Archive
13 February 2023
Vulnerabilities first published on this day (UTC), newest first.
27 results · Clear filters · Feed
-
High 7.7
WP Airbnb Review Slider < 3.3 - Subscriber+ SQLi
The WP Airbnb Review Slider WordPress plugin before 3.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber.
-
High 8.8
Customer Reviews for WooCommerce < 5.16.0 - Contributor+ LFI
The Customer Reviews for WooCommerce WordPress plugin before 5.16.0 does not validate one of its shortcode attribute, which could allow users with a contributor role and above to include arbitrary files via a traversal attack. This could also allow them to re…
-
High 8.8
Enable Media Replace < 4.0.2 - Author+ Arbitrary File Upload
The Enable Media Replace WordPress plugin before 4.0.2 does not prevent authors from uploading arbitrary files to the site, which may allow them to upload PHP shells on affected sites.
-
High 8.8
WP Google Review Slider < 11.8 - Subscriber+ SQLi
The WP Google Review Slider WordPress plugin before 11.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber.
-
High 7.7
Simple URLs < 115 - Subscriber+ SQLi
The Simple URLs WordPress plugin before 115 does not escape some parameters before using them in various SQL statements used by AJAX actions available by any authenticated users, leading to a SQL injection exploitable by low privilege users such as subscriber.
-
High 7.2
Mapwiz <= 1.0.1 - Admin+ SQLi
The Mapwiz WordPress plugin through 1.0.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
-
High 8.8
WP Review Slider < 12.2 - Subscriber+ SQLi
The WP Review Slider WordPress plugin before 12.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber.
-
High 8.8CVE-2023-0261 Scanner template
WP TripAdvisor Review Slider < 10.8 - Subscriber+ SQLi
The WP TripAdvisor Review Slider WordPress plugin before 10.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber.
-
High 8.8
Pinpoint Booking System < 2.9.9.2.9 - Subscriber+ SQLi
The Pinpoint Booking System WordPress plugin before 2.9.9.2.9 does not validate and escape one of its shortcode attributes before using it in a SQL statement, which could allow any authenticated users, such as subscriber to perform SQL Injection attacks.
-
High 7.8
Heap-based Buffer Overflow in gpac/gpac
Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to v2.3.0-DEV.
-
High 7.1
Off-by-one Error in gpac/gpac
Off-by-one Error in GitHub repository gpac/gpac prior to v2.3.0-DEV.
-
High 8.8
Cross-site Scripting (XSS) - Stored in btcpayserver/btcpayserver
Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.11.
-
High 7.3
Buffer Over-read in gpac/gpac
Buffer Over-read in GitHub repository gpac/gpac prior to v2.3.0-DEV.
-
High 7.5
Food Ordering System v2.0 was discovered to contain a SQL injection vulnerability via the email parameter.
-
High 8.8
ConnectWise Control before 22.9.10032 (formerly known as ScreenConnect) fails to validate user-supplied parameters such…
-
High 8.8
SameSite Attribute vulnerability in pimCore
An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code.
-
High 7.8
Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of d…
-
High 7.8
Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of d…
-
High 7.8
Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of d…
-
High 7.5
SUSHIRO App for Android outputs sensitive information to the log file, which may result in an attacker obtaining a cred…
-
High 7.8
Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of d…
-
High 7.8
Use-after free vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier due to lack of error ha…
-
High 7.8
Out-of-bound write vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier due to lack of erro…
-
High 7.8
Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of d…
-
High 7.8
Genymotion Desktop v3.3.2 was discovered to contain a DLL hijacking vulnerability that allows attackers to escalate pri…
-
High 8.8
Improper Input Validation in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on the same network to execute a…
-
High 7.5
Driver Distributor v2.2.3.1 and earlier contains a vulnerability where passwords are stored in a recoverable format. If…