CVE-2023-45394

Stored Cross-Site Scripting XSS vulnerability in the Company field in the "Request a Quote" Section of Small CRM v3.0 allows an attacker to store and execute malicious javascript code in the Admin panel which leads to Admin account takeover...

PHPGurukul Small CRM 跨站脚本漏洞

Small CRM is a customer relationship management system. Small CRM suffers from a cross-site scripting vulnerability that stems from a lack of effective filtering and escaping of data provided in the Request a Quote field, which can be exploited by an attacker to store and execute malicious...

CVE-2023-45394: Improper Neutralization of Input During Web Page Generation

Stored Cross-Site Scripting XSS vulnerability in the Company field in the "Request a Quote" Section of Small CRM v3.0 allows an attacker to store and execute malicious javascript code in the Admin panel which leads to Admin account takeover...

CVE-2023-45208

A command injection in the parsingxmlstasurvey function inside libcgifunc.so of the D-Link DAP-X1860 repeater 1.00 through 1.01b05-01 allows attackers within range of the repeater to run shell commands as root during the setup process of the repeater, via a crafted SSID. Also, network names...

Amazon Linux 2 : php (ALASPHP8.2-2023-003)

The version of php installed on the remote host is prior to 8.2.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2PHP8.2-2023-003 advisory. A flaw was found in PHP. This issue occurs due to an uncaught integer overflow in PDO::quote of PDOSQLite returning an improperly...

Medium: php

Issue Overview: A flaw was found in PHP. This issue occurs due to an uncaught integer overflow in PDO::quote of PDOSQLite returning an improperly quoted string. With the implementation of sqlite3snprintf, it is possible to force the function to return a single apostrophe if the function is called...

CLSA-2023-1695319921 Fix CVE(s): CVE-2023-39417

SECURITY UPDATE: Extension script @substitutions@ within quoting allow SQL injection - debian/patches/CVE-2023-39417.patch: filter each substitution through quoteidentifier - CVE-2023-39417...

The vulnerability of the `quote_for_pmake` function in the NASM assembler allows a attacker to trigger a service failure.

The vulnerability of the quoteforpmake function in the NASM assembler is related to copying data into a buffer without checking its size. Exploiting this vulnerability could allow an attacker to cause service failures remotely...

Medium: php

Issue Overview: A flaw was found in PHP. This issue occurs due to an uncaught integer overflow in PDO::quote of PDOSQLite returning an improperly quoted string. With the implementation of sqlite3snprintf, it is possible to force the function to return a single apostrophe if the function is called...

Medium: php

Issue Overview: A flaw was found in PHP. This issue occurs due to an uncaught integer overflow in PDO::quote of PDOSQLite returning an improperly quoted string. With the implementation of sqlite3snprintf, it is possible to force the function to return a single apostrophe if the function is called...

U.S. Dept Of Defense: authentication bypass

An authentication bypass vulnerability was discovered in the login page of a web portal, allowing unauthorized access without providing valid credentials...

OESA-2023-1622 php security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

OESA-2023-1621 php security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

OESA-2023-1619 php security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

All in One B2B for WooCommerce <= 1.0.3 - Multiple CSRF

Description The plugin does not properly check nonce values in several actions, allowing an attacker to perform CSRF attacks. This CSRF attack will reject a Quote in the database. 1. Go to All In One Quote Quotes 2. Click "Add quote", fill in the title, and save. 3. Find the Quote ID, convert it ...

SUSE CVE-2022-29654

Buffer overflow vulnerability in quoteforpmake in asm/nasm.c in nasm before 2.15.05 allows attackers to cause a denial of service via crafted file...

CVE-2022-29654

Buffer overflow vulnerability in quoteforpmake in asm/nasm.c in nasm before 2.15.05 allows attackers to cause a denial of service via crafted file...

UBUNTU-CVE-2022-29654

Buffer overflow vulnerability in quoteforpmake in asm/nasm.c in nasm before 2.15.05 allows attackers to cause a denial of service via crafted file...

CVE-2023-26443

Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements. With existing sanitization in place, this can be abused to trigger benign SQL Exceptions but could potentially be escalated to a malicious SQL injection vulnerability. We now properly encode single...

Sql injection

Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements. With existing sanitization in place, this can be abused to trigger benign SQL Exceptions but could potentially be escalated to a malicious SQL injection vulnerability. We now properly encode single...