highlight.php - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-043

Provides highlight.php integration to Drupal, allowing blocks to be automatically highlighted with the correct language. The module's Twig function doesn't sufficiently filter user-entered data...

Out-Of-Bounds Write

7zip is vulnerable to Out-Of-Bounds Write. The vulnerability exists due to the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer, allowing an attacker to leverage this vulnerability to execute code in the context of the current proces...

CVE-2023-4587

CVE-2023-4587 describes an insecure direct object reference (IDOR) in the ZKTeco ZEM800, version 6.60. A local attacker can obtain registered user backup files or device configuration files over a local network or via VPN. The vulnerability is rooted in access to sensitive object data without pro...

PT-2023-27331 · Vathemes · Vathemes Business Pro

Name of the Vulnerable Software and Affected Versions: Vathemes Business Pro theme versions = 1.10.4 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing them to steal...

LG LED Assistant Path Traversal Vulnerability

LG LED Assistant is a software from Luckin LG Korea. It is used to set up LED lights. A security vulnerability exists in LG LED Assistant that originates from failure to properly validate a user-supplied path before using it in a file operation, allowing remote attackers to disclose information...

PT-2023-27153 · Unknown · Saasproject Booking Package

Name of the Vulnerable Software and Affected Versions: SAASPROJECT Booking Package plugin versions = 1.6.01 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing them to...

PT-2023-22730 · Imagerecycle · Imagerecycle Pdf & Image Compression Plugin

Name of the Vulnerable Software and Affected Versions: ImageRecycle ImageRecycle pdf & image compression plugin versions = 3.1.10 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website,...

PT-2023-27323 · Pixelgrade · Pixtypes

Name of the Vulnerable Software and Affected Versions: Pixelgrade PixTypes plugin versions 1.4.15 and earlier Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing them t...

PT-2023-27197 · Blindside Networks · Bigbluebutton

Name of the Vulnerable Software and Affected Versions: Blindside Networks BigBlueButton plugin versions = 3.0.0-beta.4 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowi...

PT-2023-26242 · WordPress · Dharmesh Patel Post List With Featured Image

Name of the Vulnerable Software and Affected Versions: Dharmesh Patel Post List With Featured Image plugin versions 1.2 and earlier Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website,...

ASB-A-256591023

In multiple locations, there is a possible way to import contacts belonging to other users due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2023-20084 · WordPress · Mahlamusa Who Hit The Page – Hit Counter

Name of the Vulnerable Software and Affected Versions: Mahlamusa Who Hit The Page – Hit Counter plugin versions = 1.4.14.3 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially...

PT-2023-24719 · WordPress · Kaplugins Google Fonts For Wordpress

Name of the Vulnerable Software and Affected Versions: KAPlugins Google Fonts For WordPress plugin versions = 3.0.0 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing...

CVE-2023-38028

Saho’s attendance devices ADM100 and ADM-100FP have insufficient authentication. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication to read system information and operate user's data, but can’t control system or disrupt service...

PT-2023-26255 · Saho · Saho Adm100 +1

Name of the Vulnerable Software and Affected Versions: Saho attendance devices ADM100 and ADM-100FP affected versions not specified Description: The issue is related to insufficient authentication in Saho’s attendance devices. An unauthenticated remote attacker can exploit this to bypass...

Server-Side Request Forgery (SSRF)

org.apache.xmlgraphics:batik-script is vulnerable to Server-Side Request Forgery SSRF. An attacker is able to trick the application into loading a malicious SVG file, which could then be used to probe user data...

CloudExplorer Lite 信息泄露漏洞

CloudExplorer Lite is CloudExplorer's platform that provides out-of-the-box basic functionality for cloud hosting management, cloud billing, operational analytics, and security compliance, as well as powerful extensibility to meet the customization needs of enterprises. An information disclosure...

Exploit for CVE-2018-9995

CVE-2018-9995 - DVR Authentication Bypass This repository add...

PT-2023-23616 · Fahad Mahmood · Fahad Mahmood Wp Docs

Name of the Vulnerable Software and Affected Versions: Fahad Mahmood WP Docs plugin versions prior to 1.9.9 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowi...

PT-2023-23619 · Unknown · Ignazio Scimone Albo Pretorio On Line

Name of the Vulnerable Software and Affected Versions: Ignazio Scimone Albo Pretorio On line plugin versions = 4.6.3 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potential...