Skip to content
OpenAdvisories

Archive

26 December 2023

Vulnerabilities first published on this day (UTC), newest first.

← November 2023 2023 / December /26 January 2024 →
  1. 158
  2. 210
  3. 39
  4. 4243
  5. 5131
  6. 656
  7. 7140
  8. 883
  9. 924
  10. 1024
  11. 1140
  12. 12192
  13. 13155
  14. 14157
  15. 15290
  16. 1619
  17. 1727
  18. 18106
  19. 19119
  20. 20116
  21. 21126
  22. 2280
  23. 2312
  24. 2411
  25. 2566
  26. 2669
  27. 2730
  28. 2874
  29. 29160
  30. 3036
  31. 3134
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 4.8
    CVE-2023-5980

    BSK Forms Blacklist < 3.7 - Admin+ Stored Cross-Site Scripting

    The BSK Forms Blacklist WordPress plugin before 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (…

    Web / CMS
  • Medium 5.3
    CVE-2023-6155

    Quiz Maker < 6.4.9.5 - Unauthenticated Email Address Disclosure

    The Quiz Maker WordPress plugin before 6.4.9.5 does not adequately authorize the `ays_quiz_author_user_search` AJAX action, allowing an unauthenticated attacker to perform a search for users of the system, ultimately leaking user email addresses.

    Web / CMS
  • Medium 4.3
    CVE-2012-10017

    BestWebSoft Portfolio Plugin cross-site request forgery

    A vulnerability was found in BestWebSoft Portfolio Plugin up to 2.04 on WordPress. It has been classified as problematic. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgra…

    bestwebsoft Portfolio Plugin
  • Medium 5.4
    CVE-2023-50175

    Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page, the Markdown Settings (/admin/m…

    WESEEK GROWI
  • Medium 5.4
    CVE-2023-45740

    Stored cross-site scripting vulnerability when processing profile images exists in GROWI versions prior to v4.1.3. If t…

    WESEEK GROWI
  • Medium 6.3
    CVE-2023-7111

    code-projects Library Management System index.php sql injection

    A vulnerability, which was classified as critical, was found in code-projects Library Management System 2.0. Affected is an unknown function of the file index.php. The manipulation of the argument category leads to sql injection. It is possible to launch the …

    code-projects Library Management System
  • Medium 4.3
    CVE-2023-7108

    code-projects E-Commerce Website user_signup.php cross site scripting

    A vulnerability classified as problematic has been found in code-projects E-Commerce Website 1.0. This affects an unknown part of the file user_signup.php. The manipulation of the argument firstname with the input <video/src=x onerror=alert(document.domain)> …

    code-projects E-Commerce Website
  • Medium 5.4
    CVE-2023-27150

    OpenCRX Cross-site Scripting vulnerability

    openCRX 5.2.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name field after creation of a Tracker in Manage Activity.

    org.opencrx:opencrx-core Maven
  • Medium 6.1
    CVE-2023-49438 Public exploit Scanner template

    Open redirect vulnerability in Flask-Security-Too

    An open redirect vulnerability in the python package Flask-Security-Too <=5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes.

    flask-security-too PyPI