Dotkliwość: Krytyczna

Wstrzyknięcie kodu w Hotel Booking Lite umożliwia zdalne włączenie kodu.

Nieograniczony upload niebezpiecznych plików w Motors pozwala na wykorzystanie złośliwych plików.

Deserializacja niezaufanych danych w BoldGrid Client Invoicing umożliwia wstrzyknięcie obiektów.

Nieograniczony upload niebezpiecznych plików w WordPress Contact Form 7 PDF umożliwia użycie złośliwych plików.

Deserializacja niezaufanych danych w Codiqa umożliwia wstrzyknięcie obiektów.

Deserialization of Untrusted Data vulnerability in TieLabs Jannah jannah allows Object Injection.This issue affects Jannah: from n/a through <= 7.6.0.

Błędne przypisanie uprawnień w PenciDesign Soledad umożliwia eskalację uprawnień.

Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms FreshDesk Plugin gf-freshdesk allows Object Injection.This issue affects WP Gravity Forms FreshDesk Plugin:…

Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Insightly gf-insightly allows Object Injection.This issue affects WP Gravity Forms Insightly: from n/a through…

Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Zoho CRM and Bigin gf-zoho allows Object Injection.This issue affects WP Gravity Forms Zoho CRM and Bigin:…

Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Constant Contact Plugin gf-constant-contact allows Object Injection.This issue affects WP Gravity Forms…

Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms HubSpot gf-hubspot allows Object Injection.This issue affects WP Gravity Forms HubSpot: from n/a through <=…

Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Salesforce gf-salesforce-crmperks allows Object Injection.This issue affects WP Gravity Forms Salesforce: from…

Wstrzyknięcie SQL w tPlayer umożliwia nieautoryzowany dostęp do bazy danych.

Wstrzyknięcie SQL w smartcms Advance Seat Reservation Management umożliwia atak na bazę danych.

Nieprawidłowa kontrola nazwy pliku w Lunna umożliwia lokalne włączenie pliku PHP.

Deserialization of Untrusted Data vulnerability in BoldThemes DentiCare denticare allows Object Injection.This issue affects DentiCare: from n/a through < 1.4.3.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes EasyEat easyeat allows PHP Local File Inclusion.This…

Zerobyte is a backup automation tool Zerobyte versions prior to 0.18.5 and 0.19.0 contain an authentication bypass vulnerability where authentication middleware is not properly applied to…

Brak walidacji ścieżek w mcp-server-git pozwala na operacje na innych repozytoriach.

A security flaw has been discovered in code-projects Online Appointment Booking System 1.0. The impacted element is an unknown function of the file /admin/deletemanagerclinic.php.…

TinyWebGallery v2.5 contains a remote code execution vulnerability in the admin upload functionality that allows unauthenticated attackers to upload malicious PHP files. Attackers can…

UliCMS 2023.1 contains a privilege escalation vulnerability that allows unauthenticated attackers to create administrative accounts through the UserController endpoint. Attackers can send…

UliCMS 2023.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin users through mass assignment in the UserController. Attackers can send…

Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, an unchecked vsnprintf return in SStream_concat lets a malicious cs_opt_mem.vsnprintf drive SStream’s index…