Signup Form Detected

This is an informational notice that the scanner identified a potential signup form. No source data...

Oturia Smart Google Code Inserter Plugin for WordPress < 3.5 Multiple Vulnerabilities

The WordPress Oturia Smart Google Code Inserter Plugin installed on the remote host is affected by multiple vulnerabilities :\n\n - An Authentication Bypass which allows unauthenticated attackers to insert arbitrary JavaScript or HTML code via the sgcgoogleanalytic parameter.\n - An SQL Injection...

Webmin < 1.940 XML External Entity

According to its self-reported version, the Webmin install hosted on the remote host is prior to 1.940. It is, therefore, affected by an XML External Entity vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version...

Webmin < 1.990 Multiple Vulnerabilities

According to its self-reported version, the Webmin install hosted on the remote host is prior to 1.990. It is, therefore, affected by multiple vulnerabilities. - Improper Access Control to Remote Code Execution - Improper Authorization Note that the scanner has not tested for these issues but has...

Webmin < 1.974 Multiple Vulnerabilities

According to its self-reported version, the Webmin install hosted on the remote host is prior to 1.974. It is, therefore, affected by multiple vulnerabilities. - A Cross Site Request Forgery CSRF that allow to achieve Remote Command Execution RCE through Webmin running process feature. - A...

Drupal 10.0.x < 10.0.2 Information Disclosure

According to its self-reported version, the instance of Drupal running on the remote web server is 9.4.x prior to 9.4.10, 9.5.x prior to 9.5.2, or 10.0.x prior to 10.0.2. It is, therefore, affected by an information disclosure vulnerability in the Media Library module. Note that the scanner has n...

Apache Spark 3.3.0 Stored Cross-Site Scripting

A stored cross-site scripting XSS vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI. Note that the...

Kibana 7.7.0 < 7.17.1 Insufficient Authorization

According to its self-reported version number, the Kibana application running on the remote host is 7.7.0 prior to 7.17.1 or 8.0.0. It is, therefore, affected by : - A missing authorization issue in which users with read access to the Uptime feature could modify alerting rules CVE-2022-23709 Note...

Kibana 7.x < 7.13.0 Open Redirect

According to its self-reported version number, the Kibana application running on the remote host is prior to 6.8.16 or 7.0.0 prior to 7.13.0. It is, therefore, affected by : - An Open Redirect through a maliciously crafted URL CVE-2021-22141 Note that the scanner has not tested for these issues b...

PHP 8.1.x < 8.1.14 Integer Overflow

According to its self-reported version number, the version of PHP installed on the remote host is 8.0.x prior to 8.0.27, 8.1.x prior to 8.1.14, or 8.2.x prior to 8.2.1. It is, therefore, affected by an integer overflow. Note that the scanner has not tested for these issues but has instead relied...

Elementor Plugin for WordPress < 3.6.3 Incorrect Authorization

The WordPress pElementor Plugin installed on the remote host is affected by an Incorrect Authorization check. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...

phpMyAdmin 4.9.x < 4.9.10 Information Disclosure

The version of phpMyAdmin installed on the remote web server is 4.9.x prior to 4.9.10 or 5.1.x prior to 5.1.3. It is, therefore, affected by an information disclosure that would reveal the path on disk where phpMyAdmin is running from. Note that the scanner has not tested for these issues but has...

phpMyAdmin 5.1.x < 5.1.3 Information Disclosure

The version of phpMyAdmin installed on the remote web server is 4.9.x prior to 4.9.10 or 5.1.x prior to 5.1.3. It is, therefore, affected by an information disclosure that would reveal the path on disk where phpMyAdmin is running from. Note that the scanner has not tested for these issues but has...

WordPress Cron Enabled

The wp-cron.php file is responsible for scheduled events in a WordPress website. By default, when a request is made, WordPress will generate an additional request from it to the wp-cron.php file. By generating a large number of requests to the website, it is therefore possible to make the site...

WordPress Plugins Detected

This is an informational notice that the scanner was able to detect one or more installed WordPress plugins. No source data...

Microsoft Access Database Detected

A Microsoft Access Database file has been detected on the target host. This may expose privileged information or configurations to a malicious actor. No source data...

External URLs

An external URL is an URL for which the Fully Qualified Domain Name FQDN is not the same as the web target URL one. The scanner detected the presence of external URLs on the target web application and have listed them based on two types : URLs with a domain name in common with the web target URL...

Phinx Configuration File Detected

Phinx is an open-source PHP software designed to help developers to quickly create and maintain their SQL databases migrations through PHP code. Phinx uses a configuration file in the project root directory to store the environment and database information. By accessing it, an attacker could...

GLPI < 9.3.4 SQL Injection

GLPI in version 9.3.4 has an unauthenticated SQL Injection via the 'cycle' parameter of the 'unlocktasks.php' page. No source data...

Disclosed European Personal Data Number

A European Personal Data Number EPDN is a personally identifiable number that is issued to a citizen of one of the members or ex-members of the European Union. A stolen or leaked EPDN can lead to a compromise, and/or the theft of the affected individuals identity. WAS has discovered an EPDN locat...