Archive
August 2021
Vulnerabilities first published in this month (UTC), newest first.
2,107 results · Feed
-
Medium 6.1
SP Project & Document Manager <= 4.25 Reflected Cross-Site Scripting
The SP Project & Document Manager WordPress plugin is vulnerable to attribute-based Reflected Cross-Site Scripting via the from and to parameters in the ~/functions.php file which allows attackers to inject arbitrary web scripts, in versions up to and includi…
-
Medium 6.4
SEOPress <= 5.0.0 – 5.0.3 Authenticated Stored Cross-Site Scripting
The SEOPress WordPress plugin is vulnerable to Stored Cross-Site-Scripting via the processPut function found in the ~/src/Actions/Api/TitleDescriptionMeta.php file which allows authenticated attackers to inject arbitrary web scripts, in versions 5.0.0 - 5.0.3.
-
Medium 4.0
File disclosure in hbs
The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configura…
-
Unscored —
A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform a file writ…
-
Unscored —
A vulnerability in Pulse Connect Secure before 9.1R12 could allow a threat actor to perform a cross-site script attack …
-
Unscored —
An issue has been identified in the CTX269106 mitigation tool for Citrix ShareFile storage zones controller which cause…
-
Unscored —
A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command inj…
-
Unscored —
A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator or compromised Pulse C…
-
Unscored —
A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command inj…
-
Unscored —
A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform an arbitrar…
-
Unscored —
Unchecked return value in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable a…
-
Medium 6.1
Calendar_plugin <= 1.0 Reflected Cross-Site Scripting
The Calendar_plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of `$_SERVER['PHP_SELF']` in the ~/calendar.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.
-
Medium 6.1
Add Sidebar <= 2.0.0 Reflected Cross-Site Scripting
The Add Sidebar WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the add parameter in the ~/wp_sidebarMenu.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.0.
-
Medium 6.1
WP SEO Tags <= 2.2.7 Reflected Cross-Site Scripting
The WP SEO Tags WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the saq_txt_the_filter parameter in the ~/wp-seo-tags.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.2.7.
-
Medium 6.1
Moova for WooCommerce <= 3.5 Reflected Cross-Site Scripting
The Moova for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the lat parameter in the ~/Checkout/Checkout.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.5.
-
Medium 6.1
Plugmatter Pricing Table Lite <= 1.0.32 Reflected Cross-Site Scripting
The Plugmatter Pricing Table Lite WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `email` parameter in the ~/license.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.32.
-
Medium 6.1
jQuery Tagline Rotator <= 0.1.5 Reflected Cross-Site Scripting
The jQuery Tagline Rotator WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/jquery-tagline-rotator.php file which allows attackers to inject arbitrary web scripts, in versions up to and including…
-
Medium 6.1
Simple Popup Newsletter <= 1.4.7 Reflected Cross-Site Scripting
The Simple Popup Newsletter WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/simple-popup-newsletter.php file which allows attackers to inject arbitrary web scripts, in versions up to and includi…
-
Medium 6.1
WP Songbook <= 2.0.11 Reflected Cross-Site Scripting
The WP Songbook WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the url parameter found in the ~/inc/class.ajax.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.11.
-
Medium 6.1
TypoFR <= 0.11 Reflected Cross-Site Scripting
The 2TypoFR WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the text function found in the ~/vendor/Org_Heigl/Hyphenator/index.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.11.
-
Medium 6.1
2Way VideoCalls and Random Chat - HTML5 Webcam Videochat <= 5.2.7 Reflected Cross-Site Scripting
The 2Way VideoCalls and Random Chat - HTML5 Webcam Videochat WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `vws_notice` function found in the ~/inc/requirements.php file which allows attackers to inject arbitrary web scripts, in ver…
-
Medium 6.1
Scribble Maps <= 1.2 Reflected Cross-Site Scripting
The Scribble Maps WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the map parameter in the ~/includes/admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.
-
Medium 6.1
Custom Post Type Relations <= 1.0 Reflected Cross-Site Scripting
The Custom Post Type Relations WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the cptr[name] parameter found in the ~/pages/admin-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.
-
Medium 6.1
WP Fountain <= 1.5.9 Reflected Cross-Site Scripting
The WP Fountain WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/wp-fountain.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.5.9.
-
Medium 6.1
Simple Behance Portfolio <= 0.2 Reflected Cross-Site Scripting
The Simple Behance Portfolio WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `dark` parameter in the ~/titan-framework/iframe-font-preview.php file which allows attackers to inject arbitrary web scripts, in versions up to and includin…
-
Medium 6.1
Media Usage <= 0.0.4 Reflected Cross-Site Scripting
The Media Usage WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter in the ~/mmu_admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.0.4.
-
Medium 6.1
Smart Email Alerts <= 1.0.10 Reflected Cross-Site Scripting
The Smart Email Alerts WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the api_key in the ~/views/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.10.
-
Medium 6.1
Multiplayer Games <= 3.7 Reflected Cross-Site Scripting
The Multiplayer Games WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/multiplayergames.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.7.
-
Medium 6.1CVE-2021-34643 Scanner template
Skaut bazar <= 1.3.2 Reflected Cross-Site Scripting
The Skaut bazar WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/skaut-bazar.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.3.2.
-
Critical 9.8
Improper Restriction of XML External Entity Reference in Quokka
XML External Entities (XXE) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component 'quokka/core/content/views.py'.
-
Critical 9.8
Unrestricted Upload of File with Dangerous Type in django-widgy
Unrestricted Upload of File with Dangerous Type in Django-Widgy v0.8.4 allows remote attackers to execute arbitrary code via the 'image' widget in the component 'Change Widgy Page'.
-
Critical 9.8
Improper Restriction of XML External Entity Reference in Quokka
XML External Entities (XXE) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component 'quokka/utils/atom.py'.
-
Medium 6.1
Cross Site Scripting (XSS) in Quokka
Cross Site Scripting (XSS) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the 'Username' parameter in the component 'quokka/admin/actions.py'.
-
Unscored —
Incorrect Access Control in Lin-CMS-Flask v0.1.1 allows remote attackers to obtain sensitive information and/or gain pr…
-
Medium 6.1
Lin-CMS-Flask Cross Site Scripting (XSS) vulnerability
Cross Site Scripting (XSS) in Lin-CMS-Flask v0.1.1 allows remote attackers to execute arbitrary code by entering scripts in the the 'Username' parameter of the in component 'app/api/cms/user.py'.
-
Critical 9.8
Lin-CMS-Flask vulnerable to Improper Authentication
Improper Authentication in Lin-CMS-Flask v0.1.1 allows remote attackers to launch brute force login attempts without restriction via the 'login' function in the component 'app/api/cms/user.py'.
-
Unscored —
Directory traversal vulnerability in Online Catering Reservation System 1.0 exists due to lack of validation in index.p…
-
Unscored —
Persistent cross-site scripting (XSS) in Hospital Management System targeted towards web admin through contact.php.
-
Unscored —
Persistent cross-site scripting (XSS) in Hospital Management System targeted towards web admin through prescribe.php.
-
Unscored —
Unauthenticated doctor entry deletion in Hospital Management System in admin-panel1.php.