Huaxia ERP Authorization Issues Vulnerability

Huaxia ERP is an ERP software from Huaxia, China. Huaxia ERP 3.1 and prior versions have an authorization issue vulnerability that originates from the file src/main/java/com/jsh/erp/controller/UserController.java that can lead to weak password recovery...

PT-2024-15608 · Unknown · Huaxia Erp

Name of the Vulnerable Software and Affected Versions: Huaxia ERP versions up to 3.1 Description: A problematic issue has been found in Huaxia ERP, affecting an unknown function of the file src/main/java/com/jsh/erp/controller/UserController.java. This issue leads to weak password recovery and ca...

CVE-2023-52225

Deserialization of Untrusted Data vulnerability in Tagbox Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics.This issue affects Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics: from n/a through 3.1...

AVA teaching video application service platform Cross-site scripting vulnerability

AVA Teaching Video Application Service Platform is a teaching video application service platform from China Aovia AVA. A cross-site scripting vulnerability exists in AVA teaching video application service platform version 3.1, which can be exploited by remote attackers to execute arbitrary code v...

WordPress Taggbox Plugin <= 3.1 is vulnerable to PHP Object Injection

Software Taggbox Type Plugin Vulnerable versions = 3.1 Fixed in 3.2 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2023-52225 Patch priority High CVSS severity High 10 Developer Claim ownership PSID cec0f62daeea Credits Rafie Muhammad Patchstack Required privilege...

PT-2023-31798 · Unknown · Rise Blocks

Name of the Vulnerable Software and Affected Versions: Rise Blocks – A Complete Gutenberg Page Builder versions 3.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actio...

CVE-2023-5432

The Jquery news ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'jquery-news-ticker' shortcode in versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2023-33214

Cross-Site Request Forgery CSRF vulnerability in Tagbox Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics.This issue affects Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics: from n/a through 3.1...

PT-2023-8371 · Ibm · Vios +1

Name of the Vulnerable Software and Affected Versions: IBM AIX versions 7.2 through 7.3 VIOS version 3.1 Description: The issue is related to a buffer overflow in memory, allowing an attacker to execute arbitrary commands using the invscout command. This could enable a non-privileged local user t...

CVE-2023-47229

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Vyas Dipen Top 25 Social Icons plugin = 3.1 versions...

PT-2023-30375 · WordPress · Vyas Dipen Top 25 Social Icons

Name of the Vulnerable Software and Affected Versions: Vyas Dipen Top 25 Social Icons plugin versions = 3.1 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. It affects users with contributor or higher permissions. There is no information provided about the...

WordPress Delete Me Plugin <= 3.0 is vulnerable to Cross Site Scripting (XSS)

Software Delete Me Type Plugin Vulnerable versions = 3.0 Fixed in 3.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5126 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 66ecd54b472e Credits Lana Codes Required privilege...

Cross site scripting

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. org.xwiki.platform:xwiki-platform-web starting in version 3.1-milestone-1 and prior to 13.4-rc-1, org.xwiki.platform:xwiki-platform-web-templates prior to versions 14.10.2 and 15.5-rc-1, and...

Discourse 3.1.x <= 3.1.1, 3.2.0.beta1 Unauthorized Access Vulnerability

Discourse is prone to an unauthorized access vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse";...

Cross site scripting

Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting XSS vulnerability stored via /registresult.htm POST method, in the Resume parameter. The XSS is loaded from /register.ghp...

CVE-2023-4496 Easy Chat Server XSS vulnerability

Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting XSS vulnerability stored via /body2.ghp POST method, in the mtowho parameter...

CVE-2023-4496 Easy Chat Server XSS vulnerability

Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting XSS vulnerability stored via /body2.ghp POST method, in the mtowho parameter...

CVE-2023-4495 Easy Chat Server XSS vulnerability

Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting XSS vulnerability stored via /registresult.htm POST method, in the Resume parameter. The XSS is loaded from /register.ghp...

PT-2023-29319 · Unknown · Easy Chat Server

Name of the Vulnerable Software and Affected Versions: Easy Chat Server version 3.1 Description: A stack-based buffer overflow issue exists due to an excessively long username string being sent to the "register.ghp" file via a GET request, potentially leading to arbitrary code execution on the...

PT-2023-29324 · Unknown · Easy Chat Server

Name of the Vulnerable Software and Affected Versions: Easy Chat Server versions 3.1 and earlier Description: The issue arises from insufficient encryption of user-controlled inputs, leading to a Cross-Site Scripting XSS vulnerability. This vulnerability is stored via the "/registresult.htm" API...