Archive
26 December 2023
Vulnerabilities first published on this day (UTC), newest first.
69 results · Feed
-
Unscored —CVE-2023-5991 Scanner template
Hotel Booking Lite < 4.8.5 - Unauthenticated Arbitrary File Download & Deletion
The Hotel Booking Lite WordPress plugin before 4.8.5 does not validate file paths provided via user input, as well as does not have proper CSRF and authorisation checks, allowing unauthenticated users to download and delete arbitrary files on the server
-
Medium 4.8
BSK Forms Blacklist < 3.7 - Admin+ Stored Cross-Site Scripting
The BSK Forms Blacklist WordPress plugin before 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (…
-
Unscored —
Duplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data Exposure
The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the `backups-dup-lite/tmp` directory (or the `backups-dup-pro/tmp` directory in the Pro version), which temporarily stores files containi…
-
Unscored —
BestWebSoft's Like & Share < 2.74 - Unauthenticated Password Protected Post Read
The BestWebSoft's Like & Share WordPress plugin before 2.74 discloses the content of password protected posts to unauthenticated users via a meta tag
-
Medium 5.3
Quiz Maker < 6.4.9.5 - Unauthenticated Email Address Disclosure
The Quiz Maker WordPress plugin before 6.4.9.5 does not adequately authorize the `ays_quiz_author_user_search` AJAX action, allowing an unauthenticated attacker to perform a search for users of the system, ultimately leaking user email addresses.
-
Unscored —
rtMedia for WordPress, BuddyPress and bbPress < 4.6.16 - Admin+ RCE
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.6.16 loads the contents of the import file in an unsafe manner, leading to remote code execution by privileged users.
-
Unscored —
WP Mail Log < 1.1.3 – Contributor+ LFI in wml_logs/send_mail endpoint
The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file path parameters when attaching files to emails, leading to local file inclusion, and allowing an attacker to leak the contents of arbitrary files.
-
High 7.6
WP Mail Log < 1.1.3 – Incorrect Authorization in REST API Endpoints
The WP Mail Log WordPress plugin before 1.1.3 does not correctly authorize its REST API endpoints, allowing users with the Contributor role to view and delete data that should only be accessible to Admin users.
-
High 7.5CVE-2023-5203 Scanner template
WP Sessions Time Monitoring Full Automatic < 1.0.9 - Unauthenticated SQL injection
The WP Sessions Time Monitoring Full Automatic WordPress plugin before 1.0.9 does not sanitize the request URL or query parameters before using them in an SQL query, allowing unauthenticated attackers to extract sensitive data from the database via blind time…
-
Unscored —
WP Mail Log < 1.1.3 – Contributor+ SQL Injection in wml_logs endpoint
The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Contributor.
-
Unscored —
JSON Content Importer < 1.5.4 - Reflected XSS
The JSON Content Importer WordPress plugin before 1.5.4 does not sanitise and escape the tab parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
-
Unscored —
WP Mail Log < 1.1.3 – Contributor+ Arbitrary File Upload to RCE
The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file extensions uploading files to attach to emails, allowing attackers to upload PHP files, leading to remote code execution.
-
Unscored —CVE-2023-5674 EPSS 11%
WP Mail Log < 1.1.3 – Contributor+ SQL Injection in wml_logs/send_mail endpoint
The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Contributor.
-
Unscored —
Quiz Maker < 6.4.9.5 - Reflected Cross-Site Scripting
The Quiz Maker WordPress plugin before 6.4.9.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting
-
Unscored —
rtMedia for WordPress, BuddyPress and bbPress < 4.6.16 - Subscriber+ RCE
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.6.16 does not validate files to be uploaded, which could allow attackers with a low-privilege account (e.g. subscribers) to upload arbitrary files such as PHP on the server
-
Low 3.5
PlusCaptcha Plugin cross site scripting
A vulnerability was found in PlusCaptcha Plugin up to 2.0.6 on WordPress and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to ver…
-
Low 3.5
BestWebSoft Portfolio Plugin bws_menu.php bws_add_menu_render cross site scripting
A vulnerability was found in BestWebSoft Portfolio Plugin up to 2.27. It has been declared as problematic. This vulnerability affects the function bws_add_menu_render of the file bws_menu/bws_menu.php. The manipulation of the argument bwsmn_form_email leads t…
-
Unscored —
Apache OFBiz: Pre-authentication Remote Code Execution (RCE) vulnerability
The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code
-
Unscored —
Apache OFBiz: Arbitrary file properties reading and SSRF attack
Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations. The same uri can be operated to realize a SSRF attack also without authorizations. Users are recommended to upgra…
-
Medium 4.3
BestWebSoft Portfolio Plugin cross-site request forgery
A vulnerability was found in BestWebSoft Portfolio Plugin up to 2.04 on WordPress. It has been classified as problematic. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgra…
-
High 7.8CVE-2023-5180 Public exploit
Out-of-bounds Write vulnerability exists in ODA Drawings SDK before 2024.12
An issue was discovered in Open Design Alliance Drawings SDK before 2024.12. A corrupted value of number of sectors used by the Fat structure in a crafted DGN file leads to an out-of-bounds write. An attacker can leverage this vulnerability to execute code in…
-
Unscored —
VR-S1000 firmware Ver. 2.37 and earlier allows a network-adjacent unauthenticated attacker who can access the product's…
-
Unscored —
VR-S1000 firmware Ver. 2.37 and earlier uses a hard-coded cryptographic key which may allow an attacker to analyze the …
-
Unscored —
Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in VR-S1000 firmware V…
-
Unscored —
VR-S1000 firmware Ver. 2.37 and earlier allows an attacker with access to the product's web management page to execute …
-
Unscored —
Stored cross-site scripting vulnerability exists in the presentation feature of GROWI versions prior to v3.4.0. If this…
-
Unscored —
Improper authorization vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.0.…
-
Unscored —
The App Settings (/admin/app) page in GROWI versions prior to v6.0.6 stores sensitive information in cleartext form. As…
-
Medium 5.4
Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page, the Markdown Settings (/admin/m…
-
Unscored —
Stored cross-site scripting vulnerability when processing the MathJax exists in GROWI versions prior to v6.0.0. If this…
-
Unscored —
Stored cross-site scripting vulnerability exists in the anchor tag of GROWI versions prior to v6.0.0. If this vulnerabi…
-
Unscored —
Stored cross-site scripting vulnerability exists in the event handlers of the pre tags in GROWI versions prior to v6.0.…
-
Unscored —
Stored cross-site scripting vulnerability via the img tags exists in GROWI versions prior to v6.0.0. If this vulnerabil…
-
Unscored —
Stored cross-site scripting vulnerability which is exploiting a behavior of the XSS Filter exists in GROWI versions pri…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability exists in the User settings (/me) page of GROWI versions prior to v6.0.…
-
Medium 5.4
Stored cross-site scripting vulnerability when processing profile images exists in GROWI versions prior to v4.1.3. If t…
-
Unscored —
Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page and the Markdown Settings (/admi…
-
Unscored —
Stored cross-site scripting vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to …
-
Unscored —
Open redirect vulnerability in PowerCMS (6 Series, 5 Series, and 4 Series) allows a remote unauthenticated attacker to …
-
Unscored —
PowerCMS (6 Series, 5 Series, and 4 Series) contains a stored cross-site scripting vulnerability. If this vulnerability…