Threat and Vulnerability Intelligence Database

RSS Feed

Example Searches:

CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited

CVE-2023-2068
File Manager Advanced Shortcode <= 2.3.2 - Unauthenticated Remote Code Execution through shortcode
Description: The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using the shortcode. This leads to RCE in cases where the allowed MIME type list does not include PHP files. In the worst case, this is available to unauthenticated users.

CVSS: LOW (0.0)

EPSS Score: 83.95%

Source: CVE
November 28th, 2024 (6 months ago)

CVE-2023-20575
Description: A potential power side-channel vulnerability in some AMD processors may allow an authenticated attacker to use the power reporting functionality to monitor a program’s execution inside an AMD SEV VM potentially resulting in a leak of sensitive information.

CVSS: LOW (0.0)

EPSS Score: 0.06%

Source: CVE
November 28th, 2024 (6 months ago)

CVE-2023-2032
Custom 404 Pro < 3.8.1 - Multiple SQL Injection
Description: The Custom 404 Pro WordPress plugin before 3.8.1 does not properly sanitize database inputs, leading to multiple SQL Injection vulnerabilities.

CVSS: LOW (0.0)

EPSS Score: 0.21%

Source: CVE
November 28th, 2024 (6 months ago)

CVE-2023-1891
Accordion & FAQ < 1.9.9 - Reflected XSS
Description: The Accordion & FAQ WordPress plugin before 1.9.9 does not escape various generated URLs, before outputting them in attributes when some notices are displayed, leading to Reflected Cross-Site Scripting

CVSS: LOW (0.0)

EPSS Score: 0.07%

Source: CVE
November 28th, 2024 (6 months ago)

CVE-2023-1783
OrangeScrum 2.0.11 - AWS Credentials Leak via PDF Rendering
Description: OrangeScrum version 2.0.11 allows an external attacker to remotely obtain AWS instance credentials. This is possible because the application does not properly validate the HTML content to be converted to PDF.

CVSS: MEDIUM (6.5)

EPSS Score: 0.11%

Source: CVE
November 28th, 2024 (6 months ago)

CVE-2023-1724
Faveo Helpdesk Enterprise 6.0.1 - Privilege Escalation via Stored XSS
Description: Faveo Helpdesk Enterprise version 6.0.1 allows an attacker with agent permissions to perform privilege escalation on the application. This occurs because the application is vulnerable to stored XSS.

CVSS: HIGH (7.3)

EPSS Score: 0.08%

Source: CVE
November 28th, 2024 (6 months ago)

CVE-2023-1722
Yoga Class Registration System 1.0 - ATO
Description: Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server. This is possible because the application does not correctly validate the thumbnails of the classes uploaded by the administrators.

CVSS: CRITICAL (9.1)

EPSS Score: 0.23%

Source: CVE
November 28th, 2024 (6 months ago)

CVE-2023-1721
Yoga Class Registration System 1.0 - RCE
Description: Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server. This is possible because the application does not correctly validate the thumbnails of the classes uploaded by the administrators.

CVSS: CRITICAL (9.1)

EPSS Score: 0.21%

Source: CVE
November 28th, 2024 (6 months ago)

CVE-2023-1695
Description: Vulnerability of failures to capture exceptions in the communication framework. Successful exploitation of this vulnerability may cause features to perform abnormally.

CVSS: LOW (0.0)

EPSS Score: 0.09%

Source: CVE
November 28th, 2024 (6 months ago)

CVE-2023-1166
USM Premium < 16.3 - Admin+ Stored XSS
Description: The USM-Premium WordPress plugin before 16.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).

CVSS: LOW (0.0)

EPSS Score: 0.06%

Source: CVE
November 28th, 2024 (6 months ago)