422 matches found
Stupid Simple CMS Security Vulnerability
Stupid Simple CMS is a content management system by codelyfe individual developer. A security vulnerability exists in Stupid Simple CMS 1.2.4 and earlier versions, which stems from a path traversal vulnerability in the file /file-manager/rename.php...
CVE-2023-48766
Cross-Site Request Forgery CSRF vulnerability in SVGator SVGator – Add Animated SVG Easily.This issue affects SVGator – Add Animated SVG Easily: from n/a through 1.2.4...
PT-2023-32815 · Codelyfe · Codelyfe Stupid Simple Cms
Name of the Vulnerable Software and Affected Versions: codelyfe Stupid Simple CMS versions up to 1.2.4 Description: A critical issue has been found in the Deletion Interface component, specifically in the /file-manager/delete.php file. The manipulation of the file argument leads to improper...
Stupid Simple CMS Authorization Issues Vulnerability
Stupid Simple CMS is a content management system for codelyfe individual developers. Stupid Simple CMS 1.2.4 and earlier versions have an authorization issue vulnerability that stems from the parameter file in the file /file-manager/delete.php that causes incorrect authentication...
Stupid Simple CMS Code Issue Vulnerability
Stupid Simple CMS is a content management system by codelyfe individual developer. A code issue vulnerability exists in Stupid Simple CMS 1.2.4 and earlier versions, which stems from an arbitrary file upload vulnerability in file/file manager/upload.php...
CVE-2023-50266
Bazarr manages and downloads subtitles. In version 1.2.4, the proxy method in bazarr/bazarr/app/ui.py does not validate the user-controlled protocol and url variables and passes them to requests.get without any sanitization, which leads to a blind server-side request forgery SSRF. This issue allo...
Server side request forgery (ssrf)
Bazarr manages and downloads subtitles. In version 1.2.4, the proxy method in bazarr/bazarr/app/ui.py does not validate the user-controlled protocol and url variables and passes them to requests.get without any sanitization, which leads to a blind server-side request forgery SSRF. This issue allo...
CVE-2023-50266 Bazarr Blind Server-Side Request Forgery (SSRF) in the /test/<protocol>/ endpoint
Bazarr manages and downloads subtitles. In version 1.2.4, the proxy method in bazarr/bazarr/app/ui.py does not validate the user-controlled protocol and url variables and passes them to requests.get without any sanitization, which leads to a blind server-side request forgery SSRF. This issue allo...
CVE-2023-50266 Bazarr Blind Server-Side Request Forgery (SSRF) in the /test/<protocol>/ endpoint
Bazarr manages and downloads subtitles. In version 1.2.4, the proxy method in bazarr/bazarr/app/ui.py does not validate the user-controlled protocol and url variables and passes them to requests.get without any sanitization, which leads to a blind server-side request forgery SSRF. This issue allo...
PT-2023-31102 · Wpdeveloper · Wpdeveloper Parallax Slider Block
Name of the Vulnerable Software and Affected Versions: WPDeveloper Parallax Slider Block versions 1.2.4 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an...
Bazarr Code Issue Vulnerability
Bazarr is a software from Bazarr, a companion application to Sonarr and Radarr that manages and downloads subtitles according to your requirements. A code issue vulnerability exists in Bazarr version 1.2.4, which stems from a Server Request Forgery SSRF vulnerability in the file...
CVE-2023-33238
TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command injection vulnerability. This vulnerability stems from inadequate input validation in the certificate management function, which could potentially allow malicious...
PT-2023-4620 · Moxa · Moxa Tn-5900 Series +1
Name of the Vulnerable Software and Affected Versions: Moxa TN-4900 Series firmware versions v1.2.4 and prior Moxa TN-5900 Series firmware versions v3.3 and prior Description: The issue stems from insufficient input validation in the key-generation function, which could potentially allow maliciou...
Remote code execution
yaklang is a programming language designed for cybersecurity. The Yak Engine has been found to contain a local file inclusion LFI vulnerability. This vulnerability allows attackers to include files from the server's local file system through the web application. When exploited, this can lead to t...
PT-2023-27218 · Unknown · Yak Engine
Name of the Vulnerable Software and Affected Versions: Yak Engine versions prior to 1.2.4-sp1 Description: The Yak Engine contains a local file inclusion LFI vulnerability, allowing attackers to include files from the server's local file system through the web application. This can lead to...
WordPress Paid Memberships Pro Plugin <= 1.2.4 is vulnerable to Cross Site Scripting (XSS)
Software Paid Memberships Pro Type Plugin Vulnerable versions = 1.2.4 Fixed in 1.2.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 77be0838d452 Credits WordFence Required privilege...
Journal Management Software 1.2.4 SQL Injection
==================================================================================================================================== | Title : Journal Management Software V1.2.4 Sql injection | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 63.0.3 32-bi...
WordPress ACF-VC Integrator Plugin <= 1.2.4 is vulnerable to Cross Site Scripting (XSS)
Software ACF-VC Integrator Type Plugin Vulnerable versions = 1.2.4 Fixed in 1.3.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID e13159d51c36 Credits Rafie Muhammad Patchstack Required...