CVE-2022-30392

Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggersmerch/classes/Master.php?f=deletesubcategory...

Merchandise Online Store SQL注入漏洞

Merchandise Online Store is a merchandise online store system. merchandise Online Store has a security vulnerability that can be exploited by attackers via /vloggersmerch/classes/Master.php?f=deletesubcategory to conduct an SQL injection attack...

PT-2022-20090

Name of the Vulnerable Software and Affected Versions Merchandise Online Store version 1.0 Description The issue concerns a SQL Injection vulnerability. It can be exploited via the /vloggers merch/classes/Master.php?f=delete sub category endpoint. Recommendations For Merchandise Online Store...

[SECURITY] Fedora 34 Update: redis-6.2.7-1.fc34

Redis is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing se...

Experian Hunter 安全漏洞

Experian Hunter is used by Experian to prevent application fraud across all channels. A security vulnerability exists in Experian Hunter version 1.16. A remote attacker exploited the vulnerability to modify Experian Hunter via 1 the Rule Name parameter on the Rule page 2 the Sub-Rule Name 3 the...

GHSA-4PFG-2FRF-F67V MoinMoin Cross-site Scripting (XSS) vulnerability

Multiple cross-site scripting XSS vulnerabilities in action/AttachFile.py in MoinMoin 1.8.2 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 an AttachFile sub-action in the errormsg function or 2 multiple vectors related to package file errors in the uploadform...

PT-2022-18403

Name of the Vulnerable Software and Affected Versions Tenda AX12 version V22.03.01.21 CN Description A Cross-Site Request Forgery CSRF issue was found, related to the function sub 422168 at the /goform/WifiExtraSet API endpoint. Recommendations For Tenda AX12 version V22.03.01.21 CN, as a tempora...

CVE-2022-0531

The Migration, Backup, Staging WordPress plugin before 0.9.70 does not sanitise and escape the subpage parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting...

PT-2022-13243

Name of the Vulnerable Software and Affected Versions Migration, Backup, Staging WordPress plugin versions prior to 0.9.70 Description The issue is related to a reflected Cross-Site Scripting problem. It occurs because the sub page parameter is not properly sanitised and escaped before being...

CVE-2022-27277

InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain an arbitrary file deletion vulnerability via the function sub17C08...

CVE-2022-27274

InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution RCE vulnerability via the function sub12028. This vulnerability is triggered via a crafted packet...

PT-2022-18351

Name of the Vulnerable Software and Affected Versions InHand Networks InRouter 900 Industrial 4G Router versions prior to 1.0.0.r11700 Description The issue allows for arbitrary file deletion via the function sub 17C08. Recommendations For versions prior to 1.0.0.r11700, update to version...

PT-2022-18350 · Inhand Networks · Inrouter 900

Name of the Vulnerable Software and Affected Versions: InHand Networks InRouter 900 Industrial 4G Router versions prior to 1.0.0.r11700 Description: A remote code execution issue was discovered, which can be triggered by a crafted packet via the function sub 10F2C. Recommendations: For versions...

PT-2022-18352

Name of the Vulnerable Software and Affected Versions InHand Networks InRouter 900 Industrial 4G Router versions prior to v1.0.0.r11700 Description The issue allows for an arbitrary file read via the function sub 177E0. Recommendations For versions prior to v1.0.0.r11700, update to version...

PT-2022-18348 · Inhand Networks · Inrouter 900 Industrial 4G Router

Name of the Vulnerable Software and Affected Versions: InHand Networks InRouter 900 Industrial 4G Router versions prior to 1.0.0.r11700 Description: A remote code execution issue was discovered, which can be triggered by a crafted packet via the function sub 12028. Recommendations: For versions...

WordPress和WordPress plugin 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists i...

Internet Bug Bounty: Regexes with large repetitions on empty sub-expressions take a very long time to parse

Rust's regex crate guarantees a linear time complexity with regex length for compilation of untrusted regexes. However, existing mitigations for known malicious regexes are based on memory usage and, as such, do not mitigate repetitions of empty sub-expressions. For example, the following payload...

CVE-2021-24897

The Add Subtitle WordPress plugin through 1.1.0 does not sanitise or escape the sub-title field available only with classic editor when output in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks...

CVE-2021-24897

The Add Subtitle WordPress plugin through 1.1.0 does not sanitise or escape the sub-title field available only with classic editor when output in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks...

CVE-2021-24897: Improper Neutralization of Input During Web Page Generation

The Add Subtitle WordPress plugin through 1.1.0 does not sanitise or escape the sub-title field available only with classic editor when output in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks...