PT-2023-24461 · Microworld Technologies · Escan

Name of the Vulnerable Software and Affected Versions: Microworld Technologies eScan management console version 14.0.1400.2281 Description: The issue allows a remote attacker to inject arbitrary code via the vulnerable parameters type, txtPolicyType, and Deletefileval in the New Policy form. This...

WordPress Wordapp Plugin <= 1.5.0 is vulnerable to Broken Access Control

Software Wordapp Type Plugin Vulnerable versions = 1.5.0 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-2987 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 04adbd084262 Credits Lana Codes Required privilege...

Exploit for Cross-site Scripting in Escanav Escan_Management_Console

eScan Management Console 14.0.1400.2281 - Reflected Cross Sit...

PT-2023-22385 · Unknown · Edjing Mix

Name of the Vulnerable Software and Affected Versions: edjing Mix version 7.09.01 Description: The issue allows unauthorized apps to cause escalation of privilege attacks by manipulating the database. Recommendations: For edjing Mix version 7.09.01, at the moment, there is no information about a...

WordPress Headless CMS Plugin <= 2.0.3 is vulnerable to Broken Authentication

Software Headless CMS Type Plugin Vulnerable versions = 2.0.3 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Authentication CVE CVE-2023-34186 Patch priority Medium CVSS severity Medium 5.3 Developer Claim ownership PSID 6f4f9877ae87 Credits Yuki Haruma Required privile...

WordPress Google Fonts For WordPress Plugin <= 3.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Google Fonts For WordPress Type Plugin Vulnerable versions = 3.0.0 Fixed in 3.0.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-34180 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 4fe4a8a6f7d0 Credits Le Ngo...

WordPress Download Monitor Plugin <= 4.8.1 is vulnerable to Server Side Request Forgery (SSRF)

Software Download Monitor Type Plugin Vulnerable versions = 4.8.1 Fixed in 4.8.2 OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2023-31219 Patch priority Low CVSS severity Low 4.1 Developer WPChill PSID fb7b8d305714 Credits Mika Required privilege Administrator...

WordPress Jetpack Plugin <= 12.1 is vulnerable to Broken Access Control

Software Jetpack Type Plugin Vulnerable versions = 12.1 Fixed in 12.1.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE N/A Patch priority High CVSS severity High 9 Developer Claim ownership PSID e45930af254c Credits Jetpack Required privilege Author Published 30...

WordPress LH Password Changer Plugin <= 1.55 is vulnerable to Cross Site Request Forgery (CSRF)

Software LH Password Changer Type Plugin Vulnerable versions = 1.55 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-34182 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 19a12f4b7744 Credits Mika Required...

PT-2023-22380 · Unknown · Call Blocker

Name of the Vulnerable Software and Affected Versions: Call Blocker application version 6.6.3 Description: The issue allows attackers to tamper with feature-related data, resulting in a severe elevation of privilege attack. Recommendations: For version 6.6.3, update to a newer version that contai...

WordPress WP Report Post Plugin <= 2.1.2 is vulnerable to SQL Injection

Software WP Report Post Type Plugin Vulnerable versions = 2.1.2 Fixed in N/A OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-34168 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 8b1f55478a8c Credits Mika Required privilege Editor Published 30 May, 202...

Wekan 6.74 Cross Site Scripting

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Stored XSS vulnerability in rename functionality product: Wekan Open-Source kanban vulnerable version: =6.74 fixed version: 6.75 or higher CVE number: CVE-2023-28485...

WordPress Dynamic QR Code Generator Plugin <= 0.0.5 is vulnerable to Cross Site Scripting (XSS)

Software Dynamic QR Code Generator Type Plugin Vulnerable versions = 0.0.5 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-34022 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 663371fa0bd1 Credits thiennv...

WordPress Gravity Forms Plugin <= 2.7.3 is vulnerable to PHP Object Injection

Software Gravity Forms Type Plugin Vulnerable versions = 2.7.3 Fixed in 2.7.4 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2023-28782 Patch priority High CVSS severity High 8.3 Developer Claim ownership PSID 97930c86f0b1 Credits Rafie Muhammad Patchstack Required privile...

PT-2023-24330 · Skycaiji · Skycaiji

Name of the Vulnerable Software and Affected Versions: skycaiji version 2.5.4 Description: The issue allows attackers to achieve backend Cross Site Scripting XSS by deploying malicious JSON data. This enables potential exploitation of the system. Recommendations: For skycaiji version 2.5.4,...

WordPress Custom Twitter Feeds (Tweets Widget) Plugin <= 1.8.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Custom Twitter Feeds Tweets Widget Type Plugin Vulnerable versions = 1.8.4 Fixed in 2.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-33974 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID ffeee86a1e55 Credits...

WordPress MStore API Plugin <= 3.9.1 is vulnerable to Broken Authentication

Software MStore API Type Plugin Vulnerable versions = 3.9.1 Fixed in 3.9.2 OWASP Top 10 A2: Broken Authentication Classification Broken Authentication CVE CVE-2023-2734 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 533a834d2d8a Credits Lana Codes Required privilege...

WordPress MStore API Plugin <= 3.9.2 is vulnerable to Broken Authentication

Software MStore API Type Plugin Vulnerable versions = 3.9.2 Fixed in 3.9.3 OWASP Top 10 A2: Broken Authentication Classification Broken Authentication CVE CVE-2023-2732 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 9a2f0204ce39 Credits Lana Codes Required privilege...

WordPress HashOne Theme <= 1.3.0 is vulnerable to Broken Access Control

Software HashOne Type Theme Vulnerable versions = 1.3.0 Fixed in 1.3.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-33923 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID db48b6df310a Credits Dave Jong Patchstack Required privileg...

WordPress IP Metaboxes Plugin <= 2.1.1 is vulnerable to Cross Site Scripting (XSS)

Software IP Metaboxes Type Plugin Vulnerable versions = 2.1.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-30745 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 98c96aff12b7 Credits WON JOON HWANG Required...