Archive
23 June 2023
Vulnerabilities first published on this day (UTC), newest first.
16 results · Clear filters · Feed
-
Critical 9.1
Yoga Class Registration System 1.0 - RCE
Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server. This is possible because the application does not correctly validate the thumbnails of the classes uploaded by the administrators.
-
Critical 10.0
fief-server Server-Side Template Injection vulnerability
# Server-Side Template Injection ## Overview of the Vulnerability Server-Side Template Injection (SSTI) is a vulnerability within application templating engines where user input is improperly handled and is embedded into the template, possibly leading code be…
-
Critical 9.1
php-imap vulnerable to RCE through a directory traversal vulnerability
PHP-IMAP is a wrapper for common IMAP communication without the need to have the php-imap module installed / enabled. Prior to version 5.3.0, an unsanitized attachment filename allows any unauthenticated user to leverage a directory traversal vulnerability, w…
-
Critical 9.7CVE-2023-35162 Scanner template
XPlatform Wiki vulnerable to cross-site scripting via xcontinue parameter in preview actions template
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the previewactions template to per…
-
Critical 9.7CVE-2023-35161 Scanner template
XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in DeleteApplication page
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the DeleteApplication page to perf…
-
Critical 9.7CVE-2023-35160 Scanner template
XWiki Platform vulnerable to reflected cross-site scripting via back and xcontinue parameters in resubmit template
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the resubmit template to perform a…
-
Critical 9.7CVE-2023-35159 Scanner template
XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace template
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the deletespace template to perfor…
-
Critical 9.7CVE-2023-35158 Scanner template
XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in restore template
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the restore template to perform a …
-
Critical 9.7CVE-2023-35156 Scanner template
XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in delete template
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the delete template to perform a X…
-
Critical 9.1
XWiki Platform vulnerable to stored cross-site scripting in ClassEditSheet page via name parameters
XWiki Platform is a generic wiki platform. Starting in version 5.4.4 and prior to versions 14.4.8, 14.10.4, and 15.0, a stored cross-site scripting vulnerability can be exploited by users with edit rights by adding a `AppWithinMinutes.FormFieldCategoryClass` …
-
Critical 10.0
XWiki Platform vulnerable to privilege escalation (PR) from account through like LiveTableResults
XWiki Platform is a generic wiki platform. Starting in version 12.9-rc-1 and prior to versions 14.4.8, 14.10.6, and 15.1, any logged in user can add dangerous content in their first name field and see it executed with programming rights. Leading to rights esc…
-
Critical 9.9CVE-2023-35150 EPSS 78%
XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 2.40m-2 and prior to versions 14.4.8, 14.10.4, and 15.0, any user with view rights on any document can execute code with programming r…
-
Critical 10.0
XWiki Platform's Mail.MailConfig can be edited by any user with edit rights
XWiki Platform is a generic wiki platform. Starting in version 11.8-rc-1 and prior to versions 14.4.8, 14.10.6, and 15.2, `Mail.MailConfig` can be edited by any logged-in user by default. Consequently, they can change the mail obfuscation configuration and vi…
-
Critical 9.1
XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 2.2.1 until versions 14.4.8, 14.10.5, and 15.1RC1 of org.xwiki.platform:xwiki-platform-web and any version prior to 14.4.8, 14.10.5, a…
-
Critical 9.6CVE-2023-33299 EPSS 24%
A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier versions…
-
Critical 9.8
Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary co…