Search vulnerabilities

Expected end of text, found '‑' (at char 7), (line:1, col:8)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,932

CVE-2023-2262

Rockwell Automation Select Logix Communication Modules Vulnerable to Email Object Buffer Overflow

A buffer overflow vulnerability exists in the Rockwell Automation select 1756-EN* communication devices. If exploited, a threat actor could potentially leverage this vulnerability to perform a remote code execution. To exploit this vulnerability, a threat actor would have to send a maliciously crafted CIP request to device.

CVSS 3.1 · 9.8 Critical EPSS 1.3% KEV · Not listed
Vendors
Rockwellautomation
Products
1756-en2f Series A 1756-en2f Series A Firmware 1756-en2f Series B and 63 more
CVE-2023-2255

Remote documents loaded without prompt via IFrame

Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of LibreOffice documents that used "floating frames" linked to external files, would load the contents of those frames without prompting the user for permission to do so. This was inconsistent with the treatment of other linked content in LibreOffice. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.7; 7.5 versions prior to 7.5.3.

CVSS 3.1 · 5.3 Medium EPSS 2.2% KEV · Not listed
Vendors
Debian Libreoffice Redhat
Products
Debian Linux Libreoffice Enterprise Linux
CVE-2023-2254

Ko-fi Button < 1.3.3 - Admin+ Stored XSS

The Ko-fi Button WordPress plugin before 1.3.3 does not properly some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup), and we consider it a low risk.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ko-fi
Products
Ko-fi Button
CVE-2023-2244

SourceCodester Online Eyewear Shop GET Parameter update_status.php sql injection

A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been classified as critical. This affects an unknown part of the file /admin/orders/update_status.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227229 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Oretnom23
Products
Online Eyewear Shop
CVE-2023-2243

SourceCodester Complaint Management System POST Parameter registration.php sql injection

A vulnerability was found in SourceCodester Complaint Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file users/registration.php of the component POST Parameter Handler. The manipulation of the argument fullname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227228.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Complaint Management System Project
Products
Complaint Management System
CVE-2023-2242

SourceCodester Online Computer and Laptop Store GET Parameter sql injection

A vulnerability has been found in SourceCodester Online Computer and Laptop Store 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component GET Parameter Handler. The manipulation of the argument c/s leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227227.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Oretnom23
Products
Online Computer And Laptop Store
CVE-2023-2234

BT HCI host union variant confusion

Union variant confusion allows any malicious BT controller to execute arbitrary code on the Zephyr host.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Zephyrproject
Products
Zephyr
CVE-2023-2231

MAXTECH MAX-G866ac Remote Management missing authentication

A vulnerability, which was classified as critical, was found in MAXTECH MAX-G866ac 0.4.1_TBRO_20160314. This affects an unknown part of the component Remote Management. The manipulation leads to missing authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227001 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 9.8 Critical EPSS 2.0% KEV · Not listed
Vendors
Max-tech
Products
Max-g866ac Max-g866ac Firmware
CVE-2023-2225

SEO ALert <= 1.59 - Admin+ Stored XSS

The SEO ALert WordPress plugin through 1.59 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Pottie
Products
Seo Alert
CVE-2023-2220

Dream Technology mica Form Object cross site scripting

A vulnerability was found in Dream Technology mica up to 3.0.5. It has been classified as problematic. Affected is an unknown function of the component Form Object Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. VDB-226986 is the identifier assigned to this vulnerability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Dreamlu
Products
Mica
CVE-2023-2219

SourceCodester Task Reminder System Users.php cross site scripting

A vulnerability was found in SourceCodester Task Reminder System 1.0 and classified as problematic. This issue affects some unknown processing of the file /classes/Users.php. The manipulation of the argument id leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226985 was assigned to this vulnerability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Task Reminder System Project
Products
Task Reminder System
CVE-2023-2218

SourceCodester Task Reminder System manage_user.php sql injection

A vulnerability has been found in SourceCodester Task Reminder System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/user/manage_user.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226984.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Task Reminder System Project
Products
Task Reminder System
CVE-2023-2216

Campcodes Coffee Shop POS System Users.php cross site scripting

A vulnerability classified as problematic was found in Campcodes Coffee Shop POS System 1.0. Affected by this vulnerability is an unknown functionality of the file /classes/Users.php. The manipulation of the argument firstname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226981 was assigned to this vulnerability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Coffee Shop Pos System Project
Products
Coffee Shop Pos System
CVE-2023-2214

Campcodes Coffee Shop POS System manage_sale.php sql injection

A vulnerability was found in Campcodes Coffee Shop POS System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/sales/manage_sale.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226979.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Coffee Shop Pos System Project
Products
Coffee Shop Pos System
CVE-2023-2213

Campcodes Coffee Shop POS System manage_product.php sql injection

A vulnerability was found in Campcodes Coffee Shop POS System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/products/manage_product.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-226978 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Coffee Shop Pos System Project
Products
Coffee Shop Pos System
CVE-2023-2211

Campcodes Coffee Shop POS System manage_category.php sql injection

A vulnerability was found in Campcodes Coffee Shop POS System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/categories/manage_category.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226976.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Coffee Shop Pos System Project
Products
Coffee Shop Pos System
CVE-2023-2210

Campcodes Coffee Shop POS System view_category.php sql injection

A vulnerability has been found in Campcodes Coffee Shop POS System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/categories/view_category.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226975.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Coffee Shop Pos System Project
Products
Coffee Shop Pos System
CVE-2023-2209

Campcodes Coffee Shop POS System view_details.php sql injection

A vulnerability, which was classified as critical, was found in Campcodes Coffee Shop POS System 1.0. Affected is an unknown function of the file /admin/sales/view_details.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-226974 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Coffee Shop Pos System Project
Products
Coffee Shop Pos System
CVE-2023-2208

Campcodes Retro Basketball Shoes Online Store details.php sql injection

A vulnerability, which was classified as critical, has been found in Campcodes Retro Basketball Shoes Online Store 1.0. This issue affects some unknown processing of the file details.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226973 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Campcodes
Products
Retro Basketball Shoes Online Store
CVE-2023-2207

Campcodes Retro Basketball Shoes Online Store contactus1.php sql injection

A vulnerability classified as critical was found in Campcodes Retro Basketball Shoes Online Store 1.0. This vulnerability affects unknown code of the file contactus1.php. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226972.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Campcodes
Products
Retro Basketball Shoes Online Store