WordPress plugin Video List Manager has a SQL injection vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

PT-2023-22586 · Douphp · Douphp

Name of the Vulnerable Software and Affected Versions: DouPHP version 1.7 Description: A stored cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the unique id parameter in "/admin/article.php". This enables attackers to...

Cilium log information leakage vulnerability

Cilium is an open source software. It is used to provide and transparently secure network connectivity and load balancing between application workloads such as application containers or processes. A logging information disclosure vulnerability exists in Cilium that stems from Cilium logging...

WordPress Plugin Freshdesk: Input validation error vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. An input validation error vulnerability...

PT-2023-10281 · WordPress · Freshdesk Plugin

Name of the Vulnerable Software and Affected Versions: Freshdesk Plugin version 1.7 Description: A critical issue has been found in the Freshdesk Plugin on WordPress, affecting some unknown functionality. This issue leads to open redirect and can be exploited remotely. Recommendations: For...

WordPress Plugin WP htpasswd Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2023-20798 · Unknown · Kirin Fortress Machine

Name of the Vulnerable Software and Affected Versions: Kirin Fortress Machine version 1.7-2020-0610 Description: A SQL Injection issue allows attackers to execute arbitrary code via the "/admin.php?controller=admin commonuser" API endpoint, specifically through the controller parameter. This...

Path Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files

Impact If an admin account has already been compromised by an attacker, the LESS parser can be exploited to read sensitive files on the server through the use of path traversal techniques. An attacker can achieve this by providing an absolute path to a sensitive file in the custom LESS setting,...

GHSA-VHM8-WWRF-3GCW Path Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files

Impact If an admin account has already been compromised by an attacker, the LESS parser can be exploited to read sensitive files on the server through the use of path traversal techniques. An attacker can achieve this by providing an absolute path to a sensitive file in the custom LESS setting,...

Path traversal

flarum is a forum software package for building communities. In versions prior to 1.7.0 an admin account which has already been compromised by an attacker may use a vulnerability in the LESS parser which can be exploited to read sensitive files on the server through the use of path traversal...

SUSE CVE-2008-3325

Cross-site request forgery CSRF vulnerability in Moodle 1.6.x before 1.6.7 and 1.7.x before 1.7.5 allows remote attackers to modify profile settings and gain privileges as other users via a link or IMG tag to the user edit profile page...

SUSE CVE-2014-1418

Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the 1 Vary: Cookie or 2 Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers...

Wings postback link vulnerability

Wings is the server control interface for Pterodactyl Panel. A backlink vulnerability exists in Wings v1.7.x prior to v1.7.4, and v1.11.x prior to v1.11.4, which stems from the ability to recursively delete files and directories on the host system, which could be exploited by an attacker to...

CVE-2022-46639

A vulnerability in the descargaetiqueta.php component of Correos Prestashop 1.7.x allows attackers to execute a directory traversal...

PrestaShop path traversal vulnerability

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution offers multiple payment methods, short message alerts and product image scaling. A security vulnerability exists in Correos Prestashop version 1.7.x, which stems from the descargaetiqueta.php...

PT-2023-10228 · Overdrive Eletrônica · Course-Builder

Name of the Vulnerable Software and Affected Versions: Overdrive Eletrônica course-builder versions up to 1.7.x Description: A vulnerability was found in the course-builder, classified as problematic, affecting some unknown functionality of the file coursebuilder/modules/oeditor/oeditor.html. The...

CVE-2023-0254

The Simple Membership WP user Import plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ parameter in versions up to, and including, 1.7 due to insufficient escaping on the user supplied parameter. This makes it possible for authenticated attackers with administrative privileges...

PT-2023-16114 · WordPress · Simple Membership Wp User Import

Name of the Vulnerable Software and Affected Versions: Simple Membership WP user Import plugin for WordPress versions up to, and including, 1.7 Description: The issue allows for SQL Injection via the orderby parameter due to insufficient escaping on the user-supplied parameter. This enables...

PT-2023-18518 · Tokio · Tokio

Name of the Vulnerable Software and Affected Versions: Tokio versions 1.7.0 through 1.18.3 Tokio versions 1.18.4 through 1.20.2 Tokio versions 1.20.3 through 1.23.0 Description: When configuring a Windows named pipe server, setting pipe mode will reset reject remote clients to false. If the...

CVE-2022-4637 ep3-bs cross site scripting

A vulnerability classified as problematic has been found in ep3-bs up to 1.7.x. This affects an unknown part. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.8.0 is able to address this issue. The name of the patch is...