Archive
March 2024
Vulnerabilities first published in this month (UTC), newest first.
1,626 results · Clear filters · Feed
-
Medium 6.3
Campcodes/PHPGurukul Online Marriage Registration System application-bwdates-reports-details.php sql injection
A vulnerability has been found in Campcodes/PHPGurukul Online Marriage Registration System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/application-bwdates-reports-details.php. The manipulation …
-
Medium 5.4
Cross-site Scripting in Moodle Chat
The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A element or IMG element, or HTML content that leads to a performance degradation. NOTE: the vendor's Using_Chat page says "If you know some HTML code, you can use it in y…
-
Medium 5.4
SQL injection vulnerability in Niushop B2B2C v.5.3.3 and before allows an attacker to escalate privileges via the delet…
-
Medium 6.1
There is Stored Cross-Site Scripting (XSS) in dzzoffice 2.02.1 SC UTF8 in uploadfile to index.php, with the XSS payload…
-
Medium 6.5
VvvebJs Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and obtain sensitive information via the sanitizeFileName parameter in save.php.
-
Medium 5.4
Logpoint before 7.1.0 allows Self-XSS on the LDAP authentication page via the username to the LDAP login form.
-
Medium 6.1
VvvebJs Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting (XSS) vulnerability in VvvebJs before version 1.7.7, allows remote attackers to execute arbitrary code and obtain sensitive information via the action parameter in save.php.
-
Medium 6.3
SQL injection vulnerability in snow snow v.2.0.0 allows a remote attacker to execute arbitrary code via the dataScope p…
-
Medium 6.1
Cross Site Scripting (XSS) vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain …
-
Medium 5.4
Codiad v2.8.4 allows reflected XSS via the components/market/dialog.php type parameter.
-
Medium 6.3
Campcodes Online Marriage Registration System search.php sql injection
A vulnerability, which was classified as critical, was found in Campcodes Online Marriage Registration System 1.0. Affected is an unknown function of the file /admin/search.php. The manipulation of the argument searchdata leads to sql injection. It is possibl…
-
Medium 6.3
Campcodes Online Marriage Registration System search.php sql injection
A vulnerability classified as critical was found in Campcodes Online Marriage Registration System 1.0. This vulnerability affects unknown code of the file /user/search.php. The manipulation of the argument searchdata leads to sql injection. The attack can be …
-
Medium 6.4
Advantech WebAccess/SCADA SQL Injection
There is an SQL injection vulnerability in Advantech WebAccess/SCADA software that allows an authenticated attacker to remotely inject SQL code in the database. Successful exploitation of this vulnerability could allow an attacker to read or modify data on th…
-
Medium 6.3
Campcodes Complete Online Beauty Parlor Management System contact-us.php sql injection
A vulnerability was found in Campcodes Complete Online Beauty Parlor Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/contact-us.php. The manipulation of the argument email leads to …
-
Medium 6.5
A privilege escalation issue existed in FileMaker Server, potentially exposing sensitive information to front-end websi…
-
Medium 4.6
Delta Electronics DIAEnergie Cross-site scripting
Improper neutralization of input within the affected product could lead to cross-site scripting.
-
Medium 6.5
node-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validation
node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even…
-
Medium 6.3
Campcodes Complete Online Beauty Parlor Management System admin-profile.php sql injection
A vulnerability was detected in Campcodes Complete Online Beauty Parlor Management System 1.0. The affected element is an unknown function of the file /admin/admin-profile.php. The manipulation of the argument adminname/email results in sql injection. The att…
-
Medium 6.3
Campcodes Complete Online Beauty Parlor Management System edit-services.php sql injection
A vulnerability was found in Campcodes Complete Online Beauty Parlor Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/edit-services.php. The manipulation of the argument editid leads to sql injectio…
-
Medium 6.3
Campcodes Complete Online Beauty Parlor Management System forgot-password.php sql injection
A vulnerability was found in Campcodes Complete Online Beauty Parlor Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/forgot-password.php. The manipulation of the argument email leads to sql injec…
-
Medium 6.3
Campcodes Complete Online Beauty Parlor Management System index.php sql injection
A vulnerability has been found in Campcodes Complete Online Beauty Parlor Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/index.php. The manipulation of the argument username leads to sql injection.…
-
Medium 4.3
CSRF Vulnerability in gradio-app/gradio
A Cross-Site Request Forgery (CSRF) vulnerability in gradio-app/gradio allows attackers to upload multiple large files to a victim's system if they are running Gradio locally. By crafting a malicious HTML page that triggers an unauthorized file upload to the …
-
Medium 4.3
WordPress Prime Slider plugin <= 3.11.10 - Broken Access Control on Duplicate Post vulnerability
Missing Authorization vulnerability in BdThemes Prime Slider – Addons For Elementor.This issue affects Prime Slider – Addons For Elementor: from n/a through 3.11.10.
