Archive
15 October 2021
Vulnerabilities first published on this day (UTC), newest first.
59 results · Feed
-
Medium 5.5
Author Bio Box <= 3.3.1 Authenticated Stored Cross-Site Scripting
The Author Bio Box WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/includes/admin/class-author-bio-box-admin.php file which allowed attackers with admini…
-
Medium 5.5
KJM Admin Notices <= 2.0.1 Authenticated Stored Cross-Site Scripting
The KJM Admin Notices WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/admin/class-kjm-admin-notices-admin.php file which allowed attackers with administr…
-
Medium 5.5
WpGenius Job Listing <= 1.0.2 Authenticated Stored Cross-Site Scripting
The WpGenius Job Listing WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/src/admin/class/class-wpgenious-job-listing-options.php file which allowed attac…
-
Medium 5.5
MyBB Cross-Poster <= 1.0 Authenticated Stored Cross-Site Scripting
The MyBB Cross-Poster WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/classes/MyBBXPSettings.php file which allowed attackers with administrative user ac…
-
Medium 5.5
HAL <= 2.1.1 Authenticated Stored Cross-Site Scripting
The HAL WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/wp-hal.php file which allowed attackers with administrative user access to inject arbitrary web s…
-
Medium 5.5
job-portal <= 0.0.1 Authenticated Stored Cross-Site Scripting
The job-portal WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/admin/jobs_function.php file which allowed attackers with administrative user access to in…
-
Medium 5.5
Job Manager <= 0.7.25 Authenticated Stored Cross-Site Scripting
The Job Manager WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/admin-jobs.php file which allowed attackers with administrative user access to inject arb…
-
Medium 5.5
Job Board Vanila Plugin <= 1.0 Authenticated Stored Cross-Site Scripting
The Job Board Vanila WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via the psjb_exp_in and the psjb_curr_in parameters found in the ~/job-settings.php file which allowed attackers with admi…
-
Medium 5.5
Business Manager – WordPress ERP, HR, CRM, and Project Management Plugin <= 1.4.5 Authenticated Stored Cross-Site Scripting
The Business Manager WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization found throughout the plugin which allowed attackers with administrative user access to inject arbitrary web scripts, in ve…
-
Medium 4.3
Huachu Digital Technology Co.,Ltd. Easytest - Improper Authorization
The learning history page of the Easytest is vulnerable by permission bypass. After obtaining a user’s permission, remote attackers can access other users’ and administrator’s account information except password by crafting URL parameters.
-
Medium 5.4
Huachu Digital Technology Co.,Ltd. Easytest - Stored XSS
Easytest bulletin board management function of online learning platform does not filter special characters. After obtaining a user’s privilege, remote attackers can inject JavaScript and execute stored XSS attack.
-
High 8.8
Huachu Digital Technology Co.,Ltd. Easytest - SQL Injection-2
The Easytest contains SQL injection vulnerabilities. After obtaining a user’s privilege, remote attackers can inject SQL commands into the parameters of the elective course management page to obtain all database and administrator permissions.
-
High 8.8
Huachu Digital Technology Co.,Ltd. Easytest - SQL Injection-1
The Easytest contains SQL injection vulnerabilities. After obtaining user’s privilege, remote attackers can inject SQL commands into the parameters of the learning history page to access all database and obtain administrator permissions.
-
Medium 4.3
ShinHer Information Co., LTD. ShinHer StudyOnline System - Improper Authorization-3
The “List View” function of ShinHer StudyOnline System is not under authority control. After logging in with user’s privilege, remote attackers can access the content of other users’ message boards by crafting URL parameters.
-
Medium 5.4
ShinHer Information Co., LTD. ShinHer StudyOnline System - Improper Authorization-2
The “Study Edit” function of ShinHer StudyOnline System does not perform permission control. After logging in with user’s privilege, remote attackers can access and edit other users’ tutorial schedule by crafting URL parameters.
-
High 8.8
ShinHer Information Co., LTD. ShinHer StudyOnline System - Improper Authorization-1
The “Teacher Edit” function of ShinHer StudyOnline System does not perform authority control. After logging in with user’s privilege, remote attackers can access and edit other users’ credential and personal information by crafting URL parameters.
-
Medium 5.4
ShinHer Information Co., LTD. ShinHer StudyOnline System - Stored XSS
The “List_Add” function of message board of ShinHer StudyOnline System does not filter special characters in the title parameter. After logging in with user’s privilege, remote attackers can inject JavaScript and execute stored XSS attacks.
-
Unscored —
A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPa…
-
Unscored —
Buffer overflow vulnerability in function stbi__extend_receive in stb_image.h in stb 2.26 via a crafted JPEG file.