WordPress WP-UserOnline plugin versions 2.87.6 and below suffer from a persistent cross site scripting vulnerability.

Transposh WordPress Translation versions 1.0.7 and below have an ajax action “tp_tp” that is vulnerable to an unauthenticated/authenticated reflected cross site scripting vulnerability when user-supplied input to the HTTP GET parameter “q” is processed by the web application. Since the application does not properly validate and sanitize this parameter, it is possible to place arbitrary […]

Transposh WordPress Translation versions 1.0.7 and below have an ajax action “tp_translation” which is available to authenticated or unauthenticated users (see CVE-2022-2461) that allows them to submit new translations. Translations submitted this way are shown on the Transposh administrative interface on the pages “tp_main” and “tp_editor”. However, since the plugin does not properly validate and […]

Dingtian-DT-R002 version 3.1.276A suffers from an authentication bypass vulnerability.

Transposh WordPress Translation versions 1.0.7 and below suffer from an incorrect authorization vulnerability. When installed, Transposh comes with a set of pre-configured options, one of these is the “Who can translate” setting under the “Settings” tab, which by default allows “Anonymous” users to add translations via the plugin’s “tp_translation” ajax action. Successful exploits can allow […]

rpc.py version 0.6.0 suffers from a remote code execution vulnerability.

Transposh WordPress Translation versions 1.0.8.1 and below suffer from cross site request forgery vulnerabilities.

Crime Reporting System version 1.0 suffers from a persistent cross site scripting vulnerability.

Transposh WordPress Translation versions 1.0.8.1 and below have an ajax action called “tp_history” which is intended to return data about who has translated a text given by the “token” parameter. However, the plugin also returns the user’s login name as part of the “user_login” attribute. Successful exploits can allow an unauthenticated attacker to leak the […]

Geonetwork versions 3.1.x through 4.2.0 suffer from an XML external entity injection vulnerability.