588 matches found
PT-2023-31370 · Unknown · Fix My Feed Rss Repair
Name of the Vulnerable Software and Affected Versions: Fix My Feed RSS Repair versions 1.4 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application...
PT-2023-32769 · Unknown · Amazing Little Poll
Name of the Vulnerable Software and Affected Versions: Amazing Little Poll versions 1.3 through 1.4 Description: The issue allows an unauthenticated user to access the admin panel without providing any credentials by accessing the "lp admin.php?adminstep=" parameter. This could enable unauthorize...
WordPress Evergreen Content Poster Plugin <= 1.4 is vulnerable to Cross Site Scripting (XSS)
Software Evergreen Content Poster Type Plugin Vulnerable versions = 1.4 Fixed in 1.4.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-41127 Patch priority Low CVSS severity Low 5.9 Developer Evergreen Content Poster PSID 35d54e5980dd Credits DoYeon Park p6rkdoye0n...
LMXCMS SQL注入漏洞
lmxcms dream cms is a website building system of China dream cms lmxcms company. A SQL injection vulnerability exists in LMXCMS v1.4, which stems from the application's lack of validation of externally entered SQL statements. An attacker can exploit this vulnerability to execute arbitrary code vi...
WordPress Tab Ultimate Plugin <= 1.3 is vulnerable to Cross Site Scripting (XSS)
Software Tab Ultimate Type Plugin Vulnerable versions = 1.3 Fixed in 1.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5667 Patch priority Low CVSS severity Low 6.4 Developer Claim ownership PSID 6b4d31988178 Credits István Márton Required privileg...
CVE-2023-43667
Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, the attacker can create misleading or false log records, making it harder to audit and trace malicious...
CVE-2023-43072
Dell SmartFabric Storage Software v1.4 and earlier contains an improper access control vulnerability in the CLI. A local possibly unauthenticated attacker could potentially exploit this vulnerability, leading to ability to execute arbritrary shell commands...
PT-2023-28682 · Dell · Dell Smartfabric Storage
Name of the Vulnerable Software and Affected Versions: Dell SmartFabric Storage Software versions 1.4 and earlier Description: The issue is related to an improper access control vulnerability in the Command Line Interface CLI of the software. A local, possibly unauthenticated attacker could explo...
Dell SmartFabric Storage Software 安全漏洞
Dell SmartFabric Storage Software is a stand-alone storage software solution from Dell USA. Dell SmartFabric Storage Software version 1.4 suffers from an HTML injection vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied data, which can be...
CVE-2023-5295
The Blog Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'vivafbcomment' shortcode in versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...
WordPress Comments by Startbit Plugin <= 1.4 is vulnerable to Cross Site Scripting (XSS)
Software Comments by Startbit Type Plugin Vulnerable versions = 1.4 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5295 Patch priority Low CVSS severity Low 6.4 Developer Claim ownership PSID 790370410166 Credits István Márton Required...
cn.net.vidyo:dylink-vidyo-ws-sdk (>=2.1.0.16.RELEASE <=3.0.0.3.RELEASE), com.aftia.plugin:aem-build-maven-plugin.core (>=1.2.1 <=1.2.2) +286 more potentially affected by CVE-2023-40743 via org.apache.axis:axis (=1.4)
org.apache.axis:axis MAVEN version =1.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.axis:axis and may be impacted: - cn.net.vidyo:dylink-vidyo-ws-sdk =2.1.0.16.RELEASE, =1.2.1, =1.0.0, =1.4-build003, =0.9.1, =0.0.3.M1, =0.0.3.M1,...
CVE-2023-31246
Incorrect default permissions in some IntelR SDP Tool software before version 1.4 build 5 may allow an authenticated user to potentially enable escalation of privilege via local access...
Tiva Events Calender 跨站脚本漏洞
Tiva Events Calender is a calendar application by the individual developer of tivatheme. A cross-site scripting vulnerability exists in Tiva Events Calender version 1.4, which stems from the parameter name leading to cross-site scripting...
PT-2023-26150 · Unknown · Codecanyon Tiva Events Calender
Name of the Vulnerable Software and Affected Versions: Codecanyon Tiva Events Calender version 1.4 Description: A problematic vulnerability was found in the software, affecting unknown code. The manipulation of the name argument leads to cross-site scripting. The attack can be initiated remotely...
ShowMojo MojoBox Digital Lockbox 安全漏洞
The ShowMojo MojoBox Digital Lockbox is a digital lockbox from ShowMojo. A security vulnerability exists in the ShowMojo MojoBox Digital Lockbox version 1.4, which stems from4 Vulnerability to authentication bypass, and vulnerability to replay attacks on the unlocking mechanism via Bluetooth Low...
Blackcat Cms v1.4 - Remote Code Execution (RCE)
Exploit Title: Blackcat Cms v1.4 - Remote Code Execution RCE Application: blackcat Cms Version: v1.4 Bugs: RCE Technology: PHP Vendor URL: https://blackcat-cms.org/ Software Link: https://github.com/BlackCatDevelopment/BlackCatCMS Date of found: 13.07.2023 Author: Mirabbas Ağalarov Tested on: Lin...
PT-2023-10300 · WordPress · Wp-Donate
Name of the Vulnerable Software and Affected Versions: wp-donate Plugin versions up to 1.4 Description: A critical issue has been found in the wp-donate Plugin, affecting an unknown part of the file includes/donate-display.php. This issue leads to sql injection and can be initiated remotely...
CVE-2023-2907
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Marksoft allows SQL Injection. This issue affects Marksoft: through Mobile:v.7.1.7 ; Login:1.4 ; API:20230605...
