An issue in phpkobo AjaxNewsTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the reque parameter. CVSSv3.1 9.8 (CRITICAL) · EPSS 71th percentile
Volatility 3 version 2.5.0 released with new Linux capabilities plugin, Linux process dumping support, Xen ELF file format support, and improved Linux subsystem support. Release includes documentation tutorials and core API improvements.
Authorization Bypass Through User-Controlled Key vulnerability in Usta AYBS allows Authentication Abuse, Authentication Bypass. This issue affects AYBS: before 1.0.3. CVSSv3.1 8.8 (HIGH) · EPSS 22th percentile
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hedef Tracking Admin Panel allows SQL Injection. This issue affects Admin Panel: before 1.2. CVSSv3.1 9.8 (CRITICAL) · EPSS 37th percentile
DedeBIZ v6.2.11 was discovered to contain multiple remote code execution (RCE) vulnerabilities at /admin/file_manage_control.php via the $activepath and $filename parameters. CVSSv3.1 9.8 (CRITICAL) · EPSS 59th percentile
The issue was addressed with improved checks. This issue is fixed in tvOS 17, Safari 17, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content may lead to arbitrary code execution. CVSSv3.1 8.8 (HIGH)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MRV Tech Logging Administration Panel allows SQL Injection.This issue affects Logging Administration Panel: before 20230915 . CVSSv3.1 9.8 (CRITICAL) · EPSS 38th percentile
A Cross-Site Request Forgery (CSRF) in admin_manager.php of Seacms up to v12.8 allows attackers to arbitrarily add an admin account. CVSSv3.1 8.8 (HIGH) · EPSS 20th percentile
TOTOLINK A3700R V9.1.2u.6134_B20201202 and N600R V5.3c.5137 are vulnerable to Incorrect Access Control. CVSSv3.1 9.8 (CRITICAL) · EPSS 48th percentile
SQL injection vulnerability in updatepos.php in PrestaShop opartfaq through 1.0.3 allows remote attackers to run arbitrary SQL commands via unspedified vector. CVSSv3.1 9.8 (CRITICAL) · EPSS 44th percentile
SQL injection vulnerability in PrestaShop opartsavecart through 2.0.7 allows remote attackers to run arbitrary SQL commands via OpartSaveCartDefaultModuleFrontController::initContent() and OpartSaveCartDefaultModuleFrontController::displayAjaxSendCartByEmail() methods. CVSSv3.1 9.8 (CRITICAL) · EPSS 51th percentile
A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service. CVSSv3.1 8.1 (HIGH) · EPSS 66th percentile
Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the REST API module, related to analyseVarsForSqlAndScriptsInjection and testSqlAndScriptInject. CVSSv3.1 9.6 (CRITICAL) · EPSS 64th percentile
File Upload vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to execute arbitrary code and obtain sensitive information via the extension filtering and renaming functions. CVSSv3.1 8.8 (HIGH) · EPSS 68th percentile
An issue in Dolibarr ERP CRM v.17.0.1 and before allows a remote privileged attacker to execute arbitrary code via a crafted command/script. CVSSv3.1 7.2 (HIGH) · EPSS 98th percentile
A SQL injection vulnerability in Nagios XI v5.11.1 and below allows authenticated attackers with announcement banner configuration privileges to execute arbitrary SQL commands via the ID parameter sent to the update_banner_message() function. CVSSv3.1 8.8 (HIGH) · EPSS 92th percentile
A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in the POST request to /nagiosxi/admin/banner_message-ajaxhelper.php CVSSv3.1 6.5 (MEDIUM) · EPSS 96th percentile
The Allow PHP in Posts and Pages plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.0.4 via the 'php' shortcode. This allows authenticated attackers with subscriber-level permissions or above, to execute code on the server. CVSSv3.1 9.9 (CRITICAL) · EPSS 79th percentile
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CF Software Oil Management Software allows SQL Injection. This issue affects Oil Management Software: before 20230912 . CVSSv3.1 9.8 (CRITICAL) · EPSS 34th percentile
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Besttem Network Marketing Software allows SQL Injection. This issue affects Network Marketing Software: before 1.0.2309.6. CVSSv3.1 9.8 (CRITICAL) · EPSS 34th percentile
Incorrect Execution-Assigned Permissions vulnerability in Saphira Saphira Connect allows Privilege Escalation. This issue affects Saphira Connect: before 9. CVSSv3.1 8.8 (HIGH) · EPSS 68th percentile
Incorrect Default Permissions vulnerability in Saphira Saphira Connect allows Privilege Escalation. This issue affects Saphira Connect: before 9. CVSSv3.1 8.8 (HIGH) · EPSS 36th percentile
Execution with Unnecessary Privileges vulnerability in Saphira Saphira Connect allows Remote Code Inclusion. This issue affects Saphira Connect: before 9. CVSSv3.1 9.8 (CRITICAL) · EPSS 73th percentile
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saphira Saphira Connect allows SQL Injection. This issue affects Saphira Connect: before 9. CVSSv3.1 9.8 (CRITICAL) · EPSS 40th percentile
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Innosa Probbys allows SQL Injection. This issue affects Probbys: before 2. CVSSv3.1 9.8 (CRITICAL) · EPSS 34th percentile