Tag: 0day

[webapps] Kimai 1.14 – CSV Injection

[webapps] Montiorr 1.7.6m – File Upload to XSS

[dos] WordPress Plugin WPGraphQL 1.3.5 – Denial of Service

[webapps] Hasura GraphQL 1.3.3 – Remote Code Execution

[webapps] OpenPLC 3 – Remote Code Execution (Authenticated)

[webapps] SEO Panel 4.8.0 – 'order_col' Blind SQL Injection (2)

[webapps] Moodle 3.10.3 – 'url' Persistent Cross Site Scripting

[webapps] GetSimple CMS My SMTP Contact Plugin 1.1.2 – CSRF to Stored XSS to RCE

[webapps] DzzOffice 2.02.1 – 'Multiple' Cross-Site Scripting (XSS)

[webapps] Sipwise C5 NGCP CSC – 'Multiple' Stored/Reflected Cross-Site Scripting (XSS)