PT-2023-30768 · WordPress · Embed Privacy

Name of the Vulnerable Software and Affected Versions: Embed Privacy plugin for WordPress versions up to, and including, 1.8.0 Description: The issue is related to Stored Cross-Site Scripting via the embed privacy opt out shortcode due to insufficient input sanitization and output escaping on...

PT-2023-32212 · WordPress · Seraphinite Accelerator

Name of the Vulnerable Software and Affected Versions: Seraphinite Accelerator WordPress plugin versions prior to 2.2.29 Description: The issue concerns the lack of validation for URLs that can redirect authenticated users, potentially leading to arbitrary redirects. Recommendations: For versions...

PT-2023-32231 · WordPress · Article Analytics Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Article Analytics WordPress plugin affected versions not specified Description: The issue arises from the plugin's failure to properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action. This AJAX action is...

PT-2023-30736 · Strapi · Strapi Protected Populate Plugin

Name of the Vulnerable Software and Affected Versions: Strapi Protected Populate Plugin versions prior to 1.3.4 Description: The issue allows users to bypass field level security, enabling them to populate fields they do not have access to. This affects get endpoints, which are protected by the...

PT-2023-32238

Name of the Vulnerable Software and Affected Versions WP Hotel Booking WordPress plugin versions prior to 2.0.8 Description The issue concerns a lack of authorization and CSRF checks, as well as improper handling of user input in SQL statements. This allows unauthenticated users to perform SQL...

PT-2023-26662 · Unknown · Opensis Classic

Name of the Vulnerable Software and Affected Versions: openSIS Classic version 9.0 Description: A reflected cross-site scripting XSS issue allows remote attackers to execute arbitrary JavaScript in a user's web browser. This is achieved by including a malicious payload into the include parameter ...

PT-2023-21956 · Yoast · Yoast Local Premium

Name of the Vulnerable Software and Affected Versions: Yoast Local Premium versions n/a through 14.8 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application tha...

PT-2023-30556 · Korea Sns · Korea Sns

Name of the Vulnerable Software and Affected Versions: Korea SNS versions 1.6.3 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application that the use...

PT-2023-27649 · Opencrx · Opencrx

Name of the Vulnerable Software and Affected Versions: OpenCRX version 5.2.0 Description: The issue allows for HTML injection via the Accounts Group Name Field. Recommendations: For OpenCRX version 5.2.0, update to a version that fixes this issue, or as a temporary workaround, consider validating...

PT-2023-23838 · Kainex · Kainex Wise Chat

Name of the Vulnerable Software and Affected Versions: Kainex Wise Chat versions 3.1.3 and earlier Description: A Cross-Site Request Forgery CSRF issue affects Kainex Wise Chat. This issue allows an attacker to perform unintended actions on a user's account. Recommendations: For versions 3.1.3 an...

PT-2023-28282 · WordPress · Apppresser

Name of the Vulnerable Software and Affected Versions: AppPresser plugin for WordPress versions up to, and including 4.2.5 Description: The issue allows for unauthorized password resets due to the plugin generating a weak reset code. The code used to reset the password has no attempt or time limi...

PT-2023-30503 · WordPress · Labib Ahmed Image Hover Effects

Name of the Vulnerable Software and Affected Versions: Labib Ahmed Image Hover Effects – WordPress Plugin versions 5.5 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended...

CVE-2023-6179 Incorrect Permission assignment to program executable folders

Honeywell ProWatch, 4.5, including all Service Pack versions, contain a Vulnerability in Application Server's executable folders. An attacker could potentially exploit this vulnerability, leading to a standard user to have arbitrary system code execution. Honeywell recommends updating to the most...

PT-2023-30590 · Aweber · Aweber

Name of the Vulnerable Software and Affected Versions: AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth versions n/a through 7.3.9 Description: The issue is related to Missing Authorization and Cross-Site Request Forgery CSRF vulnerability...

PT-2023-32110 · Mcafee · Epolicy Orchestrator

Name of the Vulnerable Software and Affected Versions: ePolicy Orchestrator versions prior to 5.10.0 CP1 Update 2 Description: A Cross Site Request Forgery issue allows a remote low privilege user to add a new user with administrator privileges to the ePO server, impacting the dashboard area of t...

PT-2023-30403 · Cubecart · Cubecart

Name of the Vulnerable Software and Affected Versions: CubeCart versions prior to 6.5.3 Description: A directory traversal issue allows a remote authenticated attacker with administrative privileges to obtain files in the system. Recommendations: For versions prior to 6.5.3, update to version 6.5...

PT-2023-30561 · Cubecart · Cubecart

Name of the Vulnerable Software and Affected Versions: CubeCart versions prior to 6.5.3 Description: The issue allows a remote authenticated attacker with administrative privileges to execute an arbitrary OS command. Recommendations: For versions prior to 6.5.3, update to version 6.5.3 or later t...

PT-2023-30475 · Woocommerce · Gravity Master Product Enquiry For Woocommerce

Name of the Vulnerable Software and Affected Versions: Gravity Master Product Enquiry for WooCommerce plugin versions prior to 3.0 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a...

PT-2023-30472 · WordPress · Ioannup Edit Woocommerce Templates

Name of the Vulnerable Software and Affected Versions: ioannup Edit WooCommerce Templates plugin versions 1.1.1 and earlier Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website,...

Missing sanity checks in Chainlink response

Lines of code Vulnerability details Summary Chainlink responses from price feeds are being used without any sanity checks. Impact The ChainlinkPriceOracle contract is used to interface with the Chainlink price feeds for the different LST assets in scope in the protocol. The current implementation...