Podatności

Unauthenticated SQL Injection in uListing <= 2.2.0 versions.

CVSS 9,3 · EPSS 0,29 % · rekomendacja wg zapisanej polityki

Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file. With administrator rights, the configuration file can be viewed through the CLI or they can be exported from the device through a TFTP transfer from the web interface. A TFTP…

CVSS 9,3 · EPSS 0,29 % · rekomendacja wg zapisanej polityki

SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades—all without any authentication.

CVSS 9,3 · EPSS 0,29 % · rekomendacja wg zapisanej polityki

A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting (XSS). Successful exploitation could enable the attacker to hijack another CloudVision user's web session, potentially granting…

CVSS 9,3 · EPSS 0,28 % · rekomendacja wg zapisanej polityki

Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0 - site/simplemembership.php dispatches task=checkLoginPass with no authentication or access control check of any kind. The handler reads a login request parameter through Joomla’s generic,…

CVSS 9,3 · EPSS 0,28 % · rekomendacja wg zapisanej polityki

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments() in comments-bundle/contao/dca/tl_comments.php. When a backend user…

CVSS 9,3 · EPSS 0,27 % · rekomendacja wg zapisanej polityki

VMware Workstation and Fusion contain an integer-overflow vulnerability. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Affected versions: - VMware Workstation: 25H2, 26H1 (fixed…

CVSS 9,3 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tickera Tickera tickera-event-ticketing-system allows Blind SQL Injection.This issue affects Tickera: from n/a through 3.6.0.6.

CVSS 9,3 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

This vulnerability exists in the ERP system due to improper validation of payment callback parameters and inadequate authentication controls in API endpoint. An unauthenticated remote attacker could exploit this vulnerability by manipulating the parameter to cause the application to establish an…

CVSS 9,3 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows Blind SQL Injection.This issue affects WPLMS: from n/a before 1.9.9.8.2.

CVSS 9,3 · EPSS 0,25 % · rekomendacja wg zapisanej polityki

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Passionate Programmer Peter WP Data Access allows Blind SQL Injection. This issue affects WP Data Access: from n/a through 5.5.82.

CVSS 9,3 · EPSS 0,25 % · rekomendacja wg zapisanej polityki

Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions.

CVSS 9,3 · EPSS 0,25 % · rekomendacja wg zapisanej polityki

Unauthenticated SQL Injection in Newsletter Subscription Form – User Subscriptions Form, Capture Email <= 1.5.9 versions.

CVSS 9,3 · EPSS 0,25 % · rekomendacja wg zapisanej polityki

Unauthenticated SQL Injection in Gmedia Photo Gallery <= 1.25.1 versions.

CVSS 9,3 · EPSS 0,25 % · rekomendacja wg zapisanej polityki

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MultiNet Interactive AB EduAdmin Booking eduadmin-booking allows Blind SQL Injection.This issue affects EduAdmin Booking: from n/a before 6.0.0.

CVSS 9,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdreams Ajax Search Pro ajax-search-pro allows Blind SQL Injection.This issue affects Ajax Search Pro: from n/a through 4.29.1.

CVSS 9,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through 3.2.9.

CVSS 9,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jegtheme JNews - Pay Writer jnews-pay-writer allows Blind SQL Injection.This issue affects JNews - Pay Writer: from n/a through 12.0.1.

CVSS 9,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tagDiv tagDiv Opt-In Builder td-subscription allows Blind SQL Injection.This issue affects tagDiv Opt-In Builder: from n/a through 1.7.6.

CVSS 9,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

A stored cross-site scripting (XSS) vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious content that executes when an authenticated user views affected content. Successful exploitation may allow the attacker to compromise the victim's authenticated…

CVSS 9,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

Usernames and passwords, including the default credentials, are stored in the configuration file using weak encryption. If the default credentials are known by a malicious user, they could obtain other credentials on the system.

CVSS 9,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it and on into the rest of the session control block, which holds pointers. A malicious or compromised server can make a TLS…

CVSS 9,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki

An unauthenticated buffer overflow vulnerability exists in AOS-S. Successful exploitation could allow an unauthenticated adjacent attacker to expose sensitive memory contents and cause a denial of service on the affected device.

CVSS 9,3 · EPSS 0,2 % · rekomendacja wg zapisanej polityki

A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configuration file upload that exceeds the expected buffer size.Refer to the ' Security Update for ASUS Router Firmware  ' section on the ASUS Security Advisory for…

CVSS 9,3 · EPSS 0,19 % · rekomendacja wg zapisanej polityki

Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while…

CVSS 9,3 · EPSS 0,16 % · rekomendacja wg zapisanej polityki