Archive
2 October 2023
Vulnerabilities first published on this day (UTC), newest first.
81 results · Feed
-
Medium 5.9
WordPress WP Jump Menu Plugin <= 3.6.4 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jim Krill WP Jump Menu plugin <= 3.6.4 versions.
-
Medium 5.9
WordPress Swifty Bar, sticky bar by WPGens Plugin <= 1.2.10 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPGens Swifty Bar, sticky bar by WPGens plugin <= 1.2.10 versions.
-
Medium 5.9
WordPress Email posts to subscribers Plugin <= 6.2 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Email posts to subscribers plugin <= 6.2 versions.
-
Medium 5.9
WordPress Insert Estimated Reading Time Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in nigauri Insert Estimated Reading Time plugin <= 1.2 versions.
-
Medium 5.9
WordPress Back To The Top Button Plugin <= 2.1.5 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in YYDevelopment Back To The Top Button plugin <= 2.1.5 versions.
-
Medium 5.9
WordPress wordpress publish post email notification Plugin <= 1.0.2.2 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution WordPress publish post email notification plugin <= 1.0.2.2 versions.
-
Medium 5.9
WordPress SendPress Newsletters Plugin <= 1.22.3.31 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SendPress Newsletters plugin <= 1.22.3.31 versions.
-
Medium 6.5
WordPress Rescue Shortcodes Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rescue Themes Rescue Shortcodes allows Stored XSS.This issue affects Rescue Shortcodes: from n/a through 2.5.
-
High 7.1
WordPress Attorney Theme <= 3 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Hennessey Digital Attorney theme <= 3 theme.
-
Unscored —
FD Application Apr. 2022 Edition (Version 9.01) and earlier improperly restricts XML external entity references (XXE). …
-
Medium 6.7
In TVAPI, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of…
-
Medium 6.7
In apusys, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of p…
-
Medium 6.7
In vpu, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of priv…
-
Medium 6.7
In camera middleware, there is a possible out of bounds write due to a missing input validation. This could lead to loc…
-
Medium 6.7
In camera middleware, there is a possible out of bounds write due to a missing input validation. This could lead to loc…
-
Medium 6.7
In rpmb , there is a possible double free due to improper locking. This could lead to local escalation of privilege wit…
-
Medium 6.7
In rpmb , there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of p…
-
Medium 6.7
In ftm, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of p…
-
Unscored —
In video, there is a possible out of bounds write due to a permissions bypass. This could lead to local escalation of p…
-
High 7.5
In wlan firmware, there is a possible firmware assertion due to improper input handling. This could lead to remote deni…
-
Unscored —
In display, there is a possible information disclosure due to a missing bounds check. This could lead to local informat…
-
Medium 6.7
In CDMA PPP protocol, there is a possible out of bounds write due to a missing bounds check. This could lead to remote …
-
Medium 4.3
Field Logic DataCube4 Web API improper authentication
A vulnerability classified as problematic was found in Field Logic DataCube4 up to 20231001. This vulnerability affects unknown code of the file /api/ of the component Web API. The manipulation leads to improper authentication. The exploit has been disclosed …
-
Medium 5.3
pretix potential IP address spoofing vulnerability
An issue was discovered in pretix before 2023.7.1. Incorrect parsing of configuration files causes the application to trust unchecked X-Forwarded-For headers even though it has not been configured to do so. This can lead to IP address spoofing by users of the…
-
Critical 9.8
An issue in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the layout.…
-
Medium 6.1CVE-2023-44012 Scanner template
Cross Site Scripting vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the h…
-
Unscored —
File Upload vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the File Manag…
-
Unscored —
File Upload vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the Skin Manag…
-
Unscored —
Phpipam before v1.5.2 was discovered to contain a LDAP injection vulnerability via the dname parameter at /users/ad-sea…
-
Unscored —
Weak Exception Handling vulnerability in baramundi software GmbH EMM Agent 23.1.50 and before allows an attacker to cau…
-
High 8.8
Super Store Finder 3.7 and below is vulnerable to authenticated Arbitrary PHP Code Injection that could lead to Remote …
-
Unscored —
Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code and cause a den…
-
Unscored —
Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the wakeup_mac parameter in the …
-
Critical 9.8
Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the Hostname parameter within th…
-
Unscored —
A cross-site scripting (XSS) vulnerability in the publish article function of emlog pro v2.1.14 allows attackers to exe…
-
Unscored —
There is a SQL injection vulnerability in the Jizhicms 2.4.9 backend, which users can use to obtain database information
-
Unscored —
Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability in the diagnostic tools page. This v…
-
Unscored —
Presto Changeo testsitecreator up to v1.1.1 was discovered to contain a SQL injection vulnerability via the component d…
-
Unscored —
Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability in the Changing Username and Passwor…
-
Unscored —
An issue in animal-art-lab v13.6.1 allows attackers to send crafted notifications via leakage of the channel access tok…