Security
Headlines
HeadlinesLatestCVEs

Tag

#php

AIOS WordPress Plugin Faces Backlash for Storing User Passwords in Plain Text

All-In-One Security (AIOS), a WordPress plugin installed on over one million sites, has issued a security update after a bug introduced in version 5.1.9 of the software caused users' passwords being added to the database in plaintext format. "A malicious site administrator (i.e. a user already logged into the site as an admin) could then have read them," UpdraftPlus, the maintainers of AIOS,

The Hacker News
Open in Source
#vulnerability#web#ios#wordpress#php#rce#auth#The Hacker News
CVE-2023-2082: class-buy-me-a-coffee.php in buymeacoffee/trunk/includes – WordPress Plugin Repository

The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 3.6 due to insufficient sanitization and escaping on the 'text value set via the bmc_post_reception action. This makes it possible for authenticated attackers, with subscriber-level permissions, and above to inject arbitrary web scripts into pages that execute whenever a victim accesses a page with the injected scripts.

CVE-2023-37839: src/Dedecms v5.7.109 Background Command Execution Vulnerability.md at main · yezere/src

An arbitrary file upload vulnerability in /dede/file_manage_control.php of DedeCMS v5.7.109 allows attackers to execute arbitrary code via uploading a crafted PHP file.

CVE-2023-37598: GitHub - sahiloj/CVE-2023-37598: CSRF vulnerability in issabel-pbx v.4.0.0-6 to delete any new virtual fax of users

A Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a denial of service via the delete new virtual fax function.

GHSA-667r-p4gg-7m2q: ImpressCMS Cross-site Scripting vulnerability

A cross-site scripting (XSS) vulnerability in ImpressCMS v1.4.5 and before allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `smile_code` parameter of the component `/editprofile.php`.

CVE-2023-37786: GitHub - CrownZTX/reflectedxss1: Reflected XSS Vulnerabilitiy in public_html/admin/configuration.php of Geeklog v2.2.2

Multiple cross-site scripting (XSS) vulnerabilities in Geeklog v2.2.2 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Mail Settings[backend], Mail Settings[host], Mail Settings[port] and Mail Settings[auth] parameters of the /admin/configuration.php.

CVE-2023-37785: GitHub - CrownZTX/cve-description: ImpressCMS <= 1.4.5 is vulnerable to Stored Cross-Site Scripting (XSS) in ./editprofile.php

A cross-site scripting (XSS) vulnerability in ImpressCMS v1.4.5 and before allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the smile_code parameter of the component /editprofile.php.

CVE-2023-30151: [CVE-2023-30151] Improper neutralization of SQL parameters in the Boxtal (envoimoinscher) module from Boxtal for PrestaShop

A SQL injection vulnerability in the Boxtal (envoimoinscher) module for PrestaShop, after version 3.1.10, allows remote authenticated users to execute arbitrary SQL commands via the `key` GET parameter.

CVE-2023-37787: GitHub - CrownZTX/storedXSS: Geeklog v2.2.2 is vulnerable to Stored Cross-Site Scripting (XSS) in public_html/admin/router.php

Multiple cross-site scripting (XSS) vulnerabilities in Geeklog v2.2.2 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Rule and Route parameters of /admin/router.php.

CVE-2023-37743: Teacher Subject Allocation Management System in PHP | Teacher Subject Allocation Management Project

A cross-site scripting (XSS) vulnerability in Teacher Subject Allocation System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search text box.