PT-2023-19112 · WordPress · Givewp

Name of the Vulnerable Software and Affected Versions: GiveWP plugin versions = 2.25.1 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability requires authentication and affects users with contributor or higher permissions. Recommendations: For...

PT-2023-19569 · Ecwid · Ecwid Ecommerce Shopping Cart

Name of the Vulnerable Software and Affected Versions: Ecwid Ecommerce Shopping Cart plugin versions = 6.11.4 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability requires authentication and affects users with contributor or higher permissions...

PT-2023-17146 · WordPress · Ai Chatbot

Name of the Vulnerable Software and Affected Versions: AI ChatBot WordPress plugin versions prior to 4.4.7 Description: The issue allows unauthenticated users to perform PHP Object Injection via an AJAX action, potentially exploiting the presence of a suitable gadget on the blog. This is achieved...

PT-2023-12131 · Unknown · Cms Made Simple

Name of the Vulnerable Software and Affected Versions: CMS Made Simple versions prior to 2.2.16 Description: The issue allows remote attackers to execute arbitrary commands. This is achieved via the m1 sortby parameter to the "modules/News/function.admin articlestab.php" endpoint. Recommendations...

PT-2023-22597 · Cyberghost · Cyberghostvpn Windows Client

Name of the Vulnerable Software and Affected Versions: CyberGhostVPN Windows Client versions prior to 8.3.10.10015 Description: A DLL injection issue was found in the Dashboard.exe component of the CyberGhostVPN Windows Client. Recommendations: For versions prior to 8.3.10.10015, update to versio...

PT-2023-20140 · Unilogies · Bumsys

Name of the Vulnerable Software and Affected Versions: unilogies/bumsys versions prior to 2.2.0 Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs when an application receives input from a user and stores it, allowing an attacker to inject malicious scripts. This...

PT-2023-23122 · Unknown · Opc Ua .Net Standard Reference Server

Name of the Vulnerable Software and Affected Versions: OPC UA .NET Standard Reference Server versions prior to 1.4.371.86 Description: The issue allows remote attackers to send malicious requests that expose sensitive information by placing it into an error message. This error message may be seen...

PT-2023-20407 · WordPress · Eirudo Simple Youtube Responsive

Name of the Vulnerable Software and Affected Versions: Eirudo Simple YouTube Responsive plugin versions = 2.5 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. It affects users with contributor or higher permissions. There is no information provided about the...

PT-2023-20424 · WordPress · Denzel Chia | Phire Design Custom Login Page

Name of the Vulnerable Software and Affected Versions: Denzel Chia | Phire Design Custom Login Page plugin versions = 2.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For Denzel Chia |...

PT-2023-19273 · Unknown +1 · Himanshu Bing Site Verification +1

Name of the Vulnerable Software and Affected Versions: Himanshu Bing Site Verification plugin using Meta Tag plugin version 1.0 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability...

PT-2023-20392 · Peepso · Peepso Community

Name of the Vulnerable Software and Affected Versions: PeepSo Community by PeepSo plugin versions 6.0.2.0 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended...

Medium: redis6

Issue Overview: Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to trigger a runtime assertion and termination of the Redis server process. The problem is fixed in Redis version 7.0.10...

PT-2023-17333 · WordPress · Blocksy Companion

Name of the Vulnerable Software and Affected Versions: Blocksy Companion WordPress plugin versions prior to 1.8.82 Description: The issue allows any authenticated users, such as subscribers, to access draft posts via a shortcode, because it does not ensure that posts are already public and can be...

PT-2023-17070 · WordPress · Quick Paypal Payments

Name of the Vulnerable Software and Affected Versions: Quick Paypal Payments WordPress plugin versions prior to 5.7.26.4 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is...

PT-2023-3998 · Ubiquiti · Edgerouter X +1

Name of the Vulnerable Software and Affected Versions: Ubiquiti EdgeRouter versions prior to 2.0.9-hotfix.7 Ubiquiti AirCube versions prior to 2.8.9 Description: A heap overflow vulnerability found in EdgeRouters and Aircubes allows a malicious actor to interrupt UPnP service to said devices. The...

PT-2023-23331 · Talend · Talend Studio

Name of the Vulnerable Software and Affected Versions: Talend Studio versions prior to 7.3.1-R2022-10 Talend Studio versions 8.x prior to 8.0.1-R2022-09 Description: The issue allows unauthenticated access to the Jolokia endpoint of the microservice, enabling remote access to the JVM via the...

Cross-site Scripting (XSS) in Ecommerce Pricing Rules name field

Impact This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Patches Update to version 10.5.21 or apply this patch manually...

SQL Injection in Admin Search Find API

Impact SQL injection is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. It generally allows an attacker to view data that they are not normally able to retrieve. This might include data belonging to other users, or any...

CVE-2023-30849 Pimcore vulnerable to SQL Injection in Translation Export API

Pimcore is an open source data and experience management platform. Prior to version 10.5.21, A SQL injection vulnerability exists in the translation export API. Users should update to version 10.5.21 to receive a patch or, as a workaround, or apply the patch manually...

PT-2023-18937 · Pimcore · Pimcore

Name of the Vulnerable Software and Affected Versions: pimcore/pimcore versions prior to 10.5.21 Description: This issue is related to Cross-site Scripting XSS - DOM, which has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or...