CVE-2024-3014: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability classified as critical has been found in SourceCodester Simple Subscription Website 1.0. Affected is an unknown function of the file Actions.php. The manipulation of the argument title leads to sql injection. It is possible to launch the attack remotely. The exploit has been...

Simple Subscription Website SQL注入漏洞

Simple Subscription Website is an open source, web-based simple subscription application by the individual developer Carlo Montero. It is used to provide companies with possible members to apply for plans that offer certain services. An SQL injection vulnerability exists in Simple Subscription...

PT-2024-23214 · Sourcecodester · Sourcecodester Simple Subscription Website

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Subscription Website version 1.0 Description: A critical vulnerability was found in the SourceCodester Simple Subscription Website, affecting an unknown functionality of the file manage plan.php. The manipulation of the ...

PT-2024-23209 · Sourcecodester · Sourcecodester Simple Subscription Website

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Subscription Website version 1.0 Description: A critical vulnerability has been found in the software. The issue is related to the manipulation of the title argument, which leads to SQL injection. This can be exploited...

Jetpack < 13.2.1 - Contributor+ Stored XSS

Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks When the "Let visitors subscribe...

Wallos < 1.11.2 - File Upload RCE

Exploit Title: Wallos - File Upload RCE Authenticated Date: 2024-03-04 Exploit Author: [email protected] Vendor Homepage: https://github.com/ellite/Wallos Software Link: https://github.com/ellite/Wallos Version: -----------------------------29251442139...

The vulnerability of Microsoft SharePoint Server Subscription Edition, SharePoint Server, and SharePoint Enterprise Server lies in insufficient input data validation, allowing an attacker to execute arbitrary code.

The vulnerability of Microsoft SharePoint Server Subscription Edition, SharePoint Server, and SharePoint Enterprise Server is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

Email Subscription Popup < 1.2.21 - Unauthenticated Stored Cross-Site Scripting

Description The Email Subscription Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '$email' parameter in versions up to, and including, 1.2.20 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2024-27960

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in I Thirteen Web Solution Email Subscription Popup allows Stored XSS.This issue affects Email Subscription Popup: from n/a through 1.2.20...

CVE-2024-27960

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in I Thirteen Web Solution Email Subscription Popup allows Stored XSS.This issue affects Email Subscription Popup: from n/a through 1.2.20...

CVE-2024-27960 WordPress Email Subscription Popup plugin <= 1.2.20 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in I Thirteen Web Solution Email Subscription Popup allows Stored XSS.This issue affects Email Subscription Popup: from n/a through 1.2.20...

CVE-2024-27960 WordPress Email Subscription Popup plugin <= 1.2.20 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in I Thirteen Web Solution Email Subscription Popup allows Stored XSS.This issue affects Email Subscription Popup: from n/a through 1.2.20...

CVE-2024-27960

CVE-2024-27960 affects the Email Subscription Popup WordPress plugin (I Thirteen Web Solution) up to version 1.2.20. Root cause: improper neutralization of input during web page generation, enabling Stored XSS. Impact per sources is low confidentiality/integrity impact with user interaction requi...

WordPress Plugin Email Subscription Popup Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

CVE-2024-27960: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in I Thirteen Web Solution Email Subscription Popup allows Stored XSS.This issue affects Email Subscription Popup: from n/a through 1.2.20...

PT-2024-22165 · I Thirteen Web Solution · Email Subscription Popup

Name of the Vulnerable Software and Affected Versions: I Thirteen Web Solution Email Subscription Popup versions 1.2.20 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS in t...

WordPress Email Subscription Popup Plugin <= 1.2.20 is vulnerable to Cross Site Scripting (XSS)

Software Email Subscription Popup Type Plugin Vulnerable versions = 1.2.20 Fixed in 1.2.21 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-27960 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID a2cc34464fb4 Credits stealthcopter Require...

Huawei EulerOS: Security Advisory for subscription-manager (EulerOS-SA-2024-1302)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP8 : subscription-manager (EulerOS-SA-2024-1302)

According to the versions of the subscription-manager packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bu...

PT-2024-3067

Name of the Vulnerable Software and Affected Versions: OpenMetadata versions prior to 1.2.4 Description: The issue is related to the AlertUtil::validateExpression method, which can lead to Remote Code Execution. An attacker can send a PUT request to "/api/v1/events/subscriptions" to exploit this...