CVE-2023-7338

Ruckus Unleashed Authenticated RCE in Gateway Mode

Ruckus Unleashed contains a remote code execution vulnerability in the web-based management interface that allows authenticated remote attackers to execute arbitrary code on the system when gateway mode is enabled. Attackers can exploit this vulnerability by sending specially crafted requests through the management interface to achieve arbitrary code execution on affected systems.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Commscope Ruckusnetworks

Products

Ruckus C110 Ruckus E510 Ruckus H320 and 55 more

CVE-2023-54346

WordPress Plugin Backup Migration 1.2.8 Unauthenticated Database Backup Download

WordPress Plugin Backup Migration 1.2.8 contains an information disclosure vulnerability that allows unauthenticated attackers to download complete database backups by accessing predictable file paths. Attackers can enumerate backup directories through configuration files and complete logs, then construct direct download URLs to retrieve sensitive backup archives containing full database dumps.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Backupbliss Wordpress

Products

Backup Migration Wordpress Plugin Backup Migration Wordpress

CVE-2022-50994

DrayTek Vigor 2960 < 1.5.1.4 OS Command Injection via mainfunction.cgi

DrayTek Vigor 2960 firmware versions prior to 1.5.1.4 contain an OS command injection vulnerability in the CGI login handler that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the formpassword parameter. Attackers can exploit unsanitized input passed to the otp_check.sh script to achieve remote code execution with web server privileges. Exploitation requires knowledge of a valid username and that the target account has MOTP authentication enabled.

CVSS 4.0 · 9.2 Critical EPSS 1.4% KEV · Not listed

Vendors

Draytek

Products

Vigor 2960

CVE-2022-50993

Weaver E-office < 10.0_20221201 Unauthenticated Arbitrary File Read via XmlRpcServlet

Weaver (Fanwei) E-office versions prior to 10.0_20221201 contain an unauthenticated arbitrary file upload vulnerability in the OfficeServer.php endpoint that allows remote attackers to upload malicious files by sending multipart POST requests with arbitrary filenames and disguised content types. Attackers can upload PHP webshells to the Document directory and execute them via HTTP GET requests to achieve remote code execution as the web server user. Exploitation evidence was first observed by the Shadowserver Foundation on 2022-10-10 (UTC).

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Weaver

Products

E-office

CVE-2022-50992

Weaver E-cology 9.5 Unauthenticated Arbitrary File Read via XmlRpcServlet

Weaver (Fanwei) E-cology 9.5 versions prior to 10.52 contain an arbitrary file read vulnerability in the XmlRpcServlet interface at the XML-RPC endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying file paths to the WorkflowService.getAttachment and WorkflowService.LoadTemplateProp methods. Attackers can exploit these methods without authentication to retrieve sensitive files including system configuration files and database credentials from the server. Exploitation evidence was first observed by the Shadowserver Foundation on 2022-12-14 (UTC).

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Weaver

Products

E-cology

CVE-2022-50972

WooCommerce 7.1.0 Remote Code Execution via class-wc-meta-box-product-images.php

WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by injecting shell commands through the product-type parameter. Attackers can send requests to the class-wc-meta-box-product-images.php endpoint with unsanitized product-type values to write malicious PHP files to the web root.

CVSS 4.0 · 9.3 Critical EPSS 1.1% KEV · Not listed

Vendors

Woocommerce Wordpress

Products

Woocommerce Wordpress

CVE-2022-50971

Malwarebytes 4.5 Unquoted Service Path Privilege Escalation

Malwarebytes 4.5 contains an unquoted service path vulnerability in the MBAMService executable that allows local attackers to escalate privileges by injecting malicious code into the system root path. Attackers can place executable files in unquoted path directories that execute with LocalSystem privileges during service startup or system reboot.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Malwarebytes

Products

Malwarebytes

CVE-2022-50959

WordPress Contact Form Builder 1.6.1 Cross-Site Scripting via code_generator.php

WordPress Contact Form Builder 1.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by exploiting the form_id parameter. Attackers can craft malicious URLs to code_generator.php with script payloads in the form_id parameter to execute arbitrary JavaScript in victim browsers.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpdevart

Products

Wordpress Contact Form Builder

CVE-2022-50956

WordPress Plugin amministrazione-aperta 3.7.3 Local File Read

WordPress Plugin amministrazione-aperta 3.7.3 contains a local file read vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting insufficient input validation in the open parameter. Attackers can supply file paths through the open GET parameter in dispatcher.php to include and read sensitive files accessible to the web server.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Amministrazione Aperta Project Wordpress

Products

Amministrazione Aperta Wordpress

CVE-2022-50944

Aero CMS 0.0.1 PHP Code Injection via posts.php

Aero CMS 0.0.1 contains a PHP code injection vulnerability that allows authenticated attackers to execute arbitrary PHP code by uploading malicious files through the image parameter. Attackers can upload PHP files with embedded code to the admin posts.php endpoint with source=add_post parameter, and the uploaded files are executed by the server.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Aerocms Project Megatkc

