Archive
5 November 2024
Vulnerabilities first published on this day (UTC), newest first.
109 results · Clear filters · Feed
-
Medium 4.0
Vulnerability of improper log printing in the Super Home Screen module Impact: Successful exploitation of this vulnerab…
-
Medium 4.3
Zotpress <= 7.3.12 - Missing Authorization
The Zotpress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Zotpress_process_accounts_AJAX function in all versions up to, and including, 7.3.12. This makes it possible for authenticated attack…
-
Medium 4.4
Photo Gallery by 10Web <= 1.8.30 - Authenticated (Administrator+) Stored Cross-Site Scripting
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.8.30 due to insufficient input sanitization and output escaping. This makes…
-
Medium 5.1
Permission control vulnerability in the Gallery app Impact: Successful exploitation of this vulnerability may affect se…
-
Medium 6.2
Permission control vulnerability in the clipboard module Impact: Successful exploitation of this vulnerability may affe…
-
Medium 4.7
In 2N Access Commander versions 3.1.1.2 and prior, a local attacker can escalate their privileges in the system which c…
-
Medium 4.0
Permission control vulnerability in the Wi-Fi module Impact: Successful exploitation of this vulnerability may affect s…
-
Medium 6.2
Vulnerability of improper device information processing in the device management module Impact: Successful exploitation…
-
Medium 6.3
In 2N Access Commander versions 3.1.1.2 and prior, an Insufficient Verification of Data Authenticity vulnerability coul…
-
Medium 5.7
Input parameter verification vulnerability in the background service module Impact: Successful exploitation of this vul…
-
Medium 5.5
Vulnerability of input parameters not being verified in the HDC module Impact: Successful exploitation of this vulnerab…
-
Medium 5.0
Vulnerability of input parameters not being verified in the HDC module Impact: Successful exploitation of this vulnerab…
-
Medium 5.3
Vulnerability of message types not being verified in the advanced messaging modul Impact: Successful exploitation of th…
-
Medium 5.1
Vulnerability of improper memory access in the phone service module Impact: Successful exploitation of this vulnerabili…
-
Medium 6.2
Permission control vulnerability in the ability module Impact: Successful exploitation of this vulnerability may cause …
-
Medium 6.2
Race condition vulnerability in the kernel network module Impact:Successful exploitation of this vulnerability may affe…
-
Medium 5.3
Vulnerability of pop-up windows belonging to no app in the VPN module Impact: Successful exploitation of this vulnerabi…
-
Medium 5.5
Vulnerability of processes not being fully terminated in the VPN module Impact: Successful exploitation of this vulnera…
-
Medium 6.2
Vulnerability of parameter type not being verified in the WantAgent module Impact: Successful exploitation of this vuln…
-
Medium 6.2
Vulnerability of parameter type not being verified in the WantAgent module Impact: Successful exploitation of this vuln…
-
Medium 6.1
Seriously Simple Podcasting <= 3.5.0 - Reflected Cross-Site Scripting via add_query_arg Parameter
The Seriously Simple Podcasting plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.5.0. This makes it possible for unauthenticate…
-
Medium 6.4
Basticom Framework <= 1.5.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
The Basticom Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated atta…
-
Medium 4.1
Post From Frontend <= 1.0.0 - Post Deletion via CSRF
The Post From Frontend WordPress plugin through 1.0.0 does not have CSRF check when deleting posts, which could allow attackers to make logged in admin perform such action via a CSRF attack
-
Medium 4.8
Pods < 3.2.7.1 - Admin+ Stored XSS
The Pods WordPress plugin before 3.2.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example…
-
Medium 4.8
Appointment Booking Calendar < 1.6.7.55 - Admin+ Stored XSS
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Appointment Type settings, which could allow high privilege users such as admin to perform Cross-Site Scri…
-
Medium 4.8
Appointment Booking Calendar < 1.6.7.55 - Admin+ Stored XSS
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Notification settings, which could allow high privilege users such as admin to perform Cross-Site Scriptin…
-
Medium 4.8
Table of Contents Plus <= 2408 - Editor+ Stored XSS
The Table of Contents Plus WordPress plugin through 2408 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
-
Medium 6.4
Shortcodes Blocks Creator Ultimate <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Shortcodes Blocks Creator Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'scu' shortcode in versions up to, and including, 2.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This m…
-
Medium 6.3
code-projects E-Health Care System app_request.php sql injection
A vulnerability was found in code-projects E-Health Care System 1.0. It has been classified as critical. Affected is an unknown function of the file Doctor/app_request.php. The manipulation of the argument app_id leads to sql injection. It is possible to laun…
-
Medium 6.3
code-projects E-Health Care System chat.php sql injection
A vulnerability was found in code-projects E-Health Care System 1.0 and classified as critical. This issue affects some unknown processing of the file /Doctor/chat.php. The manipulation of the argument name/message leads to sql injection. The attack may be in…
-
Medium 6.3
code-projects E-Health Care System req_detail.php sql injection
A vulnerability has been found in code-projects E-Health Care System 1.0 and classified as critical. This vulnerability affects unknown code of the file Admin/req_detail.php. The manipulation of the argument id leads to sql injection. The attack can be initia…
-
Medium 5.7
Netgear R8500 v1.0.2.160 was discovered to contain multiple stack overflow vulnerabilities in the component openvpn.cgi…
-
Medium 5.7
Netgear R8500 v1.0.2.160 was discovered to contain multiple stack overflow vulnerabilities in the component ipv6_fix.cg…
-
Medium 5.7
Netgear R8500 v1.0.2.160 was discovered to contain a stack overflow via the share_name parameter at usb_remote_smb_conf…
-
Medium 5.7
Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the sysNewPasswd parameter at p…
-
Medium 5.7
Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack…
-
Medium 5.7
Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack…
-
Medium 5.4
WebLaudos v20.8 (118) was discovered to contain a cross-site scripting (XSS) vulnerability via the login page.
-
Medium 5.7
Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to multiple stack …
-
Medium 5.7
Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the p…