PT-2023-16259 · WordPress · Cloud Manager Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Cloud Manager WordPress plugin versions 1.0 and earlier Description: The issue allows unauthenticated attackers to trick a logged-in admin into triggering a XSS payload by clicking a link, due to the lack of sanitization and escaping of the...

PT-2023-16634 · WordPress · Japanized For Woocommerce

Name of the Vulnerable Software and Affected Versions: Japanized For WooCommerce WordPress plugin versions prior to 2.5.8 Description: The issue is related to Reflected Cross-Site Scripting, where generated URLs are not properly escaped before being outputted in attributes. Recommendations: For...

PT-2023-12116 · Mblog · Mblog

Name of the Vulnerable Software and Affected Versions: mblog version 3.5.0 Description: The issue allows attackers to execute arbitrary code via a crafted theme when it gets selected. This is due to an OS Command injection vulnerability. Recommendations: For mblog version 3.5.0, update to a newer...

PT-2023-5348 · Libspdm · Libspdm

Name of the Vulnerable Software and Affected Versions: libspdm versions 1.0 through 2.3 Description: A vulnerability has been identified in SPDM session establishment in libspdm. If a device supports both DHE session and PSK session with mutual authentication, an attacker may be able to establish...

PT-2023-23207 · Wjj · Innokb Server +1

Name of the Vulnerable Software and Affected Versions: WJJ Software - InnoKB Server, InnoKB/Console version 2.2.1 Description: The issue is related to reflected cross-site scripting RXSS through an unspecified request. This allows for potential malicious script injection and execution. No...

PT-2023-21757 · Macho Themes · Newsmag

Name of the Vulnerable Software and Affected Versions: Macho Themes NewsMag theme versions = 2.4.4 Description: The issue is related to a Reflected Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into a website, potentially leading...

Potential XSS in content script via StackOverflow about_me

Description Alby has a feature called "batteries", which makes tipping on third party sites easier, e.g. by detecting lightning network addresses and so donating using the extensions becomes easy. One of those sites is stackoverflow. The alby extension will use the stackoverflow/stackexchange API...

PT-2023-20202 · Unknown · Sbs20/Scanservjs

Name of the Vulnerable Software and Affected Versions: sbs20/scanservjs versions prior to 2.27.0 Description: The issue is related to OS Command Injection in the GitHub repository sbs20/scanservjs. Recommendations: For versions prior to 2.27.0, update to version 2.27.0 or later to resolve the iss...

Cisco Warns of Vulnerability in Popular Phone Adapter, Urges Migration to Newer Model

Cisco has warned of a critical security flaw in SPA112 2-Port Phone Adapters that it said could be exploited by a remote attacker to execute arbitrary code on affected devices. The issue, tracked as CVE-2023-20126, is rated 9.8 out of a maximum of 10 on the CVSS scoring system. The company credit...

PT-2023-22545 · Unknown · Online Food Ordering System

Name of the Vulnerable Software and Affected Versions: Online Food Ordering System version 2.0 Description: The issue allows attackers to execute arbitrary code via uploading a crafted PHP file, exploiting an arbitrary file upload vulnerability in the component "/admin/ajax.php?action=save menu"...

PT-2023-23177 · Craft Cms · Craft Cms

Name of the Vulnerable Software and Affected Versions: Craft CMS versions 3.0.0 through 3.8.3 Craft CMS versions 3.8.4 is not affected for version 3, but versions prior to 4.4.4 are affected for version 4, so Craft CMS versions 4.0.0 through 4.4.3 Description: A malformed title in the feed widget...

PT-2023-22519 · Totolink · Totolink A7100Ru

Name of the Vulnerable Software and Affected Versions: TOTOLINK A7100RU version 7.4cu.2313 B20191024 Description: The issue is a Command Injection vulnerability. An attacker can obtain a stable root shell through a specially constructed payload. Recommendations: For TOTOLINK A7100RU version...

PT-2023-20407 · WordPress · Eirudo Simple Youtube Responsive

Name of the Vulnerable Software and Affected Versions: Eirudo Simple YouTube Responsive plugin versions = 2.5 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. It affects users with contributor or higher permissions. There is no information provided about the...

PT-2023-22536 · Unknown · Totaljs Flow

Name of the Vulnerable Software and Affected Versions: TotalJS Flow version 10 Description: A stored cross-site scripting XSS vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the platform name field in the settings module. This issue...

PT-2023-18238 · Google · Android

Name of the Vulnerable Software and Affected Versions: Call Settings versions prior to SMR May-2023 Release 1 Description: The issue allows physical attackers to access some media data stored in sandbox due to an improper export of android application components vulnerability in...

PT-2023-18257 · Unknown · Factorytest

Name of the Vulnerable Software and Affected Versions: FactoryTest application prior to SMR May-2023 Release 1 Description: The issue is related to improper input validation in the FactoryTest application, allowing local attackers to achieve privilege escalation through debugging commands...

PT-2023-20392 · Peepso · Peepso Community

Name of the Vulnerable Software and Affected Versions: PeepSo Community by PeepSo plugin versions 6.0.2.0 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended...

PT-2023-19199 · Unknown · Dgcult Exquisite Paypal Donation Plugin

Name of the Vulnerable Software and Affected Versions: DgCult Exquisite PayPal Donation plugin versions prior to 2.0.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For versions prior to...

PT-2023-19272 · Metaphor Creations · Ditty

Name of the Vulnerable Software and Affected Versions: Metaphor Creations Ditty plugin versions prior to 3.0.33 Description: A Stored Cross-Site Scripting XSS issue exists, allowing contributors or higher-privileged users to inject malicious scripts. Recommendations: For versions prior to 3.0.33,...

PT-2023-18656 · WordPress · Wordpress Download Manager Gutenberg Blocks

Name of the Vulnerable Software and Affected Versions: WordPress Download Manager Gutenberg Blocks by WordPress Download Manager plugin versions = 2.1.8 Description: The issue is related to an Authenticated Cross-Site Scripting XSS vulnerability. This means that an attacker with contributor or...