Search vulnerabilities

Expected end of text, found ',' (at char 22), (line:1, col:23)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,803

CVE-2023-3580

Improper Handling of Additional Special Element in squidex/squidex

Improper Handling of Additional Special Element in GitHub repository squidex/squidex prior to 7.4.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Squidex.io
Products
Squidex
CVE-2023-3579

HadSky User cross-site request forgery

A vulnerability, which was classified as problematic, has been found in HadSky 7.11.8. Affected by this issue is some unknown functionality of the component User Handler. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-233372.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hadsky
Products
Hadsky
CVE-2023-3578

DedeCMS co_do.php server-side request forgery

A vulnerability classified as critical was found in DedeCMS 5.7.109. Affected by this vulnerability is an unknown functionality of the file co_do.php. The manipulation of the argument rssurl leads to server-side request forgery. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-233371.

CVSS 3.1 · 5.5 Medium EPSS 3.6% KEV · Not listed
Vendors
Dedecms
Products
Dedecms
CVE-2023-3577

Limited blind SSRF to localhost/intranet in interactive dialog implementation

Mattermost fails to properly restrict requests to localhost/intranet during the interactive dialog, which could allow an attacker to perform a limited blind SSRF.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Server
CVE-2023-3573

PHOENIX CONTACT: Command Injection in WP 6xxx Web panels

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a command injection in a HTTP POST request releated to font configuration operations to gain full access to the device.

CVSS 3.1 · 8.8 High EPSS 1.2% KEV · Not listed
Vendors
Phoenixcontact
Products
Wp 6070-wvps Wp 6070-wvps Firmware Wp 6101-wxps and 9 more
CVE-2023-3572

PHOENIX CONTACT: OS Command Injection in WP 6xxx Web panels

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote, unauthenticated attacker may use an attribute of a specific HTTP POST request releated to date/time operations to gain full access to the device.

CVSS 3.1 · 10 Critical EPSS 1.0% KEV · Not listed
Vendors
Phoenixcontact
Products
Wp 6070-wvps Wp 6070-wvps Firmware Wp 6101-wxps and 9 more
CVE-2023-3571

PHOENIX CONTACT: OS Command Injection in WP 6xxx Web panels

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a specific HTTP POST releated to certificate operations to gain full access to the device.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Phoenixcontact
Products
Wp 6070-wvps Wp 6070-wvps Firmware Wp 6101-wxps and 9 more
CVE-2023-3570

PHOENIX CONTACT: OS Command Injection in WP 6xxx Web panels

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a specific HTTP DELETE request to gain full access to the device.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Phoenixcontact
Products
Wp 6070-wvps Wp 6070-wvps Firmware Wp 6101-wxps and 9 more
CVE-2023-3566

wallabag Profile Config config allocation of resources

A vulnerability was found in wallabag 2.5.4. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /config of the component Profile Config. The manipulation of the argument Name leads to allocation of resources. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-233359. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 3.5 Low EPSS 1.4% KEV · Not listed
Vendors
Wallabag
Products
Wallabag
CVE-2023-3565

Cross-site Scripting (XSS) - Generic in nilsteampassnet/teampass

Cross-site Scripting (XSS) - Generic in GitHub repository nilsteampassnet/teampass prior to 3.0.10.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Teampass
Products
Teampass
CVE-2023-3564

GZ Scripts GZ Multi Hotel Booking System index.php cross site scripting

A vulnerability was found in GZ Scripts GZ Multi Hotel Booking System 1.8. It has been classified as problematic. Affected is an unknown function of the file /index.php. The manipulation of the argument adults/children/cal_id leads to cross site scripting. It is possible to launch the attack remotely. VDB-233358 is the identifier assigned to this vulnerability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Gzscripts
Products
Gz Multi Hotel Booking System
CVE-2023-3562

GZ Scripts PHP CRM Platform index.php cross site scripting

A vulnerability has been found in GZ Scripts PHP CRM Platform 1.8 and classified as problematic. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument action leads to cross site scripting. The attack can be initiated remotely. The identifier of this vulnerability is VDB-233356. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Gzscripts
Products
Php Crm Platform
CVE-2023-3561

GZ Scripts PHP GZ Hotel Booking Script load.php cross site scripting

A vulnerability, which was classified as problematic, was found in GZ Scripts PHP GZ Hotel Booking Script 1.8. This affects an unknown part of the file /load.php. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-233355. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Gzscripts
Products
Php Gz Hotel Booking Script
CVE-2023-3560

GZ Scripts Ticket Booking Script load.php cross site scripting

A vulnerability, which was classified as problematic, has been found in GZ Scripts Ticket Booking Script 1.8. Affected by this issue is some unknown functionality of the file /load.php. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. The attack may be launched remotely. VDB-233354 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Gzscripts
Products
Ticket Booking Script
CVE-2023-3559

GZ Scripts PHP GZ Appointment Scheduling Script load.php cross site scripting

A vulnerability classified as problematic was found in GZ Scripts PHP GZ Appointment Scheduling Script 1.8. Affected by this vulnerability is an unknown functionality of the file /load.php. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. The attack can be launched remotely. The identifier VDB-233353 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Gzscripts
Products
Php Gz Appointment Scheduling Script
CVE-2023-3558

GZ Scripts Event Booking Calendar load.php cross site scripting

A vulnerability classified as problematic has been found in GZ Scripts Event Booking Calendar 1.8. Affected is an unknown function of the file /load.php. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-233352. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Gzscripts
Products
Event Booking Calendar
CVE-2023-3557

GZ Scripts Property Listing Script preview.php cross site scripting

A vulnerability was found in GZ Scripts Property Listing Script 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /preview.php. The manipulation of the argument page/layout/sort_by leads to cross site scripting. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-233351. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Gzscripts
Products
Property Listing Script
CVE-2023-3556

GZ Scripts Car Listing Script PHP preview.php cross site scripting

A vulnerability was found in GZ Scripts Car Listing Script PHP 1.8. It has been declared as problematic. This vulnerability affects unknown code of the file /preview.php. The manipulation of the argument page/sort_by leads to cross site scripting. The attack can be initiated remotely. VDB-233350 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Gzscripts
Products
Car Listing Script Php