Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
The JSON Options WordPress plugin through 0.0.4 does not have any capability check or nonce verification on one of its actions, which runs on every request and is available to unauthenticated users, allowing them to update arbitrary WordPress options. This can be leveraged to enable user…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,5 % · rekomendacja wg zapisanej polityki
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the email address of arbitrary users, including administrators, and subsequently take over their account via the password reset flow.
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,5 % · rekomendacja wg zapisanej polityki
The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an administrator.
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,5 % · rekomendacja wg zapisanej polityki
The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the account…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,5 % · rekomendacja wg zapisanej polityki
The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site.
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,5 % · rekomendacja wg zapisanej polityki
The front-end interface /cms/category/list of MCMS <=6.2.0 is vulnerable to SQL injection. The size parameter is directly concatenated into the LIMIT clause of SQL through FreeMarker ${size} without being parameterized and bound. The built-in SqlInjectionUtil employs regular expression blacklist…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,5 % · rekomendacja wg zapisanej polityki
Insecure permissions in the scheduled tasks feature of MineAdmin v3.x allows attackers to execute arbitrary commands and execute a full account takeover.
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,5 % · rekomendacja wg zapisanej polityki
The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail() that allows attackers to execute commands by supplying shell metacharacters in file paths. Attackers who control a file name passed to generate_thumbnail, such as an uploaded file, can…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 2,99 % · rekomendacja wg zapisanej polityki
On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
Memory safety bugs present in Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastro_cobranca.php can place a quoted SQL expression in the codigo parameter, which extract($_REQUEST) passes into the WHERE codigo= clause of an UPDATE statement without…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
The JSON Options WordPress plugin through 0.0.4 does not have any capability check or nonce verification on one of its actions, which runs on every request and is available to unauthenticated users, allowing them to update arbitrary WordPress options. This can be leveraged to enable user…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,5 % · rekomendacja wg zapisanej polityki
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the email address of arbitrary users, including administrators, and subsequently take over their account via the password reset flow.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,5 % · rekomendacja wg zapisanej polityki
The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an administrator.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,5 % · rekomendacja wg zapisanej polityki
The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the account…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,5 % · rekomendacja wg zapisanej polityki
The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,5 % · rekomendacja wg zapisanej polityki
The front-end interface /cms/category/list of MCMS <=6.2.0 is vulnerable to SQL injection. The size parameter is directly concatenated into the LIMIT clause of SQL through FreeMarker ${size} without being parameterized and bound. The built-in SqlInjectionUtil employs regular expression blacklist…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,5 % · rekomendacja wg zapisanej polityki
Insecure permissions in the scheduled tasks feature of MineAdmin v3.x allows attackers to execute arbitrary commands and execute a full account takeover.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,5 % · rekomendacja wg zapisanej polityki
The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail() that allows attackers to execute commands by supplying shell metacharacters in file paths. Attackers who control a file name passed to generate_thumbnail, such as an uploaded file, can…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 2,99 % · rekomendacja wg zapisanej polityki
On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
Memory safety bugs present in Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,49 % · rekomendacja wg zapisanej polityki
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastro_cobranca.php can place a quoted SQL expression in the codigo parameter, which extract($_REQUEST) passes into the WHERE codigo= clause of an UPDATE statement without…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 0,49 % · rekomendacja wg zapisanej polityki