Products

Aerocms Aero Cms

CVE-2022-50943

Moodle LMS 4.0 Cross-Site Scripting via course search.php

Moodle LMS 4.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting payloads through the search parameter. Attackers can inject JavaScript code via the search field in course/search.php to execute arbitrary scripts in users' browsers and steal session cookies.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Moodle

Products

Moodle

CVE-2021-47979

WordPress Plugin Backup and Restore 1.0.3 Arbitrary File Deletion

WordPress Plugin Backup and Restore 1.0.3 contains an arbitrary file deletion vulnerability that allows authenticated attackers to delete files by manipulating parameters in AJAX requests. Attackers can send POST requests to admin-ajax.php with crafted file_name and folder_name parameters to delete arbitrary files from the WordPress installation directory.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Miniorange Wordpress Wpbackitup

Products

Backup And Restore Wordpress Backup And Restore Wordpress

CVE-2021-47950

Advanced Guestbook 2.4.4 Persistent XSS via Smilies

Advanced Guestbook 2.4.4 contains a persistent cross-site scripting vulnerability in the smilies administration interface that allows authenticated attackers to inject malicious scripts by manipulating the s_emotion parameter. Attackers can submit POST requests to admin.php with JavaScript code in the s_emotion field, which executes when administrators view the smilies tab.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Ampps Simplephpscripts

Products

Advanced Guestbook Guestbook Script

CVE-2021-47941

WordPress Plugin Survey & Poll 1.5.7.3 SQL Injection via sss_params

WordPress Plugin Survey & Poll 1.5.7.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the wp_sap cookie parameter. Attackers can craft SQL payloads in the cookie to extract sensitive database information including usernames, passwords, and other confidential data from the WordPress database.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Modalsurvey Wordpress

Products

Survey & Poll Wordpress Survey And Poll Wordpress

CVE-2021-47932

WordPress TheCartPress 1.5.3.6 Privilege Escalation Unauthenticated

WordPress TheCartPress 1.5.3.6 contains an unauthenticated privilege escalation vulnerability that allows attackers to create administrator accounts by submitting crafted requests to the AJAX handler. Attackers can send POST requests to the tcp_register_and_login_ajax action with tcp_role set to administrator to gain full administrative access without authentication.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Thecartpress Wordpress

Products

Thecartpress Wordpress

CVE-2021-47925

CMDBuild 3.3.2 Multiple Stored Cross-Site Scripting

CMDBuild 3.3.2 contains multiple stored cross-site scripting vulnerabilities that allow authenticated attackers to inject arbitrary web script or HTML via crafted input in card creation and file upload endpoints. Attackers can inject XSS payloads through Employee card parameters or SVG file attachments in the classes endpoint, which execute when other users view the affected records or preview attachments.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Cmdbuild Tecnoteca

Products

Cmdbuild Cmdbuild

CVE-2021-47903

LiteSpeed Web Server Enterprise 5.4.11 - Command Injection

LiteSpeed Web Server Enterprise 5.4.11 contains an authenticated command injection vulnerability in the external app configuration interface. Authenticated administrators can inject shell commands through the 'Command' parameter in the server configuration, allowing remote code execution via path traversal and bash command injection.

CVSS 4.0 · 8.6 High EPSS 1.6% KEV · Not listed

Vendors

Litespeed Technologies Litespeedtech

Products

Litespeed Web Server Litespeed Web Server

CVE-2021-47889

Softros LAN Messenger 9.6.4 - 'SoftrosSpellChecker' Unquoted Service Path

Softros LAN Messenger 9.6.4 contains an unquoted service path vulnerability in the SoftrosSpellChecker service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files (x86)\Softros Systems\Softros Messenger\Spell Checker\' to inject malicious executables and escalate privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Cd-messenger Project Softros Systems

Products

Cd-messenger Lan Messenger

CVE-2021-47815

Nsauditor 3.2.3 - Denial of Service (PoC)

Nsauditor 3.2.3 contains a denial of service vulnerability in the registration code input field that allows attackers to crash the application. Attackers can paste a large buffer of 256 repeated characters into the 'Key' field to trigger an application crash.

CVSS 4.0 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Nsasoft Nsauditor

Products

Nsauditor Nsauditor

CVE-2021-47778

GetSimple CMS My SMTP Contact Plugin 1.1.2 - PHP Code Injection

GetSimple CMS My SMTP Contact Plugin 1.1.2 contains a PHP code injection vulnerability. An authenticated administrator can inject arbitrary PHP code through plugin configuration parameters, leading to remote code execution on the server.

CVSS 4.0 · 8.6 High EPSS 1.3% KEV · Not listed

Vendors

Get-simple Netexplorer

Products

Getsimplecms My Smtp Contact