PT-2024-22008 · Unknown · Eskooly Free Online School Management

Name of the Vulnerable Software and Affected Versions: Eskooly Free Online School Management Software versions 3.0 and earlier Description: The issue allows a remote attacker to escalate privileges via the Token Handling component. This is a Cross Site Request Forgery vulnerability...

CVE-2024-36775

A cross-site scripting XSS vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the About Me parameter in the Edit Profile page...

WordPress Button Generator plugin < 3.0 - Button Deletion via CSRF vulnerability

Button Deletion via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin Button Generator – easily Button Builder versions 3.0...

WordPress LoginPress Pro plugin < 3.0.0 - Captcha Bypass vulnerability

Captcha Bypass vulnerability discovered by Dave Jong Patchstack in WordPress Plugin LoginPress Pro versions 3.0.0...

RaspAP security vulnerability

RaspAP is application software for simple wireless AP setup and management of Debian-based devices. A security vulnerability exists in RaspAP 3.0.9 and earlier versions that originated from allowing a remote attacker to cause a persistent denial of service via a crafted request...

MRCMS Security Vulnerabilities

MRCMS is a content management system by marker personal developer. A security vulnerability exists in MRCMS version 3.0, which was discovered to contain a cross-site scripting XSS vulnerability via /admin/system/saveinfo.do...

Pixel & tonic Craft CMS Security Vulnerability

Pixel & tonic Craft CMS is a content management system CMS from Pixel & tonic USA. A security vulnerability exists in Craft CMS Audit Plugin versions prior to 3.0.2. An attacker can exploit the vulnerability to execute arbitrary code...

a-blog cms security breach

a-blog cms is a Japanese content management system CMS. A security vulnerability exists in a-blog cms. A remote attacker can exploit this vulnerability to execute arbitrary JavaScript code by uploading a specially crafted SVG file. The following versions are affected: version 3.1.x to version 3.1...

PT-2023-30981 · Unknown · Appointment Scheduler

Name of the Vulnerable Software and Affected Versions: Appointment Scheduler version 3.0 Description: The issue concerns Multiple HTML Injection problems. These issues can be exploited via the SMS API Key or Default Country Code. Recommendations: For Appointment Scheduler version 3.0, consider...

PT-2023-28378

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 3.0.0 Description The issue allows an authenticated malicious user to initiate multiple concurrent requests, each requesting multiple dashboard exports. This could lead to a possible denial of service...

WordPress Plugin CITS Support svg, webp Media and TTF,OTF File Upload Cross Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress Plugin CITS Support svg, webp Med...

CVE-2023-43374

Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the idutentelog parameter at /hoteldruid/personalizza.php...

JerryScript Security Vulnerability

JerryScript is a lightweight JavaScript engine from the Jerryscript project. A security vulnerability exists in JerryScript version 3.0 that originates from allowing remote attackers to execute arbitrary code via the ecmastringbuilderappendraw component in...

UBUNTU-CVE-2023-36250

CSV Injection vulnerability in GNOME time tracker version 3.0.2, allows local attackers to execute arbitrary code via crafted .tsv file when creating a new record...

vsftpd 安全漏洞

vsftpd is an FTP File Transfer Protocol server for Unix-like systems. A security vulnerability exists in vsftpd version 3.0.3, which originated from allowing an attacker to cause a denial of service due to a limited number of allowed connections...

DEBIAN-CVE-2023-38285

Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity...

Wifi Soft Unibox Administration SQL注入漏洞

Wifi Soft Unibox Administration is a smart access controller and hotspot gateway from Wifi Soft USA. It provides complete control over wired and wireless networks. A SQL injection vulnerability exists in Wifi Soft Unibox Administration versions 3.0 and 3.1, which originates from unverified or...

CVE-2023-35818

An issue was discovered on Espressif ESP32 3.0 ESP32rev300 ROM devices. An EMFI attack on ECO3 provides the attacker with a capability to influence the PC value at the CPU context level, regardless of Secure Boot and Flash Encryption status. By using this capability, the attacker can exploit...

CVE-2023-36201

An issue in JerryscriptProject jerryscript v.3.0.0 allows an attacker to obtain sensitive information via a crafted script to the arrays...

JerryScript 安全漏洞

JerryScript is a lightweight JavaScript engine from the Jerryscript Project. A security vulnerability exists in JerryscriptProject jerryscript version v.3.0.0. An attacker exploited the vulnerability to obtain sensitive information via a specially crafted array script...