CVE-2022-29410

Authenticated SQL Injection SQLi vulnerability in Mufeng's Hermit 音乐播放器 plugin = 3.1.6 on WordPress allows attackers with Subscriber or higher user roles to execute SQLi attack via &ids...

Sql injection

Authenticated SQL Injection SQLi vulnerability in Mufeng's Hermit ????? plugin = 3.1.6 on WordPress allows attackers with Subscriber or higher user roles to execute SQLi attack via &ids...

CVE-2022-29410

Authenticated SQL Injection SQLi vulnerability in Mufeng's Hermit 音乐播放器 plugin = 3.1.6 on WordPress allows attackers with Subscriber or higher user roles to execute SQLi attack via...

Improper Access Control (IDOR)

Description Improper Access Control IDOR could leak admin information. Proof of Concept 1.Login as admin, edit a role to give permission show a user information - save 2.Login as an user with that role - go to url http://my.facturascripts.site/EditUser?code=admin&action=export&option=PDF - Can se...

Multiple Store XSS via upload svg file and the file name of attachment

Description Hi There, facturascripts is vulnerable to store XSS by upload svg file, and the filename Step to produce with svg file Login as admin or any account has role Admin-Library, access Admin - library - New and upload file svg with content: alertdocument.cookie; save this. XSS will be...

setFlywheelRewards can take any rewardToken

Lines of code Vulnerability details Impact Though setFlywheelRewards has requiresAuth, it still has rug risk that a privileged user can move all rewardToken of flywheelRewards to new malicious newFlywheelRewards unconditionally. Proof of Concept A malicious user or a compromised admin can call...

WordPress ShortPixel Adaptive Images plugin access control error vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress ShortPixel Adaptive Images plugin version 3.3.1 and earlier is vulnerable to an access...

CVE-2022-27854

Stored Cross-Site Scripting XSS vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin = 0.21.19 on WordPress possible for users with contributor or higher role via &wpttestpagesubmitbuttoncaption parameter...

CVE-2022-27854

Stored Cross-Site Scripting XSS vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin = 0.21.19 on WordPress possible for users with contributor or higher role via &wpttestpagesubmitbuttoncaption parameter...

Cross site scripting

Stored Cross-Site Scripting XSS vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin = 0.21.19 on WordPress possible for users with contributor or higher role via &wpttestpagesubmitbuttoncaption parameter...

Psychological tests & quizzes <= 0.21.19 - Contributor+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of its settings available to users with a role as low as contributor, allowing them to perform Cross-Site Scripting attacks...

CVE-2022-29417

Plugin Settings Update vulnerability in ShortPixel's ShortPixel Adaptive Images plugin = 3.3.1 at WordPress allows an attacker with a low user role like a subscriber or higher to change the plugin settings...

CVE-2022-29419

SQL Injection SQLi vulnerability in Don Crowther's 3xSocializer plugin = 0.98.22 at WordPress possible for users with a low role like a subscriber or higher...

Sql injection

SQL Injection SQLi vulnerability in Don Crowther's 3xSocializer plugin = 0.98.22 at WordPress possible for users with a low role like a subscriber or higher...

CVE-2022-29419 WordPress 3xSocializer plugin <= 0.98.22 - Authenticated SQL Injection (SQLi) vulnerability

SQL Injection SQLi vulnerability in Don Crowther's 3xSocializer plugin = 0.98.22 at WordPress possible for users with a low role like a subscriber or higher...

CVE-2022-29418

CVE-2022-29418 affects the WordPress plugin Night Mode (Mark Daniels Night Mode) at versions

CVE-2022-29417

Summary: CVE-2022-29417 affects the WordPress ShortPixel Adaptive Images plugin (versions

CVE-2022-29418

Authenticated admin user role Persistent Cross-Site Scripting XSS in Mark Daniels Night Mode plugin = 1.0.0 on WordPress via vulnerable parameters: pagesettingenable-me, pagesettingbg-color, pagesettingtxt-color, pagesettinganccolor...

barbican 授权问题漏洞

barbican is an OpenStack key management service, API server. An authorization issue vulnerability exists in barbican due to a lack of authorization checks. A remote user with the administrator role could add secrets to different project containers. The vulnerability allows an attacker on a networ...

Ubuntu 18.04 LTS / 20.04 LTS : Barbican vulnerabilities (USN-5387-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5387-1 advisory. Douglas Mendizbal discovered that Barbican incorrectly handled access restrictions. An authenticated attacker could possibly use this issue t...