Show filters
73 Total Results
Displaying 31-40 of 73
Sort by:
Attacker Value
Unknown
CVE-2024-1935
Disclosure Date: March 13, 2024 (last updated April 01, 2024)
The Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘parent_url’ parameter in all versions up to, and including, 1.12.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
0
Attacker Value
Unknown
CVE-2023-41735
Disclosure Date: November 30, 2023 (last updated December 06, 2023)
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gopi Ramasamy Email posts to subscribers.This issue affects Email posts to subscribers: from n/a through 6.2.
0
Attacker Value
Unknown
CVE-2022-46818
Disclosure Date: November 03, 2023 (last updated November 14, 2023)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Gopi Ramasamy Email posts to subscribers allows SQL Injection.This issue affects Email posts to subscribers: from n/a through 6.2.
0
Attacker Value
Unknown
CVE-2023-41736
Disclosure Date: October 02, 2023 (last updated October 09, 2023)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Email posts to subscribers plugin <= 6.2 versions.
0
Attacker Value
Unknown
CVE-2023-3356
Disclosure Date: August 30, 2023 (last updated October 08, 2023)
The Subscribers Text Counter WordPress plugin before 1.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, which also lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
0
Attacker Value
Unknown
CVE-2023-39809
Disclosure Date: August 21, 2023 (last updated October 08, 2023)
N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain a command injection vulnerability via the system_hostname parameter at /manage/network-basic.php.
0
Attacker Value
Unknown
CVE-2023-39808
Disclosure Date: August 21, 2023 (last updated October 08, 2023)
N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain a hardcoded root password which allows attackers to login with root privileges via the SSH service.
0
Attacker Value
Unknown
CVE-2023-39807
Disclosure Date: August 21, 2023 (last updated October 08, 2023)
N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain a SQL injection vulnerability via the a_passwd parameter at /portal/user-register.php.
0
Attacker Value
Unknown
CVE-2023-22684
Disclosure Date: May 15, 2023 (last updated October 08, 2023)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Subscribers.Com Subscribers plugin <= 1.5.3 versions.
0
Attacker Value
Unknown
CVE-2022-3981
Disclosure Date: December 12, 2022 (last updated October 08, 2023)
The Icegram Express WordPress plugin before 5.5.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by any authenticated users, such as subscriber
0
