Vulnerabilidades

A security vulnerability has been detected in Campcodes Supplier Management System 1.0. This impacts an unknown function of the file /index.php of the component Login. Such manipulation of the argument txtUsername leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed…

The Booking Calendar Contact Form plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.2.60. This is due to missing authorization checks and payment verification in the `dex_bccf_check_IPN_verification` function. This makes it possible for unauthenticated attackers to…

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Prior to version 3.26.7, Due to an error in validation it was possible for Roo to automatically execute commands that did not match the allow list prefixes. This issue has been patched in version 3.26.7.

Missing Authorization vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Arconix Shortcodes: from n/a through <= 2.1.18.

Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through <= 1.2.47.

El plugin Shortcode for Google Street View para WordPress es vulnerable a cross-site scripting almacenado a través del shortcode 'streetview' en todas las versiones hasta la 0.5.7, inclusive. Esto se debe a una sanitización de entrada insuficiente y un escape de salida en el atributo 'id'. Esto hace posible que…

El plugin WPSite Shortcode para WordPress es vulnerable a cross-site scripting almacenado a través del atributo de shortcode 'format' en el shortcode wpsite_y y el atributo 'before' en el shortcode wpsite_postauthor en todas las versiones hasta la 1.2, inclusive. Esto se debe a una sanitización de entrada insuficiente…

El plugin de shortcode Pollcaster para WordPress es vulnerable a cross-site scripting almacenado a través del parámetro 'height' en el shortcode 'pollcaster' en todas las versiones hasta la 1.0, e incluyendo esta. Esto se debe a una sanitización de entrada y un escape de salida insuficientes en los atributos…

El plugin Padlet Shortcode para WordPress es vulnerable a cross-site scripting almacenado a través del parámetro 'key' en el shortcode 'wallwisher' en todas las versiones hasta la 1.3, inclusive. Esto se debe a una sanitización de entrada insuficiente y un escape de salida inadecuado en los atributos proporcionados…

El plugin Bulma Shortcodes para WordPress es vulnerable a cross-site scripting almacenado a través del atributo de shortcode 'type' en el shortcode bulma-notification en todas las versiones hasta la 1.0, inclusive. Esto se debe a una sanitización de entrada insuficiente y un escape de salida inadecuado. Esto hace…

El plugin Surbma | MiniCRM Shortcode para WordPress es vulnerable a cross-site scripting almacenado a través del atributo de shortcode 'id' del shortcode 'minicrm' en todas las versiones hasta la 2.0, inclusive. Esto se debe a una sanitización de entrada insuficiente y un escape de salida insuficiente. Esto permite…

El plugin BrightTALK WordPress Shortcode para WordPress es vulnerable a cross-site scripting almacenado a través del atributo 'format' del shortcode en el shortcode brighttalk-time en todas las versiones hasta la 2.4.0, inclusive. Esto se debe a una sanitización de entrada insuficiente y un escape de salida…

El plugin Tips Shortcode para WordPress es vulnerable a cross-site scripting almacenado a través del shortcode 'tip' en todas las versiones hasta la 0.2.1, inclusive. Esto se debe a una sanitización de entrada y un escape de salida insuficientes. Esto permite a atacantes autenticados, con acceso de nivel de…

El plugin Shortcodes Bootstrap para WordPress es vulnerable a cross-site scripting almacenado a través del parámetro 'type' en el shortcode [notification] en todas las versiones hasta la 1.1, inclusive. Esto se debe a la falta de saneamiento de entrada y escape de salida. Esto permite a atacantes autenticados, con…

El plugin Display Pages Shortcode para WordPress es vulnerable a cross-site scripting almacenado a través del parámetro 'column_count' en el shortcode [display-pages] en todas las versiones hasta la 1.1, inclusive. Esto se debe a una sanitización de entrada y un escape de salida insuficientes. Esto permite a atacantes…

Claude Code is an agentic coding tool. Prior to version 2.0.31, due to an error in sed command parsing, it was possible to bypass the Claude Code read-only validation and write to arbitrary files on the host system. This issue has been patched in version 2.0.31.

Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network.

A vulnerability was identified in Campcodes Complete Online Beauty Parlor Management System 1.0. This vulnerability affects unknown code of the file /admin/customer-list.php. The manipulation of the argument Name leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and…

A vulnerability has been found in Campcodes Supplier Management System 1.0. This affects an unknown function of the file /admin/add_product.php. The manipulation of the argument txtProductName leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be…

A flaw has been found in Campcodes Retro Basketball Shoes Online Store 1.0. The impacted element is an unknown function of the file /admin/admin_product.php. Executing a manipulation of the argument product_image can lead to unrestricted upload. The attack may be launched remotely. The exploit has been published and…

Campcodes Online Hospital Management System 1.0 is vulnerable to SQL Injection in /admin/index.php via the parameter username.

A vulnerability was determined in Campcodes Retro Basketball Shoes Online Store 1.0. Affected by this issue is some unknown functionality of the file /admin/admin_running.php. Executing a manipulation of the argument product_name can lead to cross site scripting. The attack may be performed from remote. The exploit…

A vulnerability was found in Campcodes Retro Basketball Shoes Online Store 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/admin_football.php. Performing a manipulation of the argument product_image results in unrestricted upload. The attack is possible to be carried out remotely.…

A vulnerability has been found in Campcodes Retro Basketball Shoes Online Store 1.0. Affected is an unknown function of the file /admin/receipt.php. Such manipulation of the argument tid leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.9.5, an authenticated SQL Injection vulnerability in the API allows any user, regardless of permission level, to execute arbitrary SQL queries. By manipulating the display parameter in an API request, an…