CVE-2024-7099

netease-youdao/qanything version 1.4.1 contains a vulnerability where unsafe data obtained from user input is concatenated in SQL queries, leading to SQL injection. The affected functions include getknowledgebasename, fromstatustostatus, deletefiles, and getfilebystatus. An attacker can exploit...

CVE-2024-7099 SQL Injection in netease-youdao/qanything

netease-youdao/qanything version 1.4.1 contains a vulnerability where unsafe data obtained from user input is concatenated in SQL queries, leading to SQL injection. The affected functions include getknowledgebasename, fromstatustostatus, deletefiles, and getfilebystatus. An attacker can exploit...

CVE-2024-7099 SQL Injection in netease-youdao/qanything

netease-youdao/qanything version 1.4.1 contains a vulnerability where unsafe data obtained from user input is concatenated in SQL queries, leading to SQL injection. The affected functions include getknowledgebasename, fromstatustostatus, deletefiles, and getfilebystatus. An attacker can exploit...

CVE-2024-7099

The CVE-2024-7099 issue affects netease-youdao/qanything, vulnerable in version 1.4.1 where unsafe data from user input is concatenated into SQL queries. Functions such as get_knowledge_base_name, from_status_to_status, delete_files, and get_file_by_status are implicated, enabling an attacker to ...

NetEase QAnything SQL注入漏洞

NetEase QAnything is a local knowledgebase question and answer system from China's NetEase that is designed to support files or databases in any format, and can be installed and used offline. A SQL injection vulnerability exists in NetEase QAnything version 1.4.1, which originates from the abilit...

PT-2024-38074 · Netease Youdao · Qanything

Name of the Vulnerable Software and Affected Versions: netease-youdao/qanything version 1.4.1 Description: The issue concerns a SQL injection vulnerability where unsafe data obtained from user input is concatenated in SQL queries. This affects functions including get knowledge base name, from...

GHSA-PV7H-HG6M-82J8 Gouniverse GoLang CMS vulnerable to Cross-site Scripting

A vulnerability was found in Gouniverse GoLang CMS 1.4.0. It has been declared as problematic. This vulnerability affects the function PageRenderHtmlByAlias of the file FrontendHandler.go. The manipulation of the argument alias leads to cross site scripting. The attack can be initiated remotely...

CVE-2024-8572

A vulnerability was found in Gouniverse GoLang CMS 1.4.0. It has been declared as problematic. This vulnerability affects the function PageRenderHtmlByAlias of the file FrontendHandler.go. The manipulation of the argument alias leads to cross site scripting. The attack can be initiated remotely...

CVE-2024-8572 Gouniverse GoLang CMS FrontendHandler.go PageRenderHtmlByAlias cross site scripting

A vulnerability was found in Gouniverse GoLang CMS 1.4.0. It has been declared as problematic. This vulnerability affects the function PageRenderHtmlByAlias of the file FrontendHandler.go. The manipulation of the argument alias leads to cross site scripting. The attack can be initiated remotely...

CVE-2024-38793

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in PriceListo Best Restaurant Menu by PriceListo allows SQL Injection.This issue affects Best Restaurant Menu by PriceListo: from n/a through 1.4.1...

WordPress Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid plugin <= 1.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by wesley wcraft in WordPress Plugin Logo Showcase Ultimate versions = 1.4.1...

PT-2024-38772 · WordPress · The Logo Showcase Ultimate

Name of the Vulnerable Software and Affected Versions: The Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid plugin for WordPress versions up to, and including, 1.4.1 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input...

PT-2024-28224 · Pricelisto · Best Restaurant Menu By Pricelisto

Name of the Vulnerable Software and Affected Versions: PriceListo Best Restaurant Menu by PriceListo versions 1.4.1 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows attackers to...

WordPress Send Emails with Mandrill plugin <= 1.4.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Abdi Pranata Patchstack Alliance in WordPress Plugin Send Emails with Mandrill versions = 1.4.1...

WordPress Best Restaurant Menu by Pricelisto plugin <= 1.4.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Jayden Caelli - ret2desync Patchstack Alliance in WordPress Plugin Best Restaurant Menu by PriceListo versions = 1.4.1...

PT-2024-27310 · Unknown · My Favorites

Name of the Vulnerable Software and Affected Versions: My Favorites versions n/a through 1.4.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations: For version...

PT-2024-27409 · Unknown · Jethin Gallery Slideshow

Name of the Vulnerable Software and Affected Versions: Jethin Gallery Slideshow versions 1.4.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations:...

PT-2024-27627 · Woocommerce · Cc & Bcc For Woocommerce Order Emails

Name of the Vulnerable Software and Affected Versions: CC & BCC for Woocommerce Order Emails versions 1.4.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS, which means...

WordPress CC & BCC for Woocommerce Order Emails plugin <=1.4.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin CC & BCC for Woocommerce Order Emails versions = 1.4.1...

CVE-2024-37298

A flaw was found in the gorilla/schema package. Running schema.Decoder.Decode on a struct that has a field of type struct... opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of schema.Decoder.Decode on a struct with arrays ...