PT-2021-11648 · Unknown · Wayang-Cms

Name of the Vulnerable Software and Affected Versions: Wayang-CMS version 1.0 Description: A SQL injection issue in the wy controlls/wy side visitor.php file allows attackers to obtain sensitive database information. Recommendations: For Wayang-CMS version 1.0, consider restricting access to the ...

Cross site scripting

Kirby is a content management system. In Kirby CMS versions 3.5.5 and 3.5.6, the Panel's ListItem component used in the pages and files section for example displayed HTML in page titles as it is. This could be used for cross-site scripting XSS attacks. Malicious authenticated Panel users can...

CVE-2021-24350

The Visitors WordPress plugin through 0.3 is affected by an Unauthenticated Stored Cross-Site Scripting XSS vulnerability. The plugin would display the user's user agent string without validation or encoding within the WordPress admin panel...

CVE-2021-24193

Low privileged users can use the AJAX action 'cppluginsdobuttonjoblatercallback' in the Visitor Traffic Real Time Statistics WordPress plugin before 2.12, to install any plugin including a specific version from the WordPress repository, as well as activate arbitrary plugin from then blog, which...

WordPress plugin Visitor Traffic Real Time Statistics 安全漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . A vulnerability exists in the WordPress plugin before...

Command Injection in ps-visitor

This affects all versions up to and including version 0.0.2 of package ps-visitor. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization...

GHSA-V2JV-33GH-XX29 Command Injection in ps-visitor

This affects all versions up to and including version 0.0.2 of package ps-visitor. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization...

Leads-5050 Visitor Insights < 1.0.4 - Unauthenticated License Change

The leads5050setlicense AJAX action was available to unauthenticated users allowing them to set an arbitrary license in the plugins settings POST /wordpress/wp-admin/admin-ajax.php HTTP/1.1 Accept: application/json, text/javascript, /; q=0.01 Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip,...

Leads-5050 Visitor Insights < 1.0.4 - Unauthenticated License Change

The leads5050setlicense AJAX action was available to unauthenticated users allowing them to set an arbitrary license in the plugins settings PoC POST /wordpress/wp-admin/admin-ajax.php HTTP/1.1 Accept: application/json, text/javascript, /; q=0.01 Accept-Language: en-GB,en;q=0.5 Accept-Encoding:...

Leads-5050 Visitor Insights < 1.1.0 - Unauthorised License Change

The leads5050setlicense AJAX action is available to authenticated users, but is missing any capability and CSRF checks. This could allow any low privilege users subscriber+ to set an arbitrary license in the plugins settings PoC POST /wordpress/wp-admin/admin-ajax.php HTTP/1.1 Accept:...

WordPress Leads 5050 Visitor Insights plugin <= 1.0.5 - Unauthorized License Change vulnerability

Unauthorized License Change vulnerability discovered by WPScan Team in WordPress Leads 5050 Visitor Insights plugin versions = 1.0.5. Solution Update the WordPress Leads 5050 Visitor Insights plugin to the latest available version at least 1.1.0...

OSV-2021-703 Container-overflow in unsigned long jsoncons::detail::escape_string<char, jsoncons::string_sink<std::_

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33781 Crash type: Container-overflow READ 1 Crash state: unsigned long jsoncons::detail::escapestring::key...

WordPress Visitor Traffic Real Time Statistics plugin <= 2.11 - Arbitrary Plugin Installation and Activation vulnerability

Arbitrary Plugin Installation and Activation vulnerability discovered by Bugbang in WordPress Visitor Traffic Real Time Statistics plugin versions = 2.11. Solution Update the WordPress Visitor Traffic Real Time Statistics plugin to the latest available version at least 2.12...

Code injection

Wagtail is a Django content management system. In affected versions of Wagtail, when saving the contents of a rich text field in the admin interface, Wagtail does not apply server-side checks to ensure that link URLs use a valid protocol. A malicious user with access to the admin interface could...

Remote Code Execution (RCE)

ps-visitor is vulnerable to remote code execution. The vulnerability exists due to a usage of the childprocess.exec function without input sanitization of user input...

CVE-2021-23374

This affects all versions of package ps-visitor. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization...

CVE-2021-23374

This affects all versions of package ps-visitor. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization...

Input validation

This affects all versions of package ps-visitor. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization...

CVE-2021-23374

CVE-2021-23374 affects all versions of the Node.js package ps-visitor. The vulnerability stems from using the built-in child_process.exec in the package’s kill function without input sanitization, allowing attacker-controlled input to execute arbitrary commands. Multiple sources confirm this comm...

CVE-2021-23374 Arbitrary Command Injection

This affects all versions of package ps-visitor. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization...