CasaOS contains weak JWT secrets

Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as root on CasaOS instances...

WordPress plugin Membership Plugin - Restrict Content 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2023-17320 · WordPress · Login Configurator

Name of the Vulnerable Software and Affected Versions: Login Configurator WordPress plugin versions through 2.1 Description: The issue is related to a reflected cross-site scripting vulnerability. It occurs because the plugin does not properly escape a URL parameter before outputting it to the...

PT-2023-24477

Name of the Vulnerable Software and Affected Versions Zekiweb versions prior to 2 Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations For versions prior...

PT-2023-25602 · WordPress · Woocommerce Order Barcodes

Name of the Vulnerable Software and Affected Versions: WooCommerce Order Barcodes plugin versions 1.6.4 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended action...

PT-2023-25737 · Unknown · Bylancer Quickorder

Name of the Vulnerable Software and Affected Versions: Bylancer QuickOrder version 6.3.7 Description: A critical issue has been found in the GET Parameter Handler component of the /blog file, where the manipulation of the s argument leads to sql injection. This issue can be exploited remotely. Th...

PT-2023-25736 · Bylancer · Bylancer Quickqr

Name of the Vulnerable Software and Affected Versions: Bylancer QuickQR version 6.3.7 Description: A critical issue was found in the GET Parameter Handler component of the /blog file, where the manipulation of the s argument leads to sql injection. This issue can be exploited remotely. The vendor...

PT-2023-25741 · Sourcecodester · Sourcecodester Insurance Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Life Insurance Management System version 1.0 Description: A critical vulnerability was found in the SourceCodester Life Insurance Management System. This issue affects the file login.php and is caused by the manipulation of the...

PT-2023-25711 · Unknown · Nesote Inout Blockchain Easypayments

Name of the Vulnerable Software and Affected Versions: Nesote Inout Blockchain EasyPayments version 1.0 Description: A critical issue was found in the POST Parameter Handler component of the /index.php/payment/getcoinaddress file. The manipulation of the coinid argument leads to sql injection,...

PT-2023-12146 · Redis +2 · Redis +2

Name of the Vulnerable Software and Affected Versions: Redis versions prior to 6.2 Redis versions prior to 6cbea7d Description: The issue allows a replica to cause an assertion failure in a primary server by sending a non-administrative command, specifically a SET command. This was fixed for Redi...

PT-2023-26346 · Thymeleaf +1 · Thymeleaf +1

Name of the Vulnerable Software and Affected Versions: Thymeleaf versions 3.1.1.RELEASE and earlier spring-boot-admin versions 3.1.1 and earlier Description: The issue allows for a sandbox bypass via crafted HTML, which may be relevant for Server Side Template Injection SSTI and code execution in...

PT-2023-8862 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 10.0.9 Description: The issue is related to SQL injection via dashboards administration, allowing a remote attacker to execute arbitrary SQL queries. This can be triggered by an administrator. Recommendations: For...

PT-2023-25900 · Kofax · Kofax Power Pdf

Name of the Vulnerable Software and Affected Versions: Kofax Power PDF affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a maliciou...

PT-2023-25980 · Unknown · Feedbacksystem

Name of the Vulnerable Software and Affected Versions: Feedbacksystem versions prior to 1.19.2 Description: The issue concerns the storage of passwords in clear text for users utilizing LDAP login. Specifically, the LDAP user's password is passed unencrypted in the LoginController.scala and store...

PT-2023-24207

Name of the Vulnerable Software and Affected Versions iDisplay PlatPlay DS versions prior to 3.14 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...

PT-2023-25627 · Unknown · Campcodes Retro Cellphone Online Store

Name of the Vulnerable Software and Affected Versions: Campcodes Retro Cellphone Online Store version 1.0 Description: A vulnerability was found in the software, classified as problematic, affecting some unknown functionality of the file /admin/add user modal.php. The manipulation of the un...

PT-2023-3665 · Rockwell Automation · 1756-En2T +8

Name of the Vulnerable Software and Affected Versions: Rockwell Automation 1756-EN4 Ethernet/IP communication products Rockwell Automation 1756-EN2T, 1756-EN2TK, 1756-EN2TXT, 1756-EN2TP, 1756-EN2TPK, 1756-EN2TPXT, 1756-EN2TR, 1756-EN2TRK, 1756-EN2TRXT, 1756-EN2F, 1756-EN2FK, 1756-EN3TR,...

PT-2023-25572

Name of the Vulnerable Software and Affected Versions Boss Mini version 1.4.0 Build 6221 Description A critical issue affects an unknown part of the file boss/servlet/document, where the manipulation of the path argument leads to file inclusion. This can be initiated remotely. Recommendations For...

PT-2023-4084 · Siemens · Simatic Cn 4100

Name of the Vulnerable Software and Affected Versions: SIMATIC CN 4100 versions prior to V2.5 Description: A vulnerability has been identified in the SIMATIC CN 4100, related to an incorrect default value in the SSH configuration. This issue could allow an attacker to bypass network isolation. Th...

PT-2023-5817 · Unknown · Sipass Integrated

Name of the Vulnerable Software and Affected Versions: SiPass integrated versions prior to V2.90.3.8 Description: A vulnerability has been identified in SiPass integrated, where affected server applications improperly check the size of data packets received for the configuration client login,...