WordPress Easy Accept Payments Plugin < 4.9.10 is vulnerable to Cross Site Scripting (XSS)

Software Easy Accept Payments Type Plugin Vulnerable versions 4.9.10 Fixed in 4.9.10 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0275 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 334f1469f03f Credits Lana Codes...

WordPress MainWP Links Manager Extension Plugin <= 2.1 is vulnerable to Privilege Escalation

Software MainWP Links Manager Extension Type Plugin Vulnerable versions = 2.1 Fixed in N/A OWASP Top 10 A8: Insecure Deserialization Classification Privilege Escalation CVE CVE-2023-23649 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 18ad4e4659ad Credits Dave Jong...

PT-2023-8517 · Pyload · Pyload

Name of the Vulnerable Software and Affected Versions: pyLoad versions prior to 0.5.0b3.dev78 Description: The issue is related to a Cross-Site Request Forgery CSRF attack. Since the session cookie is not set to SameSite: strict, this opens the library up to severe attack possibilities. Any API...

WordPress TemplatesNext ToolKit Plugin <= 3.2.7 is vulnerable to Cross Site Scripting (XSS)

Software TemplatesNext ToolKit Type Plugin Vulnerable versions = 3.2.7 Fixed in 3.2.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-22712 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 9bfdd28ec3f2 Credits Rafshanzani Suhad...

Apache Superset 安全漏洞

Apache Superset is a data visualization and data exploration platform from the Apache Foundation USA. A security vulnerability exists in Apache Superset versions 1.5.2 and earlier and 2.0.0, which originates from an authenticated attacker with write access to a CSS template that can create a reco...

WordPress Custom 404 Pro Plugin <= 3.7.0 is vulnerable to SQL Injection

Software Custom 404 Pro Type Plugin Vulnerable versions = 3.7.0 Fixed in 3.7.1 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2022-47605 Patch priority Low CVSS severity Low 8.3 Developer Kunal Nagar PSID 960f40facc61 Credits minhtuanact Required privilege Administrator Published...

PT-2023-7912 · WordPress · Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Show All Comments WordPress plugin version prior to 7.0.1 Description: The issue is related to a Reflected Cross-Site Scripting attack, which could be used against logged-in high-privilege users, such as admins. This occurs because the plugin...

WordPress Map Multi Marker Plugin <= 3.2.1 is vulnerable to Cross Site Scripting (XSS)

Software Map Multi Marker Type Plugin Vulnerable versions = 3.2.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-47591 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0fa0897cb0de Credits minhtuanact Requir...

WordPress DNUI Plugin <= 2.8.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software DNUI Type Plugin Vulnerable versions = 2.8.1 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-47609 Patch priority Low CVSS severity Low 6.3 Developer Claim ownership PSID f2efe7cbc315 Credits Mika Required privilege...

PT-2023-15569 · Unknown · Tramyardg Hotel-Mgmt-System

Name of the Vulnerable Software and Affected Versions: Tramyardg hotel-mgmt-system version 2022.4 Description: The issue concerns a Cross Site Scripting XSS vulnerability. It can be exploited via the process update profile.php file. Recommendations: For Tramyardg hotel-mgmt-system version 2022.4,...

WordPress WP-OliveCart Plugin <= 1.1.3 is vulnerable to Cross Site Scripting (XSS)

Software WP-OliveCart Type Plugin Vulnerable versions = 1.1.3 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-47435 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 10d7b9455c85 Credits Team WeBoB Required privileg...

WordPress Materialis Companion Plugin < 1.3.40 is vulnerable to Cross Site Scripting (XSS)

Software Materialis Companion Type Plugin Vulnerable versions 1.3.40 Fixed in 1.3.40 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4762 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 80cd16937fbb Credits Lana Codes...

WordPress Extra Block Design, Style, CSS for ANY Gutenberg Blocks Plugin <= 0.2.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software Extra Block Design, Style, CSS for ANY Gutenberg Blocks Type Plugin Vulnerable versions = 0.2.6 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-47183 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID...

WordPress Launchpad – Coming Soon & Maintenance Mode Plugin Plugin <= 1.0.13 is vulnerable to Cross Site Scripting (XSS)

Software Launchpad – Coming Soon & Maintenance Mode Plugin Type Plugin Vulnerable versions = 1.0.13 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0295 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 1b5adaa47d4c...

WordPress Superior FAQ Plugin <= 1.0.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Superior FAQ Type Plugin Vulnerable versions = 1.0.2 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-22678 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID ae6b745055b4 Credits NeginNrb Required...

WordPress Annual Archive Plugin < 1.6.0 is vulnerable to Cross Site Scripting (XSS)

Software Annual Archive Type Plugin Vulnerable versions 1.6.0 Fixed in 1.6.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0178 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID e447b05c3b01 Credits Lana Codes Required...

a2 (>=0.5.0-alpha.1, <=0.5.3), aahc (0.1.0) +4865 more potentially affected by unknown CVE via tokio (>=0.2.0-alpha.1, <=1.18.2)

tokio CARGO version =0.2.0-alpha.1, =0.5.0-alpha.1, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.5.0, =0.1.0, =0.1.0, =0.0.1, =0.0.7-alpha.3, =0.0.7-alpha.2, =0.0.7-alpha.1, =0.0.7-alpha.3, =0.2.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0005...

WordPress YouTube Channel Plugin < 3.23.0 is vulnerable to Cross Site Scripting (XSS)

Software YouTube Channel Type Plugin Vulnerable versions 3.23.0 Fixed in 3.23.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4756 Patch priority Medium CVSS severity Medium 6.3 Developer Aleksandar Urošević PSID 3866f6e0ecf5 Credits Lana Codes...

PT-2023-10571 · Insteon · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: The issue concerns buffer overflow vulnerabilities in the PubNub message handler for the "cc" channel. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow,...

PT-2023-10612 · Unknown · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel. Specially crafted commands sent through the PubNub service can cause a stack-based buffer...