WordPress Booking Manager Plugin < 2.0.29 is vulnerable to Server Side Request Forgery (SSRF)

Software Booking Manager Type Plugin Vulnerable versions 2.0.29 Fixed in 2.0.29 OWASP Top 10 A5: Broken Access Control Classification Server Side Request Forgery SSRF CVE CVE-2023-1977 Patch priority High CVSS severity High 6.4 Developer Claim ownership PSID dc7cead73df5 Credits Shreya Pohekar...

CVE-2023-26125

Versions of the package github.com/gin-gonic/gin before 1.9.0 are vulnerable to Improper Input Validation by allowing an attacker to use a specially crafted request via the X-Forwarded-Prefix header, potentially leading to cache poisoning. Note: Although this issue does not pose a significant...

WordPress HollerBox Plugin <= 2.1.3 is vulnerable to SQL Injection

Software HollerBox Type Plugin Vulnerable versions = 2.1.3 Fixed in 2.1.4 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-2111 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 81f314d3ef98 Credits rSolutions Security Team Required privilege Administrato...

WordPress Multi Rating Plugin <= 5.0.6 is vulnerable to Cross Site Scripting (XSS)

Software Multi Rating Type Plugin Vulnerable versions = 5.0.6 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-32130 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID e47a95b5141e Credits yuyudhn Required privilege...

WordPress WP Directory Kit Plugin <= 1.2.2 is vulnerable to Broken Access Control

Software WP Directory Kit Type Plugin Vulnerable versions = 1.2.2 Fixed in 1.2.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-2280 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID 56684d930e16 Credits WordFence Required privileg...

Moodle 4.1.x < 4.1.3 Arbitrary Folder Creation Vulnerability (MSA-23-0014)

Moodle is prone to an arbitrary folder creation vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:moodle:moodle";...

WordPress Multi Rating Plugin <= 5.0.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software Multi Rating Type Plugin Vulnerable versions = 5.0.6 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-32125 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 619f441acc2a Credits yuyudhn Required privile...

WordPress Manager for Icomoon Plugin <= 2.0 is vulnerable to Arbitrary File Upload

Software Manager for Icomoon Type Plugin Vulnerable versions = 2.0 Fixed in 2.1 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-29386 Patch priority Low CVSS severity Low 9.1 Developer Claim ownership PSID 0add1822a9fe Credits deokhunKim Required privilege Administrat...

WordPress Spiffy Calendar Plugin <= 4.9.3 is vulnerable to Cross Site Scripting (XSS)

Software Spiffy Calendar Type Plugin Vulnerable versions = 4.9.3 Fixed in 4.9.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-32122 Patch priority Medium CVSS severity Medium 5.8 Developer Claim ownership PSID 27fe48000742 Credits LEE SE HYOUNG...

WordPress Contact Form 7 extension for Google Map fields Plugin <= 1.8.3 is vulnerable to Cross Site Scripting (XSS)

Software Contact Form 7 extension for Google Map fields Type Plugin Vulnerable versions = 1.8.3 Fixed in 1.8.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 3a7978727c74 Credits...

WordPress Hostel Plugin <= 1.1.5.1 is vulnerable to Cross Site Scripting (XSS)

Software Hostel Type Plugin Vulnerable versions = 1.1.5.1 Fixed in 1.1.5.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-32120 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID baaca7c51cda Credits yuyudhn Required privilege...

phpMyFAQ < 3.1.13 Multiple Vulnerabilities

phpMyFAQ is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:phpmyfaq:phpmyfaq"; if description...

PT-2023-22586 · Douphp · Douphp

Name of the Vulnerable Software and Affected Versions: DouPHP version 1.7 Description: A stored cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the unique id parameter in "/admin/article.php". This enables attackers to...

WordPress UserAgent-Spy Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)

Software UserAgent-Spy Type Plugin Vulnerable versions = 1.3.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2490 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 7a32663f704c Credits Yash Kanchhal Required...

WordPress URL Params Plugin < 2.5 is vulnerable to Cross Site Scripting (XSS)

Software URL Params Type Plugin Vulnerable versions 2.5 Fixed in 2.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0274 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID c07bdc476562 Credits Lana Codes Required privilege...

WordPress Library Viewer Plugin <= 2.0.6 is vulnerable to Cross Site Scripting (XSS)

Software Library Viewer Type Plugin Vulnerable versions = 2.0.6 Fixed in 2.0.6.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-32102 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 0ff4626c41da Credits Mika Required...

WordPress Albo Pretorio Online Plugin <= 4.6.3 is vulnerable to Cross Site Scripting (XSS)

Software Albo Pretorio Online Type Plugin Vulnerable versions = 4.6.3 Fixed in 4.6.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-32109 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 17b880fb4602 Credits Phd Required...

WordPress WOLF Plugin <= 1.0.6 is vulnerable to Cross Site Scripting (XSS)

Software WOLF Type Plugin Vulnerable versions = 1.0.6 Fixed in 1.0.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-31218 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 34d06a9a9f59 Credits Junsu Yeo Required privilege...

WordPress Tiempo.com Plugin <= 0.1.2 is vulnerable to Cross Site Scripting (XSS)

Software Tiempo.com Type Plugin Vulnerable versions = 0.1.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2272 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 05252127f46c Credits Erwan LR WPScan Required...

WordPress Advanced Custom Fields Plugin < 5.12.5 is vulnerable to PHP Object Injection

Software Advanced Custom Fields Type Plugin Vulnerable versions 5.12.5 Fixed in 5.12.5 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2023-1196 Patch priority Medium CVSS severity Medium 4.9 Developer Claim ownership PSID 8c55b8a9942a Credits Nguyen Huu Do Required privile...