Archive
5 April 2023
Vulnerabilities first published on this day (UTC), newest first.
92 results · Clear filters · Feed
-
Medium 6.3
WCFM Membership <= 2.9.10 - Cross-Site Request Forgery
The WCFM Membership plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.10 due to missing nonce checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety o…
-
Medium 6.5
Fields GLPI plugin vulnerable to unauthorized write access to additional fields
Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to versions 1.13.1 and 1.20.4, lack of access control check allows any authenticated user to write data to any fields container, including those to which they have no co…
-
Medium 4.8
GLPI vulnerable to stored Cross-site Scripting through dashboard administration
GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to versions 9.5.13 and 10.0.7, a user with dashboard administration rights may hack the dashboard form to store malicious code that will be executed when other users …
-
Medium 6.3
WCFM Frontend Manager <= 6.5.13 - Cross-Site Request Forgery
The WCFM Frontend Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.6.0 due to missing nonce checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide vari…
-
Medium 6.3
The WCFM Frontend Manager plugin for WordPress is vulnerable to unauthorized modification and access of data in version…
-
Medium 6.3
WCFM Marketplace <= 3.4.12 - Cross-Site Request Forgery
The WCFM Marketplace plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.11 due to missing nonce checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety …
-
Medium 4.5
GLPI vulnerable to stored Cross-site Scripting in external links
GLPI is a free asset and IT management software package. Starting in version 0.60 and prior to versions 9.5.13 and 10.0.7, a vulnerability allows an administrator to create a malicious external link. This issue is fixed in versions 9.5.13 and 10.0.7.
-
Medium 6.5
A vulnerability in the web-based management interface of Cisco Small Business Routers RV016, RV042, RV042G, RV082, RV32…
KEV Mar 3, 2025 -
Medium 5.4
YourChannel <= 1.2.4 - Cross-Site Request Forgery to Plugin Language Translation Reset
The YourChannel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.4. This is due to missing or incorrect nonce validation on the deleteLang function. This makes it possible for unauthenticated attackers to …
-
Medium 4.3
YourChannel <= 1.2.4 - Cross-Site Request Forgery to Plugin Language Translation Update
The YourChannel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.4. This is due to missing or incorrect nonce validation on the saveLang function. This makes it possible for unauthenticated attackers to ch…
-
Medium 5.5
YourChannel <= 1.2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
The YourChannel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with a…
-
Medium 6.5
YourChannel <= 1.2.3 - Missing Authorization to Plugin Cache Reset
The YourChannel plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check when clearing the plugin cache via the yrc_clear_cache GET parameter in versions up to, and including, 1.2.3. This makes it possible for unauthen…
-
Medium 5.4
YourChannel <= 1.2.4 - Cross-Site Request Forgery to Plugin Settings Change
The YourChannel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.4. This is due to missing or incorrect nonce validation on the save function. This makes it possible for unauthenticated attackers to change…
-
Medium 5.4
YourChannel <= 1.2.4 - Cross-Site Request Forgery to Plugin Channel Reset
The YourChannel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.4. This is due to missing or incorrect nonce validation on the clearKeys function. This makes it possible for unauthenticated attackers to r…
-
Medium 6.5
YourChannel <= 1.2.3 - Missing Authorization to Plugin Settings Reset
The YourChannel plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check when resetting plugin settings via the yrc_nuke GET parameter in versions up to, and including, 1.2.3. This makes it possible for unauthenticated…
-
Medium 4.3
SourceCodester Earnings and Expense Tracker App index.php information disclosure
A vulnerability was found in SourceCodester Earnings and Expense Tracker App 1.0. It has been classified as problematic. This affects an unknown part of the file index.php. The manipulation of the argument page leads to information disclosure. It is possible …
-
Medium 6.1
Dell Streaming Data Platform prior to 1.4 contains Open Redirect vulnerability. A remote unauthenticated attacker can p…
-
Medium 6.3
SourceCodester Air Cargo Management System GET Parameter track_shipment.php sql injection
A vulnerability has been found in SourceCodester Air Cargo Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/transactions/track_shipment.php of the component GET Parameter Handler. …
-
Medium 4.7
SourceCodester Online Graduate Tracer System session expiration
A vulnerability, which was classified as problematic, was found in SourceCodester Online Graduate Tracer System 1.0. Affected is an unknown function of the file admin/. The manipulation leads to session expiration. It is possible to launch the attack remotely…
-
Medium 6.5
WordPress Sp*tify Play Button for WordPress Plugin <= 2.05 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Jonk @ Follow me Darling Sp*tify Play Button for WordPress plugin <= 2.05 versions.
