Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the Subscriptions Manager in all versions up to, and including, 2.4.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, Shovel does not format state logged by the crash reporter and can leave unencrypted credentials in a crash dump file. the shovel worker genserver processes does not implement the formatstatus/2…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Missing authorization in Core in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially spoof address bar via a crafted HTML page. (Chromium security severity: Low)
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Plane is an open-source project management tool. In 1.3.1 and earlier, ProjectMemberViewSet.partial_update places its authorization checks inside the role update branch, so a guest or member can omit role and change another ProjectMember record's is_active field, including deactivating a project…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
SmartAdmin through 3.30.0 contains a missing authorization vulnerability in AdminProtectController that allows authenticated low-privileged employees to modify system-wide level-3 protection settings. Attackers can call the unannotated updateConfig and loginFail batchDelete endpoints to disable…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.7 and 2.52.0, the local web_fetch_tool and the WebFetch local fallback can consume excessive CPU and memory during HTML-to-Markdown conversion of attacker-controlled HTML…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow could an authenticated user to change the password of another user without prior knowledge of that password.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to version 1.27.0, a user with no view rights on a page may see the content of an office attachment displayed with the view file macro. This issue has been patched in version 1.27.0.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL used during JNDI lookup operations, enabling access to an unintended JNDI provider.�This could further lead to disclosure or modification of information about the server. There is…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'src_by[].val.start / src_by[].val.end (operator 'bt')' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.58.1. This is due to the software allowing users to execute an action that does not properly validate a value…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'current_month' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to time-based SQL Injection via the 'sort_by' parameter in all versions up to, and including, 3.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to blind SQL Injection via 'fields[][value]' Parameter in all versions up to, and including, 2.11.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 006 could allow an authenticated user to obtain sensitive information from backup files due to incorrect permissions assignment.
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users, allowing them to read private order messages, post messages and attachments in the customer's name,…
Opis źródłowy NVD · ENCVSS 6,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the Subscriptions Manager in all versions up to, and including, 2.4.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, Shovel does not format state logged by the crash reporter and can leave unencrypted credentials in a crash dump file. the shovel worker genserver processes does not implement the formatstatus/2…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Missing authorization in Core in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially spoof address bar via a crafted HTML page. (Chromium security severity: Low)
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Plane is an open-source project management tool. In 1.3.1 and earlier, ProjectMemberViewSet.partial_update places its authorization checks inside the role update branch, so a guest or member can omit role and change another ProjectMember record's is_active field, including deactivating a project…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
SmartAdmin through 3.30.0 contains a missing authorization vulnerability in AdminProtectController that allows authenticated low-privileged employees to modify system-wide level-3 protection settings. Attackers can call the unannotated updateConfig and loginFail batchDelete endpoints to disable…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.7 and 2.52.0, the local web_fetch_tool and the WebFetch local fallback can consume excessive CPU and memory during HTML-to-Markdown conversion of attacker-controlled HTML…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow could an authenticated user to change the password of another user without prior knowledge of that password.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to version 1.27.0, a user with no view rights on a page may see the content of an office attachment displayed with the view file macro. This issue has been patched in version 1.27.0.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL used during JNDI lookup operations, enabling access to an unintended JNDI provider.�This could further lead to disclosure or modification of information about the server. There is…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'src_by[].val.start / src_by[].val.end (operator 'bt')' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.58.1. This is due to the software allowing users to execute an action that does not properly validate a value…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'current_month' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to time-based SQL Injection via the 'sort_by' parameter in all versions up to, and including, 3.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to blind SQL Injection via 'fields[][value]' Parameter in all versions up to, and including, 2.11.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 006 could allow an authenticated user to obtain sensitive information from backup files due to incorrect permissions assignment.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users, allowing them to read private order messages, post messages and attachments in the customer's name,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,5 · EPSS 0,27 % · rekomendacja wg zapisanej polityki