Archive
September 2023
Vulnerabilities first published in this month (UTC), newest first.
2,174 results · Feed
-
Medium 5.9
WordPress Snap Pixel Plugin <= 1.5.7 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Hassan Ali Snap Pixel plugin <= 1.5.7 versions.
-
Medium 5.9
WordPress SureCart Plugin <= 2.5.0 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SureCart WordPress Ecommerce For Creating Fast Online Stores plugin <= 2.5.0 versions.
-
High 7.5
Soundminer – CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Soundminer – CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
-
Medium 6.3
Fortect - CWE-428: Unquoted Search Path or Element
Fortect - CWE-428: Unquoted Search Path or Element, may be used by local user to elevate privileges.
-
High 7.6
One Identity Password Manager version 5.9.7.1 - Unauthenticated physical access privilege escalation
One Identity Password Manager version 5.9.7.1 - An unauthenticated attacker with physical access to a workstation may upgrade privileges to SYSTEM through an unspecified method. CWE-250: Execution with Unnecessary Privileges.
-
Medium 6.7
Stored cross-site scripting (XSS) vulnerability in protection plan name. The following products are affected: Acronis C…
-
High 7.1
Sensitive information disclosure and manipulation due to improper authorization. The following products are affected: A…
-
Medium 5.5
Sensitive information disclosure due to cleartext storage of sensitive information. The following products are affected…
-
Medium 5.7
Sensitive information disclosure due to spell-jacking. The following products are affected: Acronis Cyber Protect 15 (L…
-
Low 3.5
Sensitive information disclosure due to improper authorization. The following products are affected: Acronis Cyber Prot…
-
Low 3.1
Sensitive information manipulation due to cross-site request forgery. The following products are affected: Acronis Cybe…
-
Low 3.1
Sensitive information manipulation due to cross-site request forgery. The following products are affected: Acronis Cybe…
-
Low 3.5
Sensitive information disclosure due to insufficient token field masking. The following products are affected: Acronis …
-
Low 3.3
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Prote…
-
Medium 4.4
Sensitive information leak through log files. The following products are affected: Acronis Cyber Protect 15 (Linux, Win…
-
Medium 4.6
Sensitive information disclosure and manipulation due to improper authorization. The following products are affected: A…
-
Low 2.2
Sensitive information disclosure due to cleartext storage of sensitive information in memory. The following products ar…
-
Medium 6.1
Sensitive information disclosure and manipulation due to improper authentication. The following products are affected: …
-
High 7.1
WordPress Social Media & Share Icons Plugin <= 2.8.3 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in UltimatelySocial Social Media Share Buttons & Social Sharing Icons plugin <= 2.8.3 versions.
-
High 7.1
WordPress Arya Multipurpose Pro Theme <= 1.0.8 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Everest Themes Arya Multipurpose Pro theme <= 1.0.8 versions.
-
High 7.1
WordPress Happy Elementor Addons Pro Plugin <= 2.8.0 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Happy addons Happy Elementor Addons Pro plugin <= 2.8.0 versions.
-
High 7.1
WordPress Everest News Pro Theme <= 1.1.7 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Everest Themes Everest News Pro theme <= 1.1.7 versions.
-
High 7.1
WordPress Bridge Core Plugin <= 3.0.9 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Qode Interactive Bridge Core plugin <= 3.0.9 versions.
-
High 7.1
WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Themefic Ultimate Addons for Contact Form 7 plugin <= 3.2.0 versions.
-
High 7.1
WordPress URL Shortener by MyThemeShop Plugin <= 1.0.17 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in MyThemeShop URL Shortener by MyThemeShop plugin <= 1.0.17 versions.
-
Medium 5.0
LG ThinQ Service - Intent redirection with system privilege/LaunchAnyWhere
The vulnerability is an intent redirection in LG ThinQ Service ("com.lge.lms2") in the "com/lge/lms/things/ui/notification/NotificationManager.java" file. This vulnerability could be exploited by a third-party app installed on an LG device by sending a broadc…
-
Critical 9.8
SQLi in MRV Tech's Logging Administration Panel
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MRV Tech Logging Administration Panel allows SQL Injection. This issue affects Logging Administration Panel: before 20230915 .
-
High 7.1
WordPress WP Search Analytics Plugin <= 1.4.7 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Cornel Raiu WP Search Analytics plugin <= 1.4.7 versions.
-
Critical 9.8
SQLi in Hedef Trackings Admin Panel
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hedef Tracking Admin Panel allows SQL Injection. This issue affects Admin Panel: before 1.2.
-
Medium 5.9
WordPress GuruWalk Affiliates Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Abel Ruiz GuruWalk Affiliates plugin <= 1.0.0 versions.
-
Medium 6.5
WordPress Sitekit Plugin <= 1.3 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Webvitaly Sitekit plugin <= 1.3 versions.
-
Medium 5.9
WordPress Easy Coming Soon Plugin <= 2.3 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Ankit Agarwal, Priyanshu Mittal Easy Coming Soon plugin <= 2.3 versions.
-
High 8.8
IDOR in Usta AYBS
Authorization Bypass Through User-Controlled Key vulnerability in Usta AYBS allows Authentication Abuse, Authentication Bypass. This issue affects AYBS: before 1.0.3.
-
Medium 5.9
WordPress Vertical Marquee Plugin Plugin <= 7.1 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Vertical marquee plugin <= 7.1 versions.
-
Medium 5.9
WordPress Landing Page Builder Plugin <= 1.5.1.2 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PluginOps Landing Page Builder plugin <= 1.5.1.2 versions.
-
Unscored —
Relative path traversal vulnerability in Shihonkanri Plus Ver9.0.3 and earlier allows a local attacker to execute an ar…
-
Medium 6.5
WordPress Collapse-O-Matic Plugin <= 1.8.5.5 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in twinpictures, baden03 Collapse-O-Matic plugin <= 1.8.5.5 versions.
-
Medium 5.9
WordPress Slimstat Analytics Plugin <= 5.0.8 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jason Crouse, VeronaLabs Slimstat Analytics plugin <= 5.0.8 versions.
-
High 7.1
WordPress Simple URLs Plugin <= 117 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Lasso Simple URLs plugin <= 117 versions.
-
Medium 5.9
WordPress Save as PDF plugin by Pdfcrowd Plugin <= 2.16.0 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Pdfcrowd Save as PDF plugin by Pdfcrowd plugin <= 2.16.0 versions.