Archive
2 January 2023
Vulnerabilities first published on this day (UTC), newest first.
31 results · Clear filters · Feed
-
Medium 4.8CVE-2022-4260 Scanner template
WP-Ban < 1.69.1 - Admin+ Stored XSS
The WP-Ban WordPress plugin before 1.69.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for exampl…
-
Medium 6.1
Product list Widget for Woocommerce < 3.4.0 - Reflected XSS
The Product list Widget for Woocommerce WordPress plugin before 3.4.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both unauthenticated and authenticate…
-
Medium 5.3CVE-2022-4057 Scanner template
Autoptimize < 3.1.0 - Sensitive Data Disclosure
The Autoptimize WordPress plugin before 3.1.0 uses an easily guessable path to store plugin's exported settings and logs.
-
Medium 4.8
All-in-One Addons for Elementor - WidgetKit < 2.4.4 - Admin+ Stored XSS
The All-in-One Addons for Elementor WordPress plugin before 2.4.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability i…
-
Medium 4.8
Login with Cognito <= 1.4.8 - Admin+ Stored XSS
The Login with Cognito WordPress plugin through 1.4.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed…
-
Medium 6.1
WP-Lister Lite for Amazon < 2.4.4 - Reflected XSS
The WP-Lister Lite for Amazon WordPress plugin before 2.4.4 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which can be used against high-privilege users such as admin.
-
Medium 6.5
Welcart e-Commerce < 2.8.5 - Subscriber+ Arbitrary File Access
The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated users, which could allow users with a role as low as subscriber to read arbitra…
-
Medium 5.4
Superio - Job Board < 1.2.33 - Subscriber+ Stored Cross-Site Scripting
The Superio WordPress theme does not sanitise and escape some parameters, which could allow users with a role as low as a subscriber to perform Cross-Site Scripting attacks.
-
Medium 5.3
WP Cerber < 9.3.3 - User Enumeration Bypass via Rest API
The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 9.3.3 does not properly block access to the REST API users endpoint when the blog is in a subdirectory, which could allow attackers to bypass the restriction in place and list users
-
Medium 5.4
Popup Maker < 1.16.9 - Contributor+ Stored XSS via Subscription Form
The Popup Maker WordPress plugin before 1.16.9 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
-
Medium 5.4
Popup Maker < 1.16.9 - Contributor+ Stored XSS via Shortcode
The Popup Maker WordPress plugin before 1.16.9 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
-
Medium 4.8
Team Members < 5.2.1 - Editor+ Stored XSS
The Team Members WordPress plugin before 5.2.1 does not sanitize and escapes some of its settings, which could allow high-privilege users such as editors to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (fo…
-
Medium 4.8
Image Optimizer, Resizer and CDN < 6.8.1 - Admin+ Stored XSS
The Image Optimizer, Resizer and CDN WordPress plugin before 6.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability …
-
Medium 4.3
Authenticator < 1.3.1 - Subscriber+ Denial of Service via Feed Token Disclosure
The Authenticator WordPress plugin before 1.3.1 does not prevent subscribers from updating a site's feed access token, which may deny other users access to the functionality in certain configurations.