-
Medium 6.3
SourceCodester Online Payroll System login.php sql injection
A vulnerability was found in SourceCodester Online Payroll System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/login.php. The manipulation of the argument username leads to sql injection. The atta…
-
Medium 6.3
SourceCodester Online Payroll System cashadvance_row.php sql injection
A vulnerability was found in SourceCodester Online Payroll System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/cashadvance_row.php. The manipulation of the argument id leads to sql inject…
-
Medium 6.3
SourceCodester Online Payroll System attendance_row.php sql injection
A vulnerability was found in SourceCodester Online Payroll System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/attendance_row.php. The manipulation of the argument id leads to sql injection. It is possible to lau…
-
Medium 6.3
SourceCodester Online Payroll System attendance.php sql injection
A vulnerability was found in SourceCodester Online Payroll System 1.0 and classified as critical. This issue affects some unknown processing of the file attendance.php. The manipulation of the argument employee leads to sql injection. The attack may be initia…
-
Medium 6.3
SourceCodester Online Payroll System deduction_row.php sql injection
A vulnerability has been found in SourceCodester Online Payroll System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/deduction_row.php. The manipulation of the argument id leads to sql injection. The attack can be …
-
Medium 6.5
Uncontrolled Resource Consumption in M-Files Server
User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumption.
-
Medium 6.3
SourceCodester Online Payroll System employee_row.php sql injection
A vulnerability, which was classified as critical, was found in SourceCodester Online Payroll System 1.0. This affects an unknown part of the file /admin/employee_row.php. The manipulation of the argument id leads to sql injection. It is possible to initiate …
-
Medium 5.8
An issue has been discovered in GitLab affecting all versions starting from 13.6 before 15.8.5, all versions starting f…
-
Medium 5.4
An issue has been discovered in GitLab affecting all versions starting from 15.6 before 15.8.5, 15.9 before 15.9.4, and…
-
Medium 5.5
An issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.…
-
Medium 6.5
Bhima version 1.27.0 allows a remote attacker to update the privileges of any account registered in the application via…
-
Medium 6.5
Bhima version 1.27.0 allows an attacker authenticated with normal user permissions to view sensitive data of other appl…
-
Medium 4.3
Bhima version 1.27.0 allows an authenticated attacker with regular user permissions to update arbitrary user session da…
-
Medium 5.3
xml2js 0.4.23 - Prototype Pollution
xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the __proto__ property to be edited.
-
Medium 6.1
GLPI vulnerable to reflected Cross-site Scripting in search pages
GLPI is a free asset and IT management software package. Starting in version 0.85 and prior to versions 9.5.13 and 10.0.7, a malicious link can be crafted by an unauthenticated user. It will be able to exploit a reflected XSS in case any authenticated user op…
-
Medium 6.3
A use-after-free flaw was found in xgene_hwmon_remove in drivers/hwmon/xgene-hwmon.c in the Hardware Monitoring Linux K…
-
Medium 4.3
An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting f…
-
Medium 4.7
Cross-site Scripting (XSS) - Generic in thorsten/phpmyfaq
Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
-
Medium 5.3
Improper authorization in Gitlab EE affecting all versions from 12.3.0 before 15.8.5, all versions starting from 15.9 b…
-
Medium 4.7
A race problem was found in fs/proc/task_mmu.c in the memory management sub-component in the Linux kernel. This issue m…