Typecho v1.2.1 was discovered to be vulnerable to an XML Quadratic Blowup attack via the component /index.php/action/xmlrpc.
AFFECTED_PRODUCTS:
Typecho Typecho
DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the v parameter at selectimages.php.
AFFECTED_PRODUCTS:
Dedecms Dedecms
DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the imgstick parameter at selectimages.php.
AFFECTED_PRODUCTS:
Dedecms Dedecms
Tenda AX9 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'list' parameter at /goform/SetNetControlList.
AFFECTED_PRODUCTS:
Tenda Ax9 Firmware
Tenda AX9 V22.03.01.46 is vulnerable to command injection.
AFFECTED_PRODUCTS:
Tenda Ax9 Firmware
Tenda AX9 V22.03.01.46 has been found to contain a stack overflow vulnerability in the 'list' parameter at /goform/SetNetControlList.
AFFECTED_PRODUCTS:
Tenda Ax9 Firmware
Tenda AX9 V22.03.01.46 has been found to contain a stack overflow vulnerability in the 'list' parameter at /goform/SetVirtualServerCfg.
AFFECTED_PRODUCTS:
Tenda Ax9 Firmware
Tenda AX9 V22.03.01.46 has been found to contain a stack overflow vulnerability in the 'deviceList' parameter at /goform/setMacFilterCfg.
AFFECTED_PRODUCTS:
Tenda Ax9 Firmware
Tenda AX9 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'mac' parameter at /goform/SetOnlineDevName.
AFFECTED_PRODUCTS:
Tenda Ax9 Firmware
Tenda AX9 V22.03.01.46 has been found to contain a stack overflow vulnerability in the 'list' parameter at /goform/SetStaticRouteCfg.
AFFECTED_PRODUCTS:
Tenda Ax9 Firmware
Tenda AX9 V22.03.01.46 was discovered to contain a SQL command injection vulnerability in the 'setDeviceInfo' feature through the 'mac' parameter at /goform/setModules.
AFFECTED_PRODUCTS:
Tenda Ax9 Firmware
Tenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'list' parameter at /goform/SetNetControlList.
AFFECTED_PRODUCTS:
Tenda Ax12 Firmware
Tenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'mac' parameter at /goform/SetOnlineDevName.
AFFECTED_PRODUCTS:
Tenda Ax12 Firmware
Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the list parameter at /goform/SetStaticRouteCfg.
AFFECTED_PRODUCTS:
Tenda Ax12 Firmware
Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the deviceList parameter at /goform/setMacFilterCfg .
AFFECTED_PRODUCTS:
Tenda Ax12 Firmware
SENEC Storage Box V1,V2 and V3 accidentially expose a management UI accessible with publicly known admin credentials.
AFFECTED_PRODUCTS:
Enbw Senec Storage Box Firmware
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it's a duplicate of CVE-2023-39169.
The affected devices use publicly available default credentials with administrative privileges.
Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the list parameter at /goform/SetVirtualServerCfg.
AFFECTED_PRODUCTS:
Tenda Ax12 Firmware
Cross Site Scripting vulnerability in Best Courier Management System v.1.000 allows a remote attacker to execute arbitrary code via a crafted payload to the page parameter in the URL.
AFFECTED_PRODUCTS:
Mayurik Courier Management System
The affected devices transmit sensitive information unencrypted allowing a remote unauthenticated attacker to capture and modify network traffic.
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it's a duplicate of CVE-2023-39167.
In SENEC Storage Box V1,V2 and V3 an unauthenticated remote attacker can obtain the devices' logfiles that contain sensitive data.
AFFECTED_PRODUCTS:
Enbw Senec Storage Box Firmware
An issue was discovered in Dalmann OCPP.Core through 1.2.0 for OCPP (Open Charge Point Protocol) for electric vehicles. The server processes mishandle StartTransaction messages containing additional, arbitrary properties, or duplicate properties. The last occurrence of a duplicate property is accept...
AFFECTED_PRODUCTS:
Dallmann-Consulting Open Charge Point Protocol
An issue was discovered in Dalmann OCPP.Core before 1.3.0 for OCPP (Open Charge Point Protocol) for electric vehicles. It permits multiple transactions with the same connectorId and idTag, contrary to the expected ConcurrentTx status. This could result in critical transaction management and billing...
AFFECTED_PRODUCTS:
Dallmann-Consulting Open Charge Point Protocol
An issue was discovered in Dalmann OCPP.Core before 1.3.0 for OCPP (Open Charge Point Protocol) for electric vehicles. A StopTransaction message with any random transactionId terminates active transactions.
AFFECTED_PRODUCTS:
Dallmann-Consulting Open Charge Point Protocol
An issue was discovered in Dalmann OCPP.Core before 1.2.0 for OCPP (Open Charge Point Protocol) for electric vehicles. It does not validate the length of the chargePointVendor field in a BootNotification message, potentially leading to server instability and a denial of service when processing exces...
AFFECTED_PRODUCTS:
Dallmann-Consulting Open Charge Point Protocol
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in SoftLab Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Gallery, and Manage Your Google Drive Files Into Your WordPress Site.This issue affects Integrate Google Drive – Browse, Upload, Download, Embed, Play,...
