CVE-2023-36474 Interactsh server settings make users vulnerable to Subdomain Takeover

Interactsh is an open-source tool for detecting out-of-band interactions. Domains configured with interactsh server prior to version 1.0.0 were vulnerable to subdomain takeover for a specific subdomain, i.e app. Interactsh server used to create cname entries for app pointing to...

CVE-2023-3412

The Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0.0. This is due to a missing capability check on the ajaxstoresave function. This makes it possible for authenticated...

PT-2023-24690 · WordPress · Image Map Pro

Name of the Vulnerable Software and Affected Versions: Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite plugin for WordPress versions up to, and including, 1.0.0 Description: The issue is related to Stored Cross-Site Scripting due to a missing capability check on the ajax store...

WordPress Image Map Pro Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Image Map Pro Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-3411 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 58704efd163a Credits Kenichiro Ito Required...

CVE-2023-3387 Lana Text to Image <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Lana Text to Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lanatexttoimage' and 'lanatexttoimg' shortcode in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible f...

WordPress plugin Lana Text to Image 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2023-35776

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Beplus Sermon'e – Sermons Online plugin = 1.0.0 versions...

WordPress plugin Sermon e – Sermons Online 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Malicious code in dependency1338 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4342f154d7ceb9727add670c55348d65e1b2c18232cbf166d82257971ad05712 The OpenSSF Package Analysis project identified 'dependency1338' @ 1.0.0 pypi as malicious. It is considered malicious because: - The package...

PT-2023-24168 · Minical · Minical

Name of the Vulnerable Software and Affected Versions: miniCal version 1.0.0 Description: A critical issue affects the processing of the file /booking/show bookings/. The manipulation of the search query argument leads to SQL injection. The attack may be initiated remotely. The exploit has been...

CVE-2023-30150

PrestaShop leocustomajax 1.0 and 1.0.0 are vulnerable to SQL Injection via modules/leocustomajax/leoajax.php...

Malicious code in fabric-integration (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 95e54d11b0e8b8ae3ec65bb015b953544d6e1b0e8e8d5ac3ebe884d858528d42 The OpenSSF Package Analysis project identified 'fabric-integration' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

HashiCorp Vault 跨站脚本漏洞

HashiCorp Vault is a private key access management tool from HashiCorp USA. A security vulnerability exists in Vault and Vault Enterprise version 1.0.0 that stems from allowing HTML code to be injected into the Vault Web UI via key-value key-value v2...

miniCal CSV Injection Vulnerability

miniCal is miniCal open source an open source PMS. miniCal 1.0.0 and earlier versions exist CSV injection vulnerability , the vulnerability stems from improperly neutralized formula elements in CSV files , an attacker can exploit the vulnerability to remotely execute code...

CVE-2023-33408

Minical 1.0.0 is vulnerable to Cross Site Scripting XSS. The vulnerability exists due to insufficient input validation in the application's user input handling in the securityhelper.php file...

miniCal 跨站脚本漏洞

miniCal is miniCal open source an open source PMS. miniCal version 1.0.0 cross-site scripting vulnerability can be exploited by an attacker to execute arbitrary Web script or HTML by injecting a carefully crafted payload...

miniCal 跨站请求伪造漏洞

miniCal is miniCal open source an open source PMS. miniCal version 1.0.0 cross-site request forgery vulnerability , attackers can use the GIA vulnerability to forge malicious requests to lure the victim to click to perform sensitive operations...

Malicious code in blablablabla (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis bd2b2f6e1811c31bc38b88ead4b4ae8e2fb7006281d75f272d5b87f08a0e9064 The OpenSSF Package Analysis project identified 'blablablabla' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

CVE-2023-34205

In Moov signedxml through 1.0.0, parsing the raw XML as received can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack aka XSW...

Moov signedxml 数据伪造问题漏洞

signedxml is moov open source a pure go library for processing signed XML documents . Moov signedxml version 1.0.0 and earlier versions of a security vulnerability , the vulnerability stems from parsing the original XML may lead to parsing the canonicalized XML with a different output , an attack...