11783 matches found
CVE-2023-23821
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Marcin Pietrzak Interactive Polish Map plugin = 1.2 versions...
CVE-2023-26529
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in DupeOff.Com DupeOff plugin = 1.6 versions...
AZL-25956 CVE-2023-28464 affecting package kernel for versions less than 5.15.122.1-2
hciconncleanup in net/bluetooth/hciconn.c in the Linux kernel through 6.2.9 has a use-after-free observed in hciconnhashflush because of calls to hcidevput and hciconnput. There is a double free that may lead to privilege escalation...
Denial of Service (DoS)
Overview Affected versions of this package are vulnerable to Denial of Service DoS when echoing the request URL as an X-Up-Location response header. By making a request with exceedingly long URLs paths or query string, an attacker can cause unpoly-rails to write a exceedingly large response heade...
CVE-2023-24399
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in OceanWP Ocean Extra plugin = 2.1.2 versions...
PT-2023-17211 · Unknown · Dreamer Cms
Name of the Vulnerable Software and Affected Versions: Dreamer CMS versions up to 3.5.0 Description: A problematic issue was found in the File Upload Handler component, leading to cross site scripting. The manipulation can be launched remotely, affecting an unknown function. Recommendations: For...
Inbit Messenger v4.9.0 - Unauthenticated Remote SEH Overflow Exploit
Exploit Title: Inbit Messenger v4.9.0 - Unauthenticated Remote SEH Overflow Exploit Author: a-rey Vendor Homepage: http://www.inbit.com/support.html Software Link: http://www.softsea.com/review/Inbit-Messenger-Basic-Edition.html Version: v4.6.0 - v4.9.0 Tested on: Windows XP SP3, Windows 7, Windo...
CVE-2023-27229
TOTOlink A7100RU V7.4cu.2313B20191024 was discovered to contain a command injection vulnerability via the upBw parameter at /setting/setWanIeCfg...
CVE-2022-47146
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Contempoinc Real Estate 7 WordPress theme = 3.3.1 versions...
PT-2023-10276 · Unknown · Grinnellplans-Php
Name of the Vulnerable Software and Affected Versions: grinnellplans-php versions up to 3.0 Description: A critical issue has been found, affecting the function interface disp page/interface disp page of the file read.php, leading to sql injection. The attack can be launched remotely...
CVE-2023-23728
Auth. contributor+ Cross-Site Scripting XSS vulnerability in Winwar Media WP Flipclock plugin = 1.7.4 versions...
CVE-2023-22712
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in TemplatesNext TemplatesNext ToolKit plugin = 3.2.7 versions...
CVE-2023-22704
Reflected Cross-Site Scripting XSS vulnerability in Michael Winkler teachPress plugin = 8.1.8 versions...
CVE-2022-45843
Auth. contributor+ Stored Cross-Site Scripting vulnerability in Nextend Smart Slider 3 plugin = 3.5.1.9 versions...
PT-2023-18645 · Unknown · Wpmobile.App
Name of the Vulnerable Software and Affected Versions: WPMobile.App versions = 11.13 Description: A Cross-Site Scripting XSS vulnerability has been discovered in the WPMobile.App plugin for Android and iOS mobile applications, affecting versions up to and including 11.13. This issue allows for XS...
PT-2023-17115 · Zhong Bang · Crmeb
Name of the Vulnerable Software and Affected Versions: Zhong Bang CRMEB Java versions up to 1.3.4 Description: A issue was found in the function save of the file "/api/admin/store/product/save" API endpoint, which leads to cross site scripting. The attack may be initiated remotely. Recommendation...
PT-2023-17089 · Datagear · Datagear
Name of the Vulnerable Software and Affected Versions: DataGear versions up to 1.11.1 Description: A vulnerability was found in the Graph Dataset Handler component, leading to cross-site scripting. The attack can be initiated remotely. The issue affects some unknown processing of this component...
CVE-2023-0273 Custom Content Shortcode <= 4.0.2 - Contributor+ Stored XSS
The Custom Content Shortcode WordPress plugin through 4.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting...