Archive
June 2022
Vulnerabilities first published in this month (UTC), newest first.
2,191 results · Feed
-
Medium 6.3
Hindu Matrimonial Script photo.php privileges management
A vulnerability classified as critical was found in Hindu Matrimonial Script. Affected by this vulnerability is an unknown functionality of the file /admin/photo.php. The manipulation leads to improper privilege management. The attack can be launched remotely…
-
Medium 6.3
Hindu Matrimonial Script featured.php privileges management
A vulnerability classified as critical has been found in Hindu Matrimonial Script. Affected is an unknown function of the file /admin/featured.php. The manipulation leads to improper privilege management. It is possible to launch the attack remotely. The expl…
-
Medium 6.3
Hindu Matrimonial Script success_story.php privileges management
A vulnerability was found in Hindu Matrimonial Script. It has been rated as critical. This issue affects some unknown processing of the file /admin/success_story.php. The manipulation leads to improper privilege management. The attack may be initiated remotel…
-
Medium 6.3
Hindu Matrimonial Script searchview.php privileges management
A vulnerability was found in Hindu Matrimonial Script. It has been declared as critical. This vulnerability affects unknown code of the file /admin/searchview.php. The manipulation leads to improper privilege management. The attack can be initiated remotely. …
-
Medium 6.3
Hindu Matrimonial Script payment.php privileges management
A vulnerability was found in Hindu Matrimonial Script. It has been classified as critical. This affects an unknown part of the file /admin/payment.php. The manipulation leads to improper privilege management. It is possible to initiate the attack remotely. Th…
-
Medium 6.3
Hindu Matrimonial Script newsletter1.php privileges management
A vulnerability was found in Hindu Matrimonial Script and classified as critical. Affected by this issue is some unknown functionality of the file /admin/newsletter1.php. The manipulation leads to improper privilege management. The attack may be launched remo…
-
Medium 6.3
Hindu Matrimonial Script cms.php privileges management
A vulnerability has been found in Hindu Matrimonial Script and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/cms.php. The manipulation leads to improper privilege management. The attack can be launched r…
-
Medium 6.3
Hindu Matrimonial Script generalsettings.php privileges management
A vulnerability, which was classified as critical, was found in Hindu Matrimonial Script. Affected is an unknown function of the file /admin/generalsettings.php. The manipulation leads to improper privilege management. It is possible to launch the attack remo…
-
Medium 6.3
Hindu Matrimonial Script renewaldue.php privileges management
A vulnerability, which was classified as critical, has been found in Hindu Matrimonial Script. This issue affects some unknown processing of the file /admin/renewaldue.php. The manipulation leads to improper privilege management. The attack may be initiated r…
-
Medium 6.3
Hindu Matrimonial Script communitymanagement.php privileges management
A vulnerability classified as critical was found in Hindu Matrimonial Script. This vulnerability affects unknown code of the file /admin/communitymanagement.php. The manipulation leads to improper privilege management. The attack can be initiated remotely. Th…
-
Medium 6.3
Hindu Matrimonial Script countrymanagement.php privileges management
A vulnerability classified as critical has been found in Hindu Matrimonial Script. This affects an unknown part of the file /admin/countrymanagement.php. The manipulation leads to improper privilege management. It is possible to initiate the attack remotely. …
-
Medium 6.3
Hindu Matrimonial Script usermanagement.php privileges management
A vulnerability was found in Hindu Matrimonial Script. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/usermanagement.php. The manipulation leads to improper privilege management. The attack may be launch…
-
High 7.3
Hindu Matrimonial Script sql injection
A vulnerability was found in Hindu Matrimonial Script. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/. The manipulation of the argument username/password with the input 'or''=' leads to sql inj…
-
Unscored —
A vulnerability has been identified in Cerberus DMS (All versions), Desigo CC (All versions), Desigo CC Compact (All ve…
-
Medium 5.3
Adminer Login access control
A vulnerability has been found in Adminer Login 1.4.4 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improper access controls. It is possible to launch the attack on the local host. The exploit has been discl…
-
Medium 4.3
Supsystic Popup Plugin cross-site request forgery
A vulnerability was found in Supsystic Popup Plugin 1.7.6 and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to …
-
Critical 9.6
Unrestricted Upload of File with Dangerous Type in polonel/trudesk
Unrestricted Upload of File with Dangerous Type in GitHub repository polonel/trudesk prior to 1.2.4.
