559 matches found
WordPress Elessi theme <= 6.3.9 - Cross Site Scripting (XSS) Vulnerability
Cross Site Scripting XSS Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Elessi versions = 6.3.9...
CVE-2024-3927
The Element Pack Elementor Addons Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows plugin for WordPress is vulnerable to Form Submission Admin Email Bypass in all versions up to, and including, 5.6.3. This is due to the plugin not properly checking for all variations of an...
CVE-2023-25802
Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. Versions prior to 6.3.6.0 don't correctly neutralize dir/../filename sequences, such as /etc/nginx/../passwd, allowing an actor to gain information about a server. Version 6.3.6.0 has a patch for this issue...
CVE-2023-21925
Vulnerability in the Oracle Health Sciences InForm product of Oracle Health Sciences Applications component: Core. Supported versions that are affected are Prior to 6.3.1.3 and Prior to 7.0.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...
CVE-2023-29815
mccms v2.6.3 is vulnerable to Cross Site Request Forgery CSRF...
CVE-2023-23784
A relative path traversal in Fortinet FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.3.6 through 6.3.20, FortiWeb 6.4 all versions allows attacker to information disclosure via specially crafted web requests...
CVE-2023-23778
A relative path traversal vulnerability CWE-23 in FortiWeb version 7.0.1 and below, 6.4 all versions, 6.3 all versions, 6.2 all versions may allow an authenticated user to obtain unauthorized access to files and data via specifically crafted web requests...
CVE-2023-0334
The ShortPixel Adaptive Images WordPress plugin before 3.6.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against any high privilege users such as admin...
WordPress plugin Nasa Core 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...
CVE-2020-11091
In Weave Net before version 2.6.3, an attacker able to run a process as root in a container is able to respond to DNS requests from the host and thereby insert themselves as a fake service. In a cluster with an IPv4 internal network, if IPv6 is not totally disabled on the host via ipv6.disable=1 ...
CVE-2025-40635 SQL injection at Comerzzia
SQL injection vulnerability in Comerzzia Backoffice: Sales Orchestrator 3.0.15. This vulnerability allows an attacker to retrieve, create, update and delete databases via the ‘uidActivity’, ‘codCompany’ and ‘uidInstance’ parameters of the ‘/comerzzia/login’ endpoint...
Varnish Cache 安全漏洞
Varnish Cache is a suite of reverse web caching servers from Varnish, Inc. A security vulnerability exists in Varnish Cache versions prior to 7.6.3 and versions prior to 7.7 to 7.7.1 and Varnish Enterprise versions prior to 6.0.13r14, which stems from allowing CRLFs to be skipped to delimit block...
libplctag 缓冲区错误漏洞
libplctag is an open source C library for libplctag that provides a portable and simple API for accessing Allen-Bradley and Modbus PLC data over Ethernet. A buffer error vulnerability exists in libplctag versions 2.0 through 2.6.3, which stems from an out-of-bounds read in the unpackresponse...
Ribbon Communications Apollo 9608 信任管理问题漏洞
The Ribbon Communications Apollo 9608 is a Session Border Controller SBC from Ribbon Communications, Inc. that is used to protect and manage network traffic for real-time communications such as VoIP. A trust management issue vulnerability exists in the Ribbon Communications Apollo 9608 v9.6R3...
CVE-2024-49808
IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 could allow an authenticated user to spoof the identity of another user due to improper authorization which could allow the user to bypass access restrictions...
IBM Sterling Connect:Direct Web Services 安全漏洞
IBM Sterling Connect:Direct Web Services is a file-based, peer-to-peer file transfer solution from International Business Machines IBM. A security vulnerability exists in IBM Sterling Connect:Direct Web Services versions 6.1.0, 6.2.0, and 6.3.0 that stems from improper authorization and could...
IBM Sterling Control Center 安全漏洞
IBM Sterling Control Center is an application system from International Business Machines IBM, Inc. A centralized monitoring and management system. A security vulnerability exists in IBM Sterling Control Center versions 6.2.1, 6.3.1, and 6.4.0 that originates from a web page that can be stored...
CVE-2025-30870
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in WP Travel Engine WP Travel Engine allows PHP Local File Inclusion. This issue affects WP Travel Engine: from n/a through 6.3.5...
EsafeNet CDG 注入漏洞
EsafeNet CDG is a document security management system from China's EsafeNet. An injection vulnerability exists in EsafeNet CDG version 5.6.3.154.205, which originates from SQL injection and may be exploited to launch an attack remotely...