-
Medium 5.4
WordPress WP Media folder plugin <= 5.7.2 - Plugin Settings Change vulnerability
Missing Authorization vulnerability in JoomUnited WP Media folder.This issue affects WP Media folder: from n/a through 5.7.2.
-
Medium 5.3
WordPress Quicksand Post Filter jQuery plugin <= 3.1.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Mark Stockton Quicksand Post Filter jQuery Plugin.This issue affects Quicksand Post Filter jQuery Plugin: from n/a through 3.1.1.
-
Medium 6.5
WordPress YITH WooCommerce Gift Cards Premium plugin <= 3.23.1 - Unauth. Gift Card Creation Leading to Stored XSS vulnerability
Missing Authorization vulnerability in YITH YITH WooCommerce Gift Cards Premium.This issue affects YITH WooCommerce Gift Cards Premium: from n/a through 3.23.1.
-
Medium 4.3
WordPress AJAX Thumbnail Rebuild plugin <= 1.13 - Broken Access Control vulnerability
Missing Authorization vulnerability in junkcoder, ristoniinemets AJAX Thumbnail Rebuild.This issue affects AJAX Thumbnail Rebuild: from n/a through 1.13.
-
Medium 4.3
WordPress WP Media folder plugin <= 5.7.2 - Subscriber+ Arbitrary Post/Page Modification vulnerability
Missing Authorization vulnerability in JoomUnited WP Media folder.This issue affects WP Media folder: from n/a through 5.7.2.
-
Medium 5.4
WordPress Peach Payments Gateway plugin <= 3.1.9 - Broken Access Control vulnerability
Missing Authorization vulnerability in Peach Payments Peach Payments Gateway.This issue affects Peach Payments Gateway: from n/a through 3.1.9.
-
Medium 4.3
WordPress RegistrationMagic plugin <= 5.2.5.9 - Broken Access Control vulnerability
Missing Authorization vulnerability in Metagauss RegistrationMagic.This issue affects RegistrationMagic: from n/a through 5.2.5.9.
-
Medium 5.4
WordPress Points and Rewards for WooCommerce plugin <= 1.5.0 - Settings Change vulnerability
Missing Authorization vulnerability in WP Swings Points and Rewards for WooCommerce.This issue affects Points and Rewards for WooCommerce: from n/a through 1.5.0.
-
Medium 5.3
WordPress WP2FA plugin <= 2.2.0 - Broken Authentication vulnerability
Improper Authentication vulnerability in Melapress WP 2FA allows Authentication Bypass.This issue affects WP 2FA: from n/a through 2.2.0.
-
Medium 6.2
IBM Storage Protect Plus Server information disclosure
The private key for the IBM Storage Protect Plus Server 10.1.0 through 10.1.16 certificate can be disclosed, undermining the security of the certificate. IBM X-Force ID: 285205.
-
Medium 6.5
WordPress embed-code plugin <= 2.3.6 - Denial of Service Attack vulnerability
Uncontrolled Resource Consumption vulnerability in David Artiss Code Embed.This issue affects Code Embed: from n/a through 2.3.6.
-
Medium 4.3
WordPress Download Media plugin <= 1.4.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in Jean-David Daviet Download Media.This issue affects Download Media: from n/a through 1.4.2.
-
Medium 5.9
WordPress WP Coder plugin <= 3.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPCoder WP Coder allows Stored XSS.This issue affects WP Coder: from n/a through 3.5.
-
Medium 5.9
WordPress Tracking Code Manager plugin <= 2.0.16 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Data443 Tracking Code Manager.This issue affects Tracking Code Manager: from n/a through 2.0.16.
-
Medium 6.5
WordPress Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin <= 2.8.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FunnelKit Automation By Autonami allows Stored XSS.This issue affects Automation By Autonami: from n/a through 2.8.2.
-
Medium 6.5
WordPress Crisp – Live Chat and Chatbot plugin <= 0.44 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crisp allows Stored XSS.This issue affects Crisp: from n/a through 0.44.
-
Medium 5.9
WordPress WPFunnels plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels WPFunnels wpfunnels.This issue affects WPFunnels: from n/a through <= 3.0.6.