Podatności

An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer…

CVSS 7,2 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to delete other tenants' agent or RAG applications by supplying their appId. Attackers can send requests to DELETE /v1/appspace/app with guessed sequential…

CVSS 7,2 · EPSS 0,3 % · rekomendacja wg zapisanej polityki

Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency <= 5.5.8 versions.

CVSS 7,2 · EPSS 0,3 % · rekomendacja wg zapisanej polityki

Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player super-video-player allows Object Injection.This issue affects Super Video Player: from n/a through 1.8.13.

CVSS 7,2 · EPSS 0,3 % · rekomendacja wg zapisanej polityki

Deserialization of Untrusted Data vulnerability in Tainacan Community Tainacan tainacan allows Object Injection.This issue affects Tainacan: from n/a through 1.3.0.

CVSS 7,2 · EPSS 0,3 % · rekomendacja wg zapisanej polityki

Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allows Object Injection.This issue affects Product Configurator for WooCommerce: from n/a through 1.7.5.

CVSS 7,2 · EPSS 0,3 % · rekomendacja wg zapisanej polityki

Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerability in the terminal proxy that allows authenticated users to reach the Terminals administrator API with the shared key attached. Attackers can send requests through /api/v1/terminals/{server_id}/{path} to list or stop…

CVSS 7,2 · EPSS 0,3 % · rekomendacja wg zapisanej polityki

The Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment (href attribute inside comment content)' parameter in all versions up to, and including, 5.2.12 due to insufficient input…

CVSS 7,2 · EPSS 0,3 % · rekomendacja wg zapisanej polityki

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shipping_first_name' parameter in all versions up to, and including, 3.16.0.5 due to insufficient input sanitization and output escaping. This makes it possible for…

CVSS 7,2 · EPSS 0,3 % · rekomendacja wg zapisanej polityki

The LazyLoad Plugin – Lazy Load Images, Videos, and Iframes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment_content (rendered inline into the page HTML)' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output…

CVSS 7,2 · EPSS 0,29 % · rekomendacja wg zapisanej polityki

The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to, and including, 7.3 due to insufficient input sanitization and output escaping. This makes it possible for…

CVSS 7,2 · EPSS 0,29 % · rekomendacja wg zapisanej polityki

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ref' parameter in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…

CVSS 7,2 · EPSS 0,29 % · rekomendacja wg zapisanej polityki

n8n before 1.123.83 contains an authorization bypass vulnerability that allows shared-workflow editors to use credentials they cannot access by embedding them in nested or tool inline sub-workflows. Attackers can save workflows with Workflow Tool or Workflow Retriever inline definitions…

CVSS 7,2 · EPSS 0,28 % · rekomendacja wg zapisanej polityki

Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/cat_issues_top.pl script (sub calculate) concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only prefix-normalized and never validated against an…

CVSS 7,2 · EPSS 0,28 % · rekomendacja wg zapisanej polityki

An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service when IS-IS link protection and backup-selection are configured.

CVSS 7,2 · EPSS 0,27 % · rekomendacja wg zapisanej polityki

The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'wcpr_image_upload_id' parameter in all versions up to, and including, 1.2.30 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…

CVSS 7,2 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition.

CVSS 7,2 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

Incorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommerce allows Privilege Escalation.This issue affects WooCommerce: from 9.8.0 through 11.1.2.

CVSS 7,2 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Session History in all versions up to, and including, 9.3.03.002 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject…

CVSS 7,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki

The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Auphonic Webhook in all versions up to, and including, 4.5.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web…

CVSS 7,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki

The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customField[] parameter of the public frontusers::subscribe endpoint in versions up to, and including, 11.1.0. This is due to insufficient input sanitization and output escaping in the acym_cleanVar()…

CVSS 7,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. A member who uploads a crafted item can run script in the n8n origin of whoever previews it, typically the…

CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345, while the lf CLI silently discards HOST overrides. Network-adjacent attackers can call the project and dataset management API to read stored provider API…

CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field mapped to notification_content (attacker-chosen key, e.g. payload_text)' parameter in all versions up to, and including,…

CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute field name, e.g. profile_test>' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and…

CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki