PT-2023-32814 · Jahastech · Nxfilter

Name of the Vulnerable Software and Affected Versions: Jahastech NxFilter version 4.3.2.5 Description: A problematic issue has been found in the Bind Request Handler component, affecting the processing of the file user,adap.jsp?actionFlag=test&id=1. This leads to ldap injection and can be initiat...

PT-2023-9621 · Python +2 · Cpython +2

Name of the Vulnerable Software and Affected Versions: CPython version 3.12.0 Description: The issue is related to errors in privilege management in the subprocess module of the CPython interpreter. When using the extra groups= parameter with an empty list as a value, the logic regressed to not...

PT-2023-31203 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinalCMS version 5.0.0 Description: A Cross-Site Request Forgery CSRF issue was found in JFinalCMS. The vulnerability can be exploited via the "/admin/category/updateStatus" API endpoint. Recommendations: For JFinalCMS version 5.0.0, as a...

PT-2023-10832 · Ckeditor +1 · Ckeditor +1

Name of the Vulnerable Software and Affected Versions: ระบบบัญชีออนไลน์ Online Accounting System versions up to 1.4.0 Description: A problematic issue affects the processing of the file ckeditor/filemanager/browser/default/image.php. The manipulation of the argument fid with the input...

PT-2023-23992 · WordPress · Woocommerce Product Recommendations

Name of the Vulnerable Software and Affected Versions: WooCommerce Product Recommendations plugin versions = 2.3.0 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions...

PT-2023-28590 · Unknown · Bigbluebutton

Name of the Vulnerable Software and Affected Versions: BigBlueButton versions prior to 2.6.0-beta.1 Description: BigBlueButton is an open-source virtual classroom. It has a path traversal vulnerability that allows an attacker with a valid starting folder path to traverse and read other files...

PT-2023-29982 · Tenda · Tenda W18E

Name of the Vulnerable Software and Affected Versions: Tenda W18E version 16.01.0.81576 Description: The issue is related to a stack overflow vulnerability. It occurs via the portMirrorMirroredPorts parameter in the formSetNetCheckTools function. Recommendations: For Tenda W18E version...

PT-2023-6822 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 10.0.10 Description: The issue is related to information disclosure in the GLPI system. Exploitation of this issue may allow a remote attacker to disclose protected information. An API user can enumerate sensitive field...

PT-2023-5411 · D Link · D-Link Dir-823G

Name of the Vulnerable Software and Affected Versions: D-Link DIR-823G version 1.0.2B05 Description: The issue is related to a stack overflow in the SetWifiDownSettings function of the D-Link DIR-823G router's firmware, which can be exploited by a remote attacker to impact the confidentiality,...

PT-2023-30853 · Sourcecodester · Sourcecodester Simple Membership System

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Membership System version 1.0 Description: A critical issue was found in the file club edit query.php, where the manipulation of the club id argument leads to SQL injection. This can be initiated remotely. The issue has...

PT-2023-27983 · Jeecg · Jeecg

Name of the Vulnerable Software and Affected Versions: Jeecg versions up to 3.5.3 Description: The issue is an arbitrary file read vulnerability. It can be exploited via the interface "/testConnection". Recommendations: For versions up to 3.5.3, as a temporary workaround, consider restricting...

PT-2023-26581 · Unknown · Campcodes Beauty Salon Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Beauty Salon Management System version 0.1.0 Description: A critical issue has been found in the system, affecting an unknown functionality of the file /admin/del feedback.php. The manipulation of the id argument leads to sql...

PT-2023-26410 · Nxfilter · Nxfilter

Name of the Vulnerable Software and Affected Versions: NxFilter version 4.3.2.5 Description: A vulnerability has been found in NxFilter, affecting unknown code of the file user.jsp, leading to cross-site request forgery. The attack can be initiated remotely. The vendor was contacted early about...

PT-2023-26398 · Dedebiz · Dedebiz

Name of the Vulnerable Software and Affected Versions: DedeBIZ version 6.2.10 Description: A problematic issue has been found in DedeBIZ, affecting some unknown functionality of the file /admin/sys sql query.php. The manipulation of the sqlquery argument leads to sql injection. The attack can be...

PT-2023-25737 · Unknown · Bylancer Quickorder

Name of the Vulnerable Software and Affected Versions: Bylancer QuickOrder version 6.3.7 Description: A critical issue has been found in the GET Parameter Handler component of the /blog file, where the manipulation of the s argument leads to sql injection. This issue can be exploited remotely. Th...

PT-2023-25736 · Bylancer · Bylancer Quickqr

Name of the Vulnerable Software and Affected Versions: Bylancer QuickQR version 6.3.7 Description: A critical issue was found in the GET Parameter Handler component of the /blog file, where the manipulation of the s argument leads to sql injection. This issue can be exploited remotely. The vendor...

PT-2023-12146 · Redis +2 · Redis +2

Name of the Vulnerable Software and Affected Versions: Redis versions prior to 6.2 Redis versions prior to 6cbea7d Description: The issue allows a replica to cause an assertion failure in a primary server by sending a non-administrative command, specifically a SET command. This was fixed for Redi...

PT-2023-5817 · Unknown · Sipass Integrated

Name of the Vulnerable Software and Affected Versions: SiPass integrated versions prior to V2.90.3.8 Description: A vulnerability has been identified in SiPass integrated, where affected server applications improperly check the size of data packets received for the configuration client login,...

PT-2023-11560 · Taogogo · Taocms

Name of the Vulnerable Software and Affected Versions: taogogo taoCMS version 2.5 beta5.1 Description: The issue allows a remote attacker to execute arbitrary code via the name field in "admin.php". This is a Cross Site Scripting vulnerability. Recommendations: For version 2.5 beta5.1, as a...

PT-2023-3743 · Sap · Sap Netweaver Enterprise Portal

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Enterprise Portal version 7.50 Description: The issue arises from insufficient encoding of user-controlled inputs over the network, resulting in a reflected Cross-Site Scripting XSS issue. This allows an attacker to view or modi...