-
Medium 4.8
WordPress Filter Gallery Plugin < 0.1.6 - Admin+ Stored XSS
The WordPress Filter Gallery Plugin WordPress plugin before 0.1.6 does not properly escape the filters passed in the ufg_gallery_filters ajax action before outputting them on the page, allowing a high privileged user such as an administrator to inject HTML or…
-
Medium 5.3
BookingPress < 1.0.31 - Unauthenticated IDOR in appointment_id
The BookingPress WordPress plugin before 1.0.31 suffers from an Insecure Direct Object Reference (IDOR) vulnerability in it's thank you page, allowing any visitor to display information about any booking, including full name, date, time and service booked, by…
-
Medium 4.8
WP Social Sharing <= 2.2 - Admin+ Stored XSS
The WP Social Sharing WordPress plugin through 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (f…
-
Medium 4.6
OpenDNS OpenResolve endpoints.py neutralization for logs
A vulnerability classified as problematic has been found in OpenDNS OpenResolve. This affects an unknown part of the file resolverapi/endpoints.py. The manipulation leads to improper output neutralization for logs. The identifier of the patch is 9eba6ba5abd89…
-
Medium 6.5
Improper Input Validation in kenny2automate
kenny2automate is a Discord bot. In the web interface for server settings, form elements were generated with Discord channel IDs as part of input names. Prior to commit a947d7c, no validation was performed to ensure that the channel IDs submitted actually bel…
-
Medium 5.5
Centralized-Salesforce-Dev-Framework SOQL SObjectService.cls SObjectService injection
A vulnerability was found in Centralized-Salesforce-Dev-Framework. It has been declared as problematic. Affected by this vulnerability is the function SObjectService of the file src/classes/SObjectService.cls of the component SOQL Handler. The manipulation of…
-
Medium 5.5
IS_Projecto2 NewsBean.java sql injection
A vulnerability has been found in IS_Projecto2 and classified as critical. This vulnerability affects unknown code of the file Cnn-EJB/ejbModule/ejbs/NewsBean.java. The manipulation of the argument date leads to sql injection. The name of the patch is aa128b2…
-
Medium 5.5
License to Kill injury.rb sql injection
A vulnerability, which was classified as critical, was found in License to Kill. This affects an unknown part of the file models/injury.rb. The manipulation of the argument name leads to sql injection. The patch is named cd11cf174f361c98e9b1b4c281aa7b77f46b50…
-
Medium 6.5
Weak password requirements in Kiwi TCMS
Kiwi TCMS is an open source test management system. In version 11.6 and prior, when users register new accounts and/or change passwords, there is no validation in place which would prevent them from picking an easy to guess password. This issue is resolved by…
-
Medium 4.6
rofl0r MacGeiger ESSID macgeiger.c dump_wlan_at injection
A vulnerability classified as problematic has been found in rofl0r MacGeiger. Affected is the function dump_wlan_at of the file macgeiger.c of the component ESSID Handler. The manipulation leads to injection. Access to the local network is required for this a…
-
Medium 5.5
nterchange code_caller_controller.php getContent code injection
A vulnerability was found in nterchange up to 4.1.0. It has been rated as critical. This issue affects the function getContent of the file app/controllers/code_caller_controller.php. The manipulation of the argument q with the input %5C%27%29;phpinfo%28%29;/*…
-
Medium 6.3
82Flex WEIPDCRM sql injection
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in 82Flex WEIPDCRM. It has been classified as critical. This affects an unknown part. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The identifier of the patc…
-
Medium 4.3
cronvel string-kit naturalSort.js naturalSort redos
A vulnerability classified as problematic was found in cronvel string-kit up to 0.12.7. This vulnerability affects the function naturalSort of the file lib/naturalSort.js. The manipulation leads to inefficient regular expression complexity. The attack can be …
-
Medium 5.5
Hesburgh Libraries of Notre Dame Sipity search_criteria_for_works_parameter.rb SearchCriteriaForWorksParameter sql injection
A vulnerability classified as critical has been found in Hesburgh Libraries of Notre Dame Sipity. This affects the function SearchCriteriaForWorksParameter of the file app/parameters/sipity/parameters/search_criteria_for_works_parameter.rb. The manipulation l…
-
Medium 5.5
porpeeranut go-with-me add.php sql injection
A vulnerability was found in porpeeranut go-with-me. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file module/frontend/add.php. The manipulation leads to sql injection. The identifier of the patch is b924…
-
Medium 4.3
Inappropriate implementation in Paint in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to leak cross-or…
-
Medium 6.5
Use after free in Browser History in Google Chrome prior to 100.0.4896.75 allowed a remote attacker to potentially expl…