BIT-MASTODON-2022-48364

The undomarkstatusesassensitive method in app/services/approveappealservice.rb in Mastodon 3.5.x before 3.5.3 does not use the server's representative account, resulting in moderator identity disclosure when a moderator approves the appeal of a user whose status update was marked as sensitive...

CVE-2024-24099

Code-projects Scholars Tracking System 1.0 is vulnerable to SQL Injection under Employment Status Information Update...

PT-2024-20270 · Unknown · Code-Projects Scholars Tracking System

Name of the Vulnerable Software and Affected Versions: Code-projects Scholars Tracking System version 1.0 Description: The issue is related to SQL Injection under Employment Status Information Update. This allows for potential exploitation of the system's database. Recommendations: For...

CVE-2023-4639

creationtimestamp| type| source ---|---|--- 2024-02-09 04:11:15+00:00| seen| https://t.me/ctinow/181794 2024-11-17 10:25:44+00:00| seen| https://infosec.exchange/users/cve/statuses/113497810158138244 2024-11-17 12:56:59+00:00| seen| https://t.me/cvedetector/11259...

CVE-2023-1108

A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates...

WordPress Plugin MStore API 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...

MStore API < 3.9.7 - Multiple CSRF

The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks, such as Order Status Update, Order Title Update, Product Limit Update, Order Message Update, and Firebase Server Key Update...

CVE-2023-2179 WooCommerce Order Status Change Notifier <= 1.1.0 - Subscriber+ Arbitrary Order Status Update

The WooCommerce Order Status Change Notifier WordPress plugin through 1.1.0 does not have authorisation and CSRF when updating status orders via an AJAX action available to any authenticated users, which could allow low privilege users such as subscriber to update arbitrary order status, making...

CVE-2022-48364

The undomarkstatusesassensitive method in app/services/approveappealservice.rb in Mastodon 3.5.x before 3.5.3 does not use the server's representative account, resulting in moderator identity disclosure when a moderator approves the appeal of a user whose status update was marked as sensitive...

Sql injection

A vulnerability was found in SourceCodester Yoga Class Registration System 1.0 and classified as critical. This issue affects some unknown processing of the file admin/registrations/updatestatus.php of the component Status Update Handler. The manipulation of the argument id leads to sql injection...

CVE-2023-0980 SourceCodester Yoga Class Registration System Status Update update_status.php sql injection

A vulnerability was found in SourceCodester Yoga Class Registration System 1.0 and classified as critical. This issue affects some unknown processing of the file admin/registrations/updatestatus.php of the component Status Update Handler. The manipulation of the argument id leads to sql injection...

PT-2023-16662 · Sourcecodester · Sourcecodester Yoga Class Registration System

Name of the Vulnerable Software and Affected Versions: SourceCodester Yoga Class Registration System version 1.0 Description: A critical issue affects the Status Update Handler component, specifically the file admin/registrations/update status.php. The manipulation of the id argument leads to SQL...

CVE-2022-0421 Five Star Restaurant Reservations < 2.4.12 - Unauthenticated Arbitrary Payment Status Update to Stored XSS

The Five Star Restaurant Reservations WordPress plugin before 2.4.12 does not have authorisation when changing whether a payment was successful or failed, allowing unauthenticated users to change the payment status of arbitrary bookings. Furthermore, due to the lack of sanitisation and escaping,...

编号撤回

This CVE number has been withdrawn...

Multivendor Marketplace Solution for WooCommerce < 3.8.12 - Unauthorised AJAX Calls

The plugin is lacking authorisation and CSRF in multiple AJAX actions, which could allow any authenticated users, such as subscriber to call them and suspend vendors reporter by the submitter or update arbitrary order status identified by WPScan when verifying the issue for example. Other...

CVE-2021-45461

creationtimestamp| type| source ---|---|--- 2022-07-18 20:36:45+00:00| exploited| https://t.me/truesecator/3189 2026-01-29 14:36:26+00:00| seen| https://threatintel.cc/2026/01/29/unveiling-the-weaponized-web-shell.html 2026-01-29 14:42:05+00:00| seen| MISP/30dbf7d0-e101-412c-b155-26c5c47a7558...

CVE-2022-0825 Amelia < 1.0.49 - Customer+ Arbitrary Appointments Status Update

The Amelia WordPress plugin before 1.0.49 does not have proper authorisation when managing appointments, allowing any customer to update other's booking status, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it...

WordPress Amelia plugin <= 1.0.48 - Arbitrary Appointments Status Update vulnerability

Arbitrary Appointments Status Update vulnerability discovered by Huli from Cymetrics in WordPress Amelia plugin versions = 1.0.48. Solution Update the WordPress Amelia plugin to the latest available version at least 1.0.49...

CVE-2022-0530

creationtimestamp| type| source ---|---|--- 2022-02-10 02:13:32+00:00| seen| https://t.me/cibsecurity/37151 2022-02-28 05:13:02+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/1553 2022-02-28 05:46:53+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/1554 2025-07-08...

CVE-2021-39943

An authorization logic error in the External Status Check API in GitLab EE affecting all versions starting from 14.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allowed a user to update the status of the check via an API call...