Archive
21 November 2022
Vulnerabilities first published on this day (UTC), newest first.
90 results · Feed
-
High 7.2
Event Monster < 1.2.1 - Admin+ SQLi
The Event Monster WordPress plugin before 1.2.0 does not validate and escape some parameters before using them in SQL statements, which could lead to SQL Injection exploitable by high privilege users
-
Medium 4.7
Ask Me < 6.8.7 - Post Deletion via CSRF
The has a CSRF vulnerability that allows the deletion of a post without using a nonce or prompting for confirmation.
-
Medium 4.3
Event Monster < 1.2.0 - Visitors Deletion via CSRF
The Event Monster WordPress plugin before 1.2.0 does not have CSRF check when deleting visitors, which could allow attackers to make logged in admin delete arbitrary visitors via a CSRF attack
-
Critical 9.8
Easy Digital Downloads < 3.1.0.2 - Unauthenticated CSV Injection
The Easy Digital Downloads WordPress plugin before 3.1.0.2 does not validate data when its output in a CSV file, which could lead to CSV injection.
-
Medium 4.8
Spacer < 3.0.7 - Admin+ Stored XSS
The Spacer WordPress plugin before 3.0.7 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for exampl…
-
High 8.8
WPQA < 5.9 - Follow/Unfollow via CSRF
The WPQA Builder WordPress plugin before 5.9 does not have CSRF check when following and unfollowing users, which could allow attackers to make logged in users perform such actions via CSRF attacks
-
Medium 6.5
Booster for WooCommerce - ShopManager+ Arbitrary File Download
The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.5, Booster Elite for WooCommerce WordPress plugin before 1.1.7 do not validate files to download in some of its modules, which could allow Shop…
-
Medium 4.8
Evaluate <= 1.0 - Admin+ Stored Cross-Site Scripting
The Evaluate WordPress plugin through 1.0 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for examp…
-
Critical 9.8
Contact Form 7 Database Addon < 1.2.6.5 - CSV Injection
The Contact Form 7 Database Addon WordPress plugin before 1.2.6.5 does not validate data when output it back in a CSV file, which could lead to CSV injection
-
Medium 4.8
A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute…
-
Medium 4.8
A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute…
-
Medium 4.8
A cross-site scripting (XSS) vulnerability in the Modify Page module of WBCE CMS v1.5.4 allows attackers to execute arb…
-
Medium 4.8
A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute…
-
Medium 4.8
A cross-site scripting (XSS) vulnerability in the Overview Page settings module of WBCE CMS v1.5.4 allows attackers to …
-
High 7.8
When LG SmartShare is installed, local privilege escalation is possible through DLL Hijacking attack. The LG ID is LVE-…
-
High 7.5
Apache Hama allows XSS and information disclosure
missing input validation in Apache Hama may cause information disclosure through path traversal and XSS. Since Apache Hama is EOL, we do not expect these issues to be fixed.
-
Medium 5.5
Garbage collection issue in BC-FJA in Java 13 and later
An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4. Changes to the JVM garbage collector in Java 13 and later trigger an issue in the BC-FJA FIPS modules where it is possible for temporary keys used by the module to be zeroed …
-
Medium 4.8
A cross-site scripting (XSS) vulnerability in the Show Advanced Option module of WBCE CMS v1.5.4 allows attackers to ex…
-
Critical 9.8
An issue was discovered in Technitium DNS Server through 8.0.2 that allows variant V2 of unintended domain name resolut…
-
Critical 9.8
An issue was discovered in Technitium DNS Server through 8.0.2 that allows variant V1 of unintended domain name resolut…
-
Medium 4.8CVE-2022-40470 Public exploit
Phpgurukul Blood Donor Management System 1.0 allows Cross Site Scripting via Add Blood Group Name Feature.
-
Critical 9.8
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function addWifiMacFilter.
-
Critical 9.8
An issue was discovered in Appalti & Contratti 9.12.2. The target web applications are subject to multiple SQL Injectio…
-
High 7.5
Tenda AC21 V16.03.08.15 is vulnerable to Buffer Overflow via function via set_device_name.
-
High 7.5
Tenda AC15 V15.03.05.18 is avulnerable to Buffer Overflow via function formSetPPTPServer.
-
High 7.5
Tenda AC15 V15.03.05.18 is vulnerable to Buffer Overflow via function fromSetRouteStatic..
-
Critical 9.8
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function fromSetRouteStatic.
-
Critical 9.8
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function formSetWifiGuestBasic.
-
Critical 9.8
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function formWifiWpsStart.
-
Critical 9.8
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function R7WebsSecurityHandler.
-
High 7.8CVE-2022-44830 Public exploit
Sourcecodester Event Registration App v1.0 was discovered to contain multiple CSV injection vulnerabilities via the Fir…
-
High 7.5
An issue was discovered in Appalti & Contratti 9.12.2. The target web applications allow Local File Inclusion in any pa…
-
Medium 6.1
An issue was discovered in Appalti & Contratti 9.12.2. The web applications are vulnerable to a Reflected Cross-Site Sc…
-
Medium 6.5
An issue was discovered in Appalti & Contratti 9.12.2. It allows Session Fixation. When a user logs in providing a JSES…
-
Critical 9.8
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function formSetMacFilterCfg.
-
Critical 9.8
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow. via function formWifiWpsOOB.
-
High 7.5
Tenda AC15 V15.03.05.18 is vulnerable to Buffer Overflow via function formSetVirtualSer.
-
Critical 9.8
Tenda AC18 V15.03.05.05 is vulnerable to Buffer Overflow via function formSetDeviceName.
-
Critical 9.8
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function form_fast_setting_wifi_set.
-
High 7.5
Tenda AC21 V16.03.08.15 is vulnerable to Buffer Overflow via function formSetMacFilterCfg.