CVE-2022-23603 Code injection in iTunesRPC-Remastered

iTunesRPC-Remastered is a discord rich presence application for use with iTunes & Apple Music. In code before commit 24f43aa user input is not properly sanitized and code injection is possible. Users are advised to upgrade as soon as is possible. There are no known workarounds for this issue...

CVE-2022-23603 Code injection in iTunesRPC-Remastered

iTunesRPC-Remastered is a discord rich presence application for use with iTunes & Apple Music. In code before commit 24f43aa user input is not properly sanitized and code injection is possible. Users are advised to upgrade as soon as is possible. There are no known workarounds for this issue...

GHSA-CXM3-V4MV-6MH8 vditor Vulnerable to Cross-site Scripting in SVG events

vditor does not filter user input in SVG events, leading to XSS PoC html...

vditor Vulnerable to Cross-site Scripting in SVG events

vditor does not filter user input in SVG events, leading to XSS PoC html...

CVE-2022-22992

A command injection remote code execution vulnerability was discovered on Western Digital My Cloud Devices that could allow an attacker to execute arbitrary system commands on the device. The vulnerability was addressed by escaping individual arguments to shell functions coming from user input...

SQL Injection

showdoc/showdoc is vulnerable to SQL Injection attacks. The library does not properly sanitize the uid parameter which is an user input, allowing a malicious user to inject and execute arbitrary SQL queries on the server...

Jfinal CMS Cross-Site Scripting Vulnerability

Jfinal CMS is a java development of powerful information consulting website , using a simple and powerful JFinal as the web framework , template engine with beetl, database with mysql, front-end bootstrap framework. Jfinal CMS cross-site scripting vulnerability , the vulnerability stems from the...

WordPress RegistrationMagic V 5.0.1.5 SQL Injection

Exploit Title: WordPress Plugin RegistrationMagic V 5.0.1.5 - SQL Injection Authenticated Date 23.01.2022 Exploit Author: Ron Jost Hacker5preme Vendor Homepage: https://registrationmagic.com/ Software Link:...

WordPress Plugin RegistrationMagic V 5.0.1.5 - SQL Injection (Authenticated)

Exploit Title: WordPress Plugin RegistrationMagic V 5.0.1.5 - SQL Injection Authenticated Date 23.01.2022 Exploit Author: Ron Jost Hacker5preme Vendor Homepage: https://registrationmagic.com/ Software Link:...

Path traversal

Apache Karaf obr: commands and run goal on the karaf-maven-plugin have partial path traversal which allows to break out of expected folder. The risk is low as obr: commands are not very used and the entry is set by user. This has been fixed in revision:...

Dell EMC Data Protection Central Server-Side Request Forgery Vulnerability

Dell Emc Data Protection Central is a management console from Dell USA Inc. It is used for data protection. A server-side request forgery vulnerability exists in Dell EMC Data Protection Central 19.5 and prior versions, which stems from the product's failure to properly validate user input and ca...

CVE-2021-46087

In jfinalcms = 5.1 0, there is a storage XSS vulnerability in the background system of CMS. Because developers do not filter the parameters submitted by the user input form, any user with background permission can affect the system security by entering malicious code...

CVE-2021-46087

In jfinalcms = 5.1 0, there is a storage XSS vulnerability in the background system of CMS. Because developers do not filter the parameters submitted by the user input form, any user with background permission can affect the system security by entering malicious code...

Design/Logic Flaw

In jfinalcms = 5.1 0, there is a storage XSS vulnerability in the background system of CMS. Because developers do not filter the parameters submitted by the user input form, any user with background permission can affect the system security by entering malicious code...

CVE-2021-46087

In jfinalcms = 5.1 0, there is a storage XSS vulnerability in the background system of CMS. Because developers do not filter the parameters submitted by the user input form, any user with background permission can affect the system security by entering malicious code...

CVE-2021-46087

CVE-2021-46087 corresponds to a stored XSS vulnerability in the JFinal CMS (jfinal_cms) with version qualification “>= 5.1.0” as described in the CVE summary. The vulnerability arises because the application does not filter user input from forms submitted in the background/administrative inter...

Sourcecodester Online Resort Management System SQL Injection Vulnerability

Sourcecodester Online Resort Management System is an open source web-based application that provides online room reservations and can also be used as a simple website for resorts. sourcecodester Online Resort Management System in version v1.0 A SQL injection vulnerability exists, which stems from...

Sourcecodester Simple Music Clour Community System SQL Injection Vulnerability

Sourcecodester Simple Music Clour Community System is a simple music cloud community system. sourcecodester Simple Music Clour Community System has a SQL injection vulnerability in version v1.0, which originates from the product / music/ajax.php page fails to properly filter the email parameter f...

SourceCodester Employee and Visitor Gate Pass Logging System SQL注入漏洞

SourceCodester Employee and Visitor Gate Pass Logging System is a simple web-based employee and visitor pass logging system that provides companies with an automated platform to track or log the daily records of employees and visitors entering a company building or premises. A SQL injection...

CVE-2021-43355 Fresenius Kabi Agilia Connect Infusion System use of client side authentication

Fresenius Kabi Vigilant Software Suite Mastermed Dashboard version 2.0.1.3 allows user input to be validated on the client side without authentication by the server. The server should not rely on the correctness of the data because users might not support or block JavaScript or intentionally bypa...