AFFECTED_PRODUCTS:
Softlabbd Integrate Google Drive
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Michael Uno (miunosoft) Responsive Column Widgets.This issue affects Responsive Column Widgets: from n/a through 1.2.7.
AFFECTED_PRODUCTS:
Michaeluno Responsive Column Widgets
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in PluginOps Landing Page Builder – Lead Page – Optin Page – Squeeze Page – WordPress Landing Pages.This issue affects Landing Page Builder – Lead Page – Optin Page – Squeeze Page – WordPress Landing Pages: from n/a through 1.5.1.5.
AFFECTED_PRODUCTS:
Pluginops Landing Page Builder
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks. Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.1.4.
AFFECTED_PRODUCTS:
Crmperks Integration For Constant Contact And Contact Form 7\, Wpforms\, Elementor\, Ninja
Uncontrolled Resource Consumption vulnerability in Saturday Drive Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress leading to DoS.This issue affects Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress: from n/a through 3.6.25.
AFFECTED_PRODUCTS:
Ninjaforms Ninja Forms
Improper Restriction of Excessive Authentication Attempts vulnerability in Be Devious Web Development Password Reset with Code for WordPress REST API allows Authentication Abuse.This issue affects Password Reset with Code for WordPress REST API: from n/a through 0.0.15.
AFFECTED_PRODUCTS:
Bedevious Password Reset With Code For Wordpress Rest Api
Server-Side Request Forgery (SSRF) vulnerability in Softaculous Team SpeedyCache – Cache, Optimization, Performance.This issue affects SpeedyCache – Cache, Optimization, Performance: from n/a through 1.1.2.
AFFECTED_PRODUCTS:
Softaculous Speedycache
Server-Side Request Forgery (SSRF) vulnerability in Code for Recovery 12 Step Meeting List.This issue affects 12 Step Meeting List: from n/a through 3.14.24.
AFFECTED_PRODUCTS:
Code4Recovery 12 Step Meeting List
Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Starter Templates — Elementor, WordPress & Beaver Builder Templates.This issue affects Starter Templates — Elementor, WordPress & Beaver Builder Templates: from n/a through 3.2.4.
AFFECTED_PRODUCTS:
Brainstormforce Starter Templates
Server-Side Request Forgery (SSRF) vulnerability in Paytm Paytm Payment Gateway.This issue affects Paytm Payment Gateway: from n/a through 2.7.0.
AFFECTED_PRODUCTS:
Paytm Payment Gateway
An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.
Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this iss...
AFFECTED_PRODUCTS:
Apache Struts,
Apache Struts
DLL hijacking vulnerability in TTplayer version 7.0.2, allows local attackers to escalate privileges and execute arbitrary code via urlmon.dll.
AFFECTED_PRODUCTS:
Baidu Ttplayer
TOTOLINK N300RT version 3.2.4-B20180730.0906 has a post-authentication RCE due to incorrect access control, allows attackers can bypass front-end security restrictions and execute arbitrary code.
AFFECTED_PRODUCTS:
Totolink N300rt Firmware
A cross-site-scripting vulnerability exists in Ruckus Access Point products (ZoneDirector, SmartZone, and AP Solo). If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is logging in the product. As for the affected products/models/versions, see...
AFFECTED_PRODUCTS:
Ruckuswireless Zonedirector Firmware,
Ruckuswireless R310 Firmware,
Ruckuswireless H320 Firmware
... (+34)
Appointment Scheduler 3.0 is vulnerable to CSV Injection via a Language > Labels > Export action.
AFFECTED_PRODUCTS:
Phpjabbers Appointment Scheduler
A lack of rate limiting in pjActionAjaxSend in Appointment Scheduler 3.0 allows attackers to cause resource exhaustion.
AFFECTED_PRODUCTS:
Phpjabbers Appointment Scheduler
Appointment Scheduler 3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plugin_sms_api_key, plugin_sms_country_code, calendar_id, title, country name, or customer_name parameter.
AFFECTED_PRODUCTS:
Phpjabbers Appointment Scheduler
Appointment Scheduler 3.0 is vulnerable to Multiple HTML Injection issues via the SMS API Key or Default Country Code.
AFFECTED_PRODUCTS:
Phpjabbers Appointment Scheduler
Car Rental Script 3.0 is vulnerable to Multiple HTML Injection issues via SMS API Key or Default Country Code.
AFFECTED_PRODUCTS:
Phpjabbers Car Rental Script
Car Rental Script 3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plugin_sms_api_key, plugin_sms_country_code, calendar_id, title, country name, or customer_name parameter.
AFFECTED_PRODUCTS:
Phpjabbers Car Rental Script
Car Rental Script v3.0 is vulnerable to CSV Injection via a Language > Labels > Export action.
AFFECTED_PRODUCTS:
Phpjabbers Car Rental Script
A lack of rate limiting in pjActionAjaxSend in Car Rental v3.0 allows attackers to cause resource exhaustion.
AFFECTED_PRODUCTS:
Phpjabbers Car Rental Script
A lack of rate limiting in pjActionAJaxSend in Time Slots Booking Calendar 4.0 allows attackers to cause resource exhaustion.
AFFECTED_PRODUCTS:
Phpjabbers Time Slots Booking Calendar