CVE-2023-0340 Custom Content Shortcode <= 4.0.2 - Contributor+ LFI

The Custom Content Shortcode WordPress plugin through 4.0.2 does not validate one of its shortcode attribute, which could allow users with a contributor role and above to include arbitrary files via a traversal attack. This could also allow them to read non PHP files and retrieve their content. R...

CVE-2023-0340

The CVE-2023-0340 issue affects the Custom Content Shortcode WordPress plugin (

CVE-2023-0340 Custom Content Shortcode <= 4.0.2 - Contributor+ LFI

The Custom Content Shortcode WordPress plugin through 4.0.2 does not validate one of its shortcode attribute, which could allow users with a contributor role and above to include arbitrary files via a traversal attack. This could also allow them to read non PHP files and retrieve their content. R...

CVE-2023-0340: Undefined Security Weakness

The Custom Content Shortcode WordPress plugin through 4.0.2 does not validate one of its shortcode attribute, which could allow users with a contributor role and above to include arbitrary files via a traversal attack. This could also allow them to read non PHP files and retrieve their content. R...

Metasploit Weekly Wrap-Up

FortiNAC EITW Content Added Whilst we did have a few cool new modules added this week, one particularly interesting one was a Fortinet FortiNAC vulnerability, CVE-2022-39952, that was added in by team member Jack Heysel. This module exploits an unauthenticated RCE in Fortinet FortiNAC versions...

CVE-2023-27037

Qibosoft QiboCMS v7 was discovered to contain a remote code execution RCE vulnerability via the GetTitle function at labelsetrs.php...

Bitbucket Environment Variable Remote Command Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Bitbucket Environment Variable RCE', 'Description' = %q For various versions of Bitbucket, there is an authenticated command injection...

CVE-2023-27037

Qibosoft QiboCMS v7 was discovered to contain a remote code execution RCE vulnerability via the GetTitle function at labelsetrs.php...

CVE-2023-27040

CVE-2023-27040 affects Simple Image Gallery v1.0, with a remote code execution (RCE) vulnerability exploitable via the username parameter. Connected sources confirm the issue leads to high-impact outcomes (CONFIDENTIALITY, INTEGRITY, AVAILABILITY all at HIGH) and indicate network-level access wit...

CVE-2023-27037

Qibosoft QiboCMS v7 is affected by a remote code execution (RCE) vulnerability in the Get_Title function of label_set_rs.php. The CVE entry CVE-2023-27037 documents impact on QiboCMS v7 and indicates high-severity risk (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C/H/I/H). Several connected sources corrobo...

CVE-2023-27040

Simple Image Gallery v1.0 was discovered to contain a remote code execution RCE vulnerability via the username parameter...

Adobe Photoshop Multiple RCE Vulnerabilities (APSB23-11) - Windows

Adobe Photoshop is prone to multiple remote code execution RCE vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Adobe Photoshop RCE Vulnerability (APSB23-23)- Mac OS X

Adobe Photoshop is prone to a high-risk vulnerability that can lead to remote code execution RCE. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-on...

CVE-2023-27757: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in the /admin/user/uploadImg component of PerfreeBlog v3.1.1 allows attackers to execute arbitrary code via a crafted JPG file...

Adobe Photoshop Multiple RCE Vulnerabilities (APSB23-11) - Mac OS X

Adobe Photoshop is prone to multiple remote code execution RCE vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Patch Tuesday - March 2023

Microsoft is offering fixes for 101 security issues for March 2023 Patch Tuesday, including two zero-day vulnerabilities; the most interesting of the two zero-day vulnerabilities is a flaw in Outlook which allows an attacker to authenticate against arbitrary remote resources as another user...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

Proof of Concept for Log4j CVE-2021-44228 Disclaimer Th...

CVE-2023-24867

Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability...

CVE-2023-23403

Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability...

CVE-2023-24907

CVE-2023-24907 describes a remote code execution vulnerability in the Microsoft PostScript and PCL6 Class Printer Driver . The CVE entry (as per NVD) has a CVSS 3.1 base score of 8.8 (High) with vectors: AV:N, AC:L, PR:L, UI:N, S:U, C:H, I:H, A:H, indicating network attack with no user interactio...