PT-2023-15309 · Unknown · Daniel Powney Multi Rating

Name of the Vulnerable Software and Affected Versions: Daniel Powney Multi Rating plugin versions = 5.0.5 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting vulnerability. This allows for malicious scripts to be injected into a website, potentially leading to...

CVE-2023-27394 CVE-2023-27394

Osprey Pump Controller version 1.01 is vulnerable an unauthenticated OS command injection vulnerability. This can be exploited to inject and execute arbitrary shell commands through a HTTP GET parameter called by DataLogView.php, EventsView.php and AlarmsView.php scripts...

CVE-2023-27886 CVE-2023-27886

Osprey Pump Controller version 1.01 is vulnerable to an unauthenticated OS command injection vulnerability. This can be exploited to inject and execute arbitrary shell commands through a HTTP POST parameter called by index.php script...

Sql injection

The Gift Cards Gift Vouchers and Packages WordPress Plugin, version = 4.3.1, is affected by an unauthenticated SQL injection vulnerability in the template parameter in the wpgvdoajaxvoucherpdfsavefunc action...

CVE-2023-28662

The Gift Cards Gift Vouchers and Packages WordPress Plugin, version = 4.3.1, is affected by an unauthenticated SQL injection vulnerability in the template parameter in the wpgvdoajaxvoucherpdfsavefunc action...

CVE-2023-0037 10WebMapBuilder < 1.0.73 - Unauthenticated SQLi

The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

HPE Serviceguard 代码问题漏洞

HPE Serviceguard is a high availability and disaster recovery clustering solution from HPE. A security vulnerability exists in HPE Serviceguard that stems from the presence of an unauthenticated Java deserialization vulnerability...

HPE Serviceguard 代码问题漏洞

HPE Serviceguard is a high availability and disaster recovery clustering solution from HPE. A security vulnerability exists in HPE Serviceguard that stems from an unauthenticated server-side request forgery vulnerability...

CVE-2023-26255

An unauthenticated path traversal vulnerability affects the "STAGIL Navigation for Jira - Menu & Themes" plugin before 2.0.52 for Jira. By modifying the fileName parameter to the snjCustomDesignConfig endpoint, it is possible to traverse and read the file system...

CVE-2023-26256

An unauthenticated path traversal vulnerability affects the "STAGIL Navigation for Jira - Menu & Themes" plugin before 2.0.52 for Jira. By modifying the fileName parameter to the snjFooterNavigationConfig endpoint, it is possible to traverse and read the file system...

CVE-2023-26255

An unauthenticated path traversal vulnerability affects the "STAGIL Navigation for Jira - Menu & Themes" plugin before 2.0.52 for Jira. By modifying the fileName parameter to the snjCustomDesignConfig endpoint, it is possible to traverse and read the file system...

CVE-2023-26326

CVE-2023-26326 affects the BuddyForms WordPress plugin, versions before 2.7.8. The vulnerability is an unauthenticated insecure deserialization due to how buddyforms_upload_image_from_url handles input, permitting a PHAR wrapper to deserialize data and invoke arbitrary PHP objects. This can enabl...

CVE-2022-37936

Unauthenticated Java deserialization vulnerability in Serviceguard Manager...

CVE-2022-29416

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Afterpay Gateway for WooCommerce = 3.5.0 versions...

CVE-2023-23849

Versions of Coverity Connect prior to 2022.12.0 are vulnerable to an unauthenticated Cross-Site Scripting vulnerability. Any web service hosted on the same sub domain can set a cookie for the whole subdomain which can be used to bypass other mitigations in place for malicious purposes...

CVE-2022-47770

Serenissima Informatica Fast Checkin version v1.0 is vulnerable to Unauthenticated SQL Injection...

CVE-2023-23489

The Easy Digital Downloads WordPress Plugin, versions 3.1.0.2 & 3.1.0.3, is affected by an unauthenticated SQL injection vulnerability in the 's' parameter of its 'edddownloadsearch' action...

FL3R FeelBox <= 8.1 - Unauthenticated SQLi

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection. 1. Visit a blog post and extract the nonce from the source search for "feelboxAjax", and extract the "token" curl -s...

CVE-2022-46072

Helmet Store Showroom v1.0 vulnerable to unauthenticated SQL Injection...

CVE-2022-4027

The CVE-2022-4027 entry concerns the WordPress Simple:Press plugin (versions up to 6.8) with a stored XSS vulnerability in the forum reply flow via the postitem parameter. The root cause is insufficient input sanitization and output escaping, allowing injection of object/embed tags. Unauthenticat...