WordPress wpDiscuz Plugin <= 7.6.3 is vulnerable to Insecure Direct Object References (IDOR)

Software wpDiscuz Type Plugin Vulnerable versions = 7.6.3 Fixed in 7.6.4 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2023-46311 Patch priority Low CVSS severity Low 2.7 Developer Claim ownership PSID 05932cb617e2 Credits Revan Arifio Requir...

Cross site scripting

The EventON plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in page...

WordPress EventON Plugin <= 2.2.2 is vulnerable to Cross Site Scripting (XSS)

Software EventON Type Plugin Vulnerable versions = 2.2.2 Fixed in 2.2.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-4635 Patch priority Medium CVSS severity Medium 6.1 Developer Claim ownership PSID 2a9d3b757474 Credits Shuning Xu Required privilege...

Cross site scripting

The WP Customer Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 3.6.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions...

PT-2023-25042 · Silicon · Gecko Bootloader

Name of the Vulnerable Software and Affected Versions: Silicon Labs Gecko Bootloader versions 4.3.1 and earlier Description: The issue is related to an integer overflow in the Gecko Bootloader, which allows unbounded memory access when reading from or writing to storage slots. Recommendations: Fo...

Squid DoS Vulnerability (GHSA-h5x6-w8mv-xfpr, SQUID-2024:2)

Squid is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:squid-cache:squid";...

WordPress iPanorama 360 WordPress Virtual Tour Builder Plugin <= 1.8.0 is vulnerable to SQL Injection

Software iPanorama 360 WordPress Virtual Tour Builder Type Plugin Vulnerable versions = 1.8.0 Fixed in 1.8.1 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-5336 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID 25ea3eb9ee79 Credits István Márton Require...

WordPress WC Captcha Plugin <= 1.5 is vulnerable to Cross Site Scripting (XSS)

Software WC Captcha Type Plugin Vulnerable versions = 1.5 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-46210 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 587ee0fec2f4 Credits Rio Darmawan Required privilege...

PT-2023-28790 · Unknown · Evolution Evo

Name of the Vulnerable Software and Affected Versions: evolution evo version 3.2.3 Description: A cross-site scripting XSS issue allows a local attacker to execute arbitrary code via a crafted payload injected uid parameter. This enables the attacker to perform unauthorized actions on the system...

WordPress Taggbox Plugin <= 3.3 is vulnerable to Broken Access Control

Software Taggbox Type Plugin Vulnerable versions = 3.3 Fixed in 3.4 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-33215 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 74a01c79e50d Credits Jonas Höbenreich Required privilege...

WordPress Webpushr Plugin <= 4.34.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Webpushr Type Plugin Vulnerable versions = 4.34.0 Fixed in 4.35.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-35041 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID 5f64981a29ac Credits Theodoros Malachias...

WordPress Booster for WooCommerce Plugin <= 7.1.2 is vulnerable to Cross Site Scripting (XSS)

Software Booster for WooCommerce Type Plugin Vulnerable versions = 7.1.2 Fixed in 7.1.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5638 Patch priority Low CVSS severity Low 6.4 Developer Claim ownership PSID be851143f85f Credits István Márton...

WordPress Open Graph Metabox Plugin <= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Open Graph Metabox Type Plugin Vulnerable versions = 1.4.4 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-46191 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 7aa3a95b4491 Credits LEE SE HYOUNG...

WordPress Freesoul Deactivate Plugins – Plugin manager and cleanup Plugin <= 2.1.3 is vulnerable to Broken Access Control

Software Freesoul Deactivate Plugins – Plugin manager and cleanup Type Plugin Vulnerable versions = 2.1.3 Fixed in 2.1.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-46188 Patch priority Low CVSS severity Low 4.3 Developer Jose Mortellaro PSID...

PT-2023-29764 · Wipotec Gmbh · Comscale

Name of the Vulnerable Software and Affected Versions: WIPOTEC GmbH ComScale versions 4.3.29.21344 through 4.4.12.723 Description: An issue in WIPOTEC GmbH ComScale allows unauthenticated attackers to login as any user without a password. Recommendations: For versions 4.3.29.21344 and 4.4.12.723,...

WordPress Internal Link Building Plugin <= 1.2.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Internal Link Building Type Plugin Vulnerable versions = 1.2.3 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-46193 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 4692712a98eb Credits LEE SE HYOUNG...

Oracle MySQL Server 8.1.0 Security Update (cpuoct2023) - Linux

Oracle MySQL Server is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

WordPress Bookly Plugin < 22.4 is vulnerable to SQL Injection

Software Bookly Type Plugin Vulnerable versions 22.4 Fixed in 22.4 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-4691 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 87844051842a Credits Pablo Sanchez Required privilege Administrator Published 17...

PT-2023-28009 · Unknown · Esst Monitoring

Name of the Vulnerable Software and Affected Versions: eSST Monitoring version 2.147.1 Description: A lack of input sanitizing in the file download feature allows attackers to execute a path traversal. Recommendations: For eSST Monitoring version 2.147.1, consider disabling the file download...

WordPress Webmaster Tools Plugin <= 2.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Webmaster Tools Type Plugin Vulnerable versions = 2.0 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-46092 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 07d0f2ff72c9 Credits LEE SE HYOUNG...