PT-2023-24307 · Icecms · Icecms

Name of the Vulnerable Software and Affected Versions: IceCMS version 1.0.0 Description: The issue is related to Cross Site Scripting XSS, which is a type of attack where an attacker injects malicious scripts into a website, allowing them to steal user data or take control of the user's session...

PT-2023-24306 · Icecms · Icecms

Name of the Vulnerable Software and Affected Versions: IceCMS version 1.0.0 Description: The issue is related to Insecure Permissions, allowing unauthorized access to the API. This results in the disclosure of sensitive information. Recommendations: For IceCMS version 1.0.0, consider restricting...

Out-of-bounds

The news MonkeyC operation code in CIQ API version 1.0.0 through 4.1.7 fails to check that string resources are not extending past the end of the expected sections. A malicious CIQ application could craft a string that starts near the end of a section, and whose length extends past its end. Upon...

Content Management System 跨站脚本漏洞

SourceCodester Content Management System is a software application. A simple PHP/Library MySQLi to manage the content items of a simple website. A security vulnerability exists in Content Management System version 1.0.0, which originates from an easy cross-site scripting XSS attack via...

PT-2023-23893 · WordPress · Pingonline Dyslexiefont Free

Name of the Vulnerable Software and Affected Versions: PingOnline Dyslexiefont Free plugin versions = 1.0.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application that the user is...

PrestaShop posstaticblocks SQL注入漏洞

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides a variety of payment methods, SMS alerts and product image scaling and other features. A security vulnerability exists in PrestaShop posstaticblocks version 1.0.0 and earlier version...

CVE-2023-30189

Prestashop posstaticblocks = 1.0.0 is vulnerable to SQL Injection via posstaticblocks::getPosCurrentHook...

CVE-2023-25460 WordPress Easy Ad Manager Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in CodeSolz Easy Ad Manager plugin = 1.0.0 versions...

WordPress weebotLite Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

Software weebotLite Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-32596 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID ab865941cc20 Credits Lokesh Dachepalli Required...

Malicious code in dc-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e8689cb64586338ac8b83b329558cc7ebd7302602c033a5de1827e1ff8ceaf6e The OpenSSF Package Analysis project identified 'dc-icons' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

PT-2023-22576

Name of the Vulnerable Software and Affected Versions Prestashop posstaticfooter version 1.0.0 Description The issue allows for SQL Injection via the posstaticfooter::getPosCurrentHook function. Recommendations For Prestashop posstaticfooter version 1.0.0, consider disabling the...

CVE-2023-31134

The CVE-2023-31134 issue affects Tauri builds where IPC isolation can be bypassed by redirecting an existing window to an external website. This vulnerability exists in specific pre-patch versions: 1.0.0–1.0.9, 1.1.0–1.1.4, and 1.2.0–1.2.5. The attack surface is the IPC layer, granting external s...

CVE-2023-24372

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in USB Memory Direct Simple Custom Author Profiles plugin = 1.0.0 versions...

WordPress plugin Simple Custom Author Profiles 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

Malicious code in a2b_hex (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 38743aff6be978cb844cd16551bd10ecef79a790d4b14710d720031cbeb492d6 The OpenSSF Package Analysis project identified 'a2bhex' @ 1.0.0 npm as malicious. It is considered malicious because: - The package communicate...

CVE-2017-20183

A vulnerability was found in External Media without Import Plugin up to 1.0.0 on WordPress. It has been declared as problematic. This vulnerability affects the function printmedianewpanel of the file external-media-without-import.php. The manipulation of the argument...

Malicious code in font-forno (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 71a5b24a13fdcf033190873535da22c0b00d1200f4ea936fbaa8a0883a1b6ce3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2023-10634 · WordPress · External Media Without Import Plugin

Name of the Vulnerable Software and Affected Versions: External Media without Import Plugin version 1.0.0 Description: A vulnerability was found in the External Media without Import Plugin on WordPress, affecting the print media new panel function of the file external-media-without-import.php. Th...

Malicious code in postaggingcorenlp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0b30a154de5e7685f533a68a9ed3e6b7e0e3e577fb28781fcb408f0ac480e95d The OpenSSF Package Analysis project identified 'postaggingcorenlp' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in idcs-dialog (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1f9e71c07d690c8293d57afe2530d560684f82b76c844f9904256c1d330fc5af The OpenSSF Package Analysis project identified 'idcs-dialog' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...