Exploit for Cross-site Scripting in Abocms Abo.Cms

CVE-2023-48858 PoC for CVE-2023-48858 A Cross-site scripting...

PT-2024-15711 · Unknown · C21 Live Encoder/Live Mosaic

Name of the Vulnerable Software and Affected Versions: C21 Live Encoder and Live Mosaic version 5.3 Description: The issue is related to inadequate access control, allowing a remote attacker to access the application as an administrator user due to lack of proper credential management. This can b...

CVE-2024-20906

Vulnerability in the Integrated Lights Out Manager ILOM product of Oracle Systems component: System Management. Supported versions that are affected are 3, 4 and 5. Easily exploitable vulnerability allows high privileged attacker with network access via ICMP to compromise Integrated Lights Out...

CVE-2023-0079

The Customer Reviews for WooCommerce WordPress plugin before 5.17.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site...

SOGo Security Breach

SOGo is a very fast and scalable modern collaboration suite. It provides calendaring, address book management and a full-featured Webmail client as well as resource sharing and permission handling. A security vulnerability exists in SOGo version 5.8.0, which stems from an HTML injection...

Traccar Security Vulnerabilities

Traccar is the United States Traccar company of a Java-based GPS tracking can provide the function of building the system . The software supports more than 170 kinds of GPS protocols and more than 1500 models of GPS tracking devices . traccar can be used with any major SQL database system . It al...

PT-2024-13959 · Traccar · Traccar

Name of the Vulnerable Software and Affected Versions: Traccar versions prior to 5.11 Description: Traccar, an open source GPS tracking system, is affected by an unrestricted file upload vulnerability in the File feature. This allows attackers to execute arbitrary code on the server. The issue is...

AZL-33891 CVE-2023-49569 affecting package packer for versions less than 1.9.5-3

A path traversal vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to create and amend files across the filesystem. In the worse case scenario, remote code execution could be achieved. Applications are only affected if they are using the ChrootO...

JFinalCMS Cross-Site Scripting Vulnerability

JFinalCMS is a content management system by heyewei Personal Developer. A cross-site scripting vulnerability exists in JFinalCMS version 5.0.0, which originates from cross-site scripting via the /gusetbook/save content parameter, allowing remote attackers to inject arbitrary web script or HTML...

Blood Bank & Donor Management SQL Injection Vulnerability

Blood Bank & Donor Management is a blood bank and donor management system. Blood Bank & Donor Management version 5.6 suffers from a SQL injection vulnerability that originates from a flaw in the /admin/request-received-bydonar.php file...

Rapid Software Rapid SCADA Input Validation Error Vulnerability

Rapid Software Rapid SCADA is an open source industrial automation platform from Rapid Software. An input validation error vulnerability exists in Rapid Software Rapid SCADA version 5.8.4 and prior versions, which originates from a vulnerability that allows an attacker to redirect a user to a...

JFinalCMS Cross-Site Scripting Vulnerability (CNVD-2024-02993)

JFinalCMS is a content management system. A cross-site scripting vulnerability exists in JFinalcms version 5.0.0, which stems from the application's lack of effective filtering and escaping of user-supplied data, and can be exploited by an attacker to run arbitrary code when creating a new custom...

PT-2024-15479 · Codeastro · Codeastro Simple House Rental System

Name of the Vulnerable Software and Affected Versions: CodeAstro Simple House Rental System version 5.6 Description: A problematic vulnerability was found in the Login Panel component, allowing for cross-site scripting. The attack can be launched remotely. Recommendations: For CodeAstro Simple...

PT-2024-10238 · Ibm · Ibm Devops Velocity +1

Name of the Vulnerable Software and Affected Versions: IBM DevOps Velocity version 5.0.0 IBM UrbanCode Velocity versions 4.0.0 through 4.0.25 Description: The issue is related to the use of weaker than expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive...

CVE-2023-41287

A SQL injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow users to inject malicious code via a network. We have already fixed the vulnerability in the following version: Video Station 5.7.2 2023/11/23 and later...

OESA-2024-1026 mosquitto security update

Mosquitto is an open source message broker that implements the MQ Telemetry Transport protocol version 3.1 and 3.1.1 MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for "machine to machine" messaging such as with low power senso...

UBUNTU-CVE-2024-21908

TinyMCE versions before 5.9.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML into the editor resulting in arbitrary JavaScript execution in another user's browser...

Documize Security Breach

Documize is an open source document collaboration system built on Golang and EmberJS. A security vulnerability exists in Documize version 5.4.2, which stems from an SQL injection vulnerability. The vulnerability allows remote attackers to execute arbitrary code via user parameters in the...

CVE-2023-50297

Open redirect vulnerability in PowerCMS 6 Series, 5 Series, and 4 Series allows a remote unauthenticated attacker to redirect users to arbitrary web sites via a specially crafted URL. Note that all versions of PowerCMS 3 Series and earlier which are unsupported End-of-Life, EOL are also affected ...

PT-2023-31748 · S Cms · S-Cms

Name of the Vulnerable Software and Affected Versions: S-CMS version 5.0 Description: The issue is related to a SQL injection vulnerability. It can be exploited via the A newsauth parameter at the "/admin/ajax.php" API endpoint. Recommendations: For S-CMS version 5.0, consider restricting access ...