FL3R FeelBox <= 8.1 - Unauthenticated SQLi

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection. 1. Visit a blog post and extract the nonce from the source search for "feelboxAjax", and extract the "token" curl -s...

GHSA-GW95-48XQ-GQF9 Moodle sensitive information disclosure

In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access...

CVE-2019-16245

OMERO before 5.6.1 makes the details of each user available to all users...

CVE-2020-13792

PlayTube 1.8 allows disclosure of user details via ajax.php?type=../admin-panel/autoload&page=manage-users directory traversal, aka local file inclusion...