CVE-2022-28143

A cross-site request forgery CSRF vulnerability in Jenkins Proxmox Plugin 0.7.0 and earlier allows attackers to connect to an attacker-specified host using attacker-specified username and password perform a connection test, disable SSL/TLS validation for the entire Jenkins controller JVM as part ...

Stored XSS vulnerability in selected-tests-executor

selected-tests-executor 1.3.3 and earlier does not escape the Properties File Path option for Choosing Tests parameters. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission. As of publication of this advisory, there is no fix...

Arbitrary file read vulnerability in selected-tests-executor

selected-tests-executor 1.3.3 and earlier allows users with Item/Configure permission to read arbitrary files on the Jenkins controller using the Choosing Tests parameter. As of publication of this advisory, there is no fix. Learn why we announce this...

CVE-2021-24959

The WP Email Users WordPress plugin through 1.7.6 does not escape the dataraw parameter in the weuselectedusers1 AJAX action, available to any authenticated users, allowing them to perform SQL injection attacks...

CVE-2021-24958

The Meks Easy Photo Feed Widget WordPress plugin before 1.2.4 does not have capability and CSRF checks in the mekssavebusinessselectedaccount AJAX action, available to any authenticated user, and does not escape some of the settings. As a result, any authenticated user, such as subscriber could...

PT-2022-9528

Name of the Vulnerable Software and Affected Versions Meks Easy Photo Feed Widget WordPress plugin versions prior to 1.2.4 Description The issue concerns a lack of capability and CSRF checks in the meks save business selected account AJAX action, which is accessible to any authenticated user...

WordPress plugin SQL注入漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. WordPress plugin is a WordPress open source application plugin. WordPress WP Email Users plugin version 1.7.6 and previous versions have a SQL injection vulnerability, which originates from WP Email...

XpressEngine 跨站脚本漏洞

XpressEngine XE is a CMS Content Management System that allows anyone to publish content easily, conveniently and freely. With an open source license, anyone can use or modify it, and as an open project, anyone can participate in its development. XE suffers from a security vulnerability that stem...

PT-2022-9517

Name of the Vulnerable Software and Affected Versions The Asset CleanUp: Page Speed Booster WordPress plugin versions prior to 1.3.8.5 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the wpacu selected sub tab area parameter is not properly escaped...

The vulnerability of NETGEAR Wi-Fi router software, including models RBK752, RBR750, RBS750, RBK852, RBR850, and RBS850, arises from insufficient cleaning of input data. This allows attackers to execute arbitrary commands.

The vulnerability of NETGEAR Wi-Fi router software, including models RBK752, RBR750, RBS750, RBK852, RBR850, and RBS850, is related to insufficient cleaning of input data. Exploiting this vulnerability can allow a remote attacker to execute arbitrary commands...

Input validation

Improper Input Validation vulnerability in PC Worx Automation Suite of Phoenix Contact up to version 1.88 could allow an attacker with a manipulated project file to unpack arbitrary files outside of the selected project directory...

CVE-2021-38321

The Custom Menu Plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the selectedmenu parameter found in the /custom-menus.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.3.3...

PT-2021-22039

Name of the Vulnerable Software and Affected Versions: Custom Menu Plugin WordPress plugin versions up to and including 1.3.3 Description: The issue allows attackers to inject arbitrary web scripts via the selected menu parameter in the /custom-menus.php file, enabling Reflected Cross-Site...

WordPress 插件跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports personal blog sites on PHP and MySQL servers. A security vulnerability exists in WordPress plugin Custom Menu Plugin 1.3.3 and earlier versions, which originates...

XO Event Calendar < 2.3.7 - Reflected Cross-Site Scripting

The plugin does not escape the selected-name parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue PoC https://example.com/wp-admin/edit.php?posttype=xoevent=xo-event-holiday-settings&selected-name;="...

CVE-2020-13589

An exploitable SQL injection vulnerability exists in the ‘entities/fields’ page of the Rukovoditel Project Management App 2.7.2. The entitiesid parameter in the 'entities/fields page mulitpleedit or copyselected or export function is vulnerable to authenticated SQL injection. An attacker can make...

CVE-2021-23837

An issue was discovered in flatCore before 2.0.0 build 139. A time-based blind SQL injection was identified in the selectedfolder HTTP request body parameter for the acp interface. The affected parameter which retrieves the file contents of the specified folder was found to be accepting malicious...

PT-2021-15558

Name of the Vulnerable Software and Affected Versions: flatCore versions prior to 2.0.0 build 139 Description: A time-based blind SQL injection issue was identified in the selected folder HTTP request body parameter for the acp interface. This parameter, which retrieves the file contents of the...

mobilityonetransportation.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1162912 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

PT-2020-7401

Name of the Vulnerable Software and Affected Versions: UebiMiau versions 2.7.11 and earlier Description: The issue allows remote attackers to inject arbitrary web script or HTML via the selected theme parameter in the "error.php" endpoint. This enables attackers to execute malicious scripts on th...