-
Medium 5.1
IBM Robotic Process Automation 21.0.2 could allow a local user to obtain sensitive web service configuration credential…
-
Medium 5.9
IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authe…
-
Medium 5.9
IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authe…
-
Unscored —
In Mahara 21.04 before 21.04.6, 21.10 before 21.10.4, and 22.04.2, files can sometimes be downloaded through thumb.php …
-
Unscored —
Knot Resolver through 5.5.1 may allow DNS cache poisoning when there is an attempt to limit forwarding actions by filte…
-
Unscored —
An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 (Control Center) devices before 8.1A SP02 P04. The vulner…
-
Unscored —
An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 (Control Center) devices before 8.1A SP02 P04. The vulner…
-
Unscored —
There is a stack-overflow at ecma-helpers.c:326 in ecma_get_lex_env_type in JerryScript 2.4.0
-
Unscored —
There is a heap-use-after-free at ecma-helpers-string.c:1940 in ecma_compare_ecma_non_direct_strings in JerryScript 2.4…
-
Unscored —
Coming Soon and Maintenance by Colorlib < 1.0.99 - Admin+ Stored Cross Site Scripting
The Coming Soon & Maintenance Mode by Colorlib WordPress plugin before 1.0.99 does not sanitize and escape some settings, allowing high privilege users such as admin to perform Stored Cross-Site Scripting when unfiltered_html is disallowed (for example in mul…
-
Unscored —
Allow SVG Files < 1.1 - Admin+ Arbitrary File Upload
The Allow svg files WordPress plugin before 1.1 does not properly validate uploaded files, which could allow high privilege users such as admin to upload PHP files even when they are not allowed to
-
Unscored —
WP Zillow Review Slider < 2.4 - Admin+ Stored Cross-Site Scripting
The WP Zillow Review Slider WordPress plugin before 2.4 does not escape a settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite)
-
Unscored —CVE-2022-1905 EPSS 37%
Events Made Easy < 2.2.81 - Unauthenticated SQLi
The Events Made Easy WordPress plugin before 2.2.81 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
-
Unscored —
underConstruction < 1.21 - Admin+ Stored Cross-Site Scripting
The underConstruction WordPress plugin before 1.21 does not sanitise or escape the "Display a custom page using your own HTML" setting before outputting it, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiletred_html ca…
-
Unscored —
underConstruction < 1.20 - Construction Mode Deactivation via CSRF
The underConstruction WordPress plugin before 1.20 does not have CSRF check in place when deactivating the construction mode, which could allow attackers to make a logged in admin perform such action via a CSRF attack
-
Unscored —
Newsletter < 7.4.6 - Admin+ Stored Cross-Site Scripting
The Newsletter WordPress plugin before 7.4.6 does not escape and sanitise the preheader_text setting, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when the unfilteredhtml is disallowed
-
Unscored —
CaPa Protect <= 0.5.8.2 - Arbitrary Settings Update via CSRF
The CaPa Protect WordPress plugin through 0.5.8.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and disable the applied protection.
-
Unscored —
WPlite <= 1.3.1 - Arbitrary Settings Update via CSRF
The WPlite WordPress plugin through 1.3.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
-
Unscored —
Amazon Einzeltitellinks <= 1.3.3 - Arbitrary Settings Update to Stored XSS via CSRF
The Amazon Einzeltitellinks WordPress plugin through 1.3.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lac…
-
Unscored —
Inline Google Maps <= 5.11 - Arbitrary Settings Update to Stored XSS via CSRF
The Inline Google Maps WordPress plugin through 5.11 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, and lead to Stored Cross-Site Scripting due to the lack of …
-
Unscored —
PDF24 Articles To PDF <= 4.2.2 - Arbitrary Settings Update via CSRF
The PDF24 Articles To PDF WordPress plugin through 4.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
-
Unscored —
PDF24 Article To PDF <= 4.2.2 - Arbitrary Settings Update via CSRF
The PDF24 Article To PDF WordPress plugin through 4.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
-
Unscored —
Cross-Linker <= 3.0.1.9 - Arbitrary Cross-Link Creation via CSRF
The Cross-Linker WordPress plugin through 3.0.1.9 does not have CSRF check in place when creating Cross-Links, which could allow attackers to make a logged in admin perform such action via a CSRF attack