PT-2023-27714 · Unknown · Schoolmate

Name of the Vulnerable Software and Affected Versions: Schoolmate version 1.3 Description: The issue concerns SQL Injection in the ValidateLogin.php file, specifically affecting the variable $username from the SESSION. Recommendations: For Schoolmate version 1.3, consider restricting access to th...

PT-2023-30859 · Ibos Oa · Ibos Oa

Name of the Vulnerable Software and Affected Versions: IBOS OA version 4.5.5 Description: A critical issue was found in IBOS OA, affecting an unknown part of the file ?r=dashboard/position/del. This issue leads to sql injection and can be initiated remotely. The exploit has been disclosed to the...

PT-2023-30853 · Sourcecodester · Sourcecodester Simple Membership System

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Membership System version 1.0 Description: A critical issue was found in the file club edit query.php, where the manipulation of the club id argument leads to SQL injection. This can be initiated remotely. The issue has...

PT-2023-27706 · Skyworth · Skyworth

Name of the Vulnerable Software and Affected Versions: Skyworth version 3.0 Description: The issue allows attackers to perform a directory traversal via mounting the Udisk to /mnt/. This is due to a problem in the directory /system/bin/blkid. Recommendations: For Skyworth version 3.0, consider...

PT-2023-27983 · Jeecg · Jeecg

Name of the Vulnerable Software and Affected Versions: Jeecg versions up to 3.5.3 Description: The issue is an arbitrary file read vulnerability. It can be exploited via the interface "/testConnection". Recommendations: For versions up to 3.5.3, as a temporary workaround, consider restricting...

PT-2023-27243 · Solarwinds · Serv-U

Name of the Vulnerable Software and Affected Versions: Serv-U versions 15.4 through 15.4 Hotfix 1 Description: A vulnerability has been identified that allows an actor to bypass multi-factor/two-factor authentication if exploited. The actor must have administrator-level access to Serv-U to perfor...

PT-2023-26096 · Unknown · Crypto Currency Tracker

Name of the Vulnerable Software and Affected Versions: Crypto Currency Tracker CCT versions prior to 9.5 Description: The issue is related to incorrect access control in the User Registration page, allowing unauthenticated attackers to register as an Admin account via a crafted POST request...

PT-2023-27989 · Unknown · Dairy Farm Shop Management System Using Php/Mysql

Name of the Vulnerable Software and Affected Versions: Dairy Farm Shop Management System Using PHP and MySQL version 1.1 Description: The Dairy Farm Shop Management System Using PHP and MySQL contains multiple SQL injection vulnerabilities in the Login function. These vulnerabilities are exploite...

PT-2023-4877 · Jscape · Jscape Mft Server

Name of the Vulnerable Software and Affected Versions: JSCAPE MFT Server versions prior to 2023.1.9 Description: The issue is related to unsafe deserialization in the JSCAPE MFT Server, which allows an attacker to execute arbitrary Java code, including OS commands, via its management interface...

PT-2023-27507 · Unknown · Adenion Blog2Social

Name of the Vulnerable Software and Affected Versions: Adenion Blog2Social: Social Media Auto Post & Scheduler plugin versions = 7.2.0 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website,...

PT-2023-28176 · Jenkins · Jenkins Ivy Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Ivy Plugin versions 2.5 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to delete disabled modules. Recommendations: For Jenkins Ivy Plugin versions 2.5 and earlier, update to a version later...

PT-2023-21193

Name of the Vulnerable Software and Affected Versions Apache Superset versions up to and including 2.1.0 Description A non-admin authenticated user could incorrectly create resources using the import charts feature. Recommendations For Apache Superset versions up to and including 2.1.0, update to...

PT-2023-26517 · Unknown · Vi Web Client

Name of the Vulnerable Software and Affected Versions: VI Web Client versions prior to 7.9.6 Description: The issue allows a remote unauthenticated attacker to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted URL. This can lead to users being redirected t...

PT-2023-29491 · Mestav · Mestav Software E-Commerce

Name of the Vulnerable Software and Affected Versions: Mestav Software E-commerce Software versions before 20230901 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2023-27198 · Vcita · Vcita Online Booking & Scheduling Calendar

Name of the Vulnerable Software and Affected Versions: vCita.Com Online Booking & Scheduling Calendar for WordPress by vcita plugin versions = 4.3.2 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into...

PT-2023-27723 · Hzeller · Timg

Name of the Vulnerable Software and Affected Versions: hzeller timg versions 1.5.1 and earlier Description: The issue allows a remote attacker to cause a denial of service. It is related to a buffer overflow vulnerability. The vulnerability can be exploited via the address 0x61200000045c...

PT-2023-28019 · Grupposcai · Grupposcai Realgimm

Name of the Vulnerable Software and Affected Versions: GruppoSCAI RealGimm version 1.1.37p38 Description: Multiple reflected cross-site scripting XSS vulnerabilities in the ErroreNonGestito.aspx component allow attackers to execute arbitrary Javascript in the context of a victim user's browser vi...

PT-2023-19869 · Premio · Premio Chaty Plugin

Name of the Vulnerable Software and Affected Versions: Premio Chaty plugin versions 3.0.9 and earlier Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing them to steal...

PT-2023-27980 · Tenda · Tenda Ac7 +2

Name of the Vulnerable Software and Affected Versions: Tenda AC7 version 1.0 V15.03.06.44 Tenda AC9 version 3.0 V15.03.06.42 multi Tenda AC5 version US AC5V1.0RTL V15.03.06.28 Description: A stack overflow issue was discovered via the time parameter at the "/goform/PowerSaveSet" API endpoint. Thi...

PT-2023-27970 · Tenda · Tenda Ac7 +1

Name of the Vulnerable Software and Affected Versions: Tenda AC7 version V15.03.06.44 Tenda AC9 version V15.03.06.42 multi Description: A stack overflow issue was discovered, which occurs via the ssid parameter at the "/goform/fast setting wifi set" API endpoint. Recommendations: For Tenda AC7...