functionality of the file /view-pass-detail.php, specifically the...

PT-2023-22559 · Prestashop · Prestashop Leocustomajax

Name of the Vulnerable Software and Affected Versions: PrestaShop leocustomajax version 1.0 PrestaShop leocustomajax version 1.0.0 Description: The issue is related to SQL Injection. It affects the module via the "modules/leocustomajax/leoajax.php" endpoint. Recommendations: For PrestaShop...

PT-2023-25002 · Bloofox · Bloofox

Name of the Vulnerable Software and Affected Versions: bloofox version 0.5.2.1 Description: The issue is related to a SQL injection vulnerability. It can be exploited via the cid parameter at the "admin/index.php?mode=settings&page=charset&action=edit" endpoint. Recommendations: For bloofox versi...

PT-2023-13465 · Unknown · Shop Beat Media Player

Name of the Vulnerable Software and Affected Versions: Shop Beat Media Player versions 2.5.95 through 3.2.57 Description: The issue concerns an Insecure Direct Object Reference IDOR vulnerability. It is exploited via the controlpanel.shopbeat.co.za endpoint. Recommendations: For versions 2.5.95...

PT-2023-24485 · Xxl-Job · Xxl-Job

Name of the Vulnerable Software and Affected Versions: XXL-Job version 2.4.1 Description: A lateral privilege escalation issue allows users to execute arbitrary commands on another user's account via a crafted POST request to the "/jobinfo/" API endpoint. Recommendations: For XXL-Job version 2.4....

PT-2023-21313 · Unknown · Idurar Erp/Crm

Name of the Vulnerable Software and Affected Versions: IDURAR ERP/CRM version 1 Description: The issue is related to a SQL injection vulnerability. It affects the /api/login component. Recommendations: For IDURAR ERP/CRM version 1, consider restricting access to the /api/login endpoint until a...