Tag
#php
Fundraising Script version 1.0 suffers from a remote SQL injection vulnerability.
Blood Bank and Donor Management System version 2.2 suffers from a persistent cross site scripting vulnerability.
Kleeja version 1.5.4 suffers from a cross site scripting vulnerability.
K-LOANS version 1.4.5 suffers from an ignored default credential vulnerability.
The Leyka plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.30.3 via the 'leyka_ajax_get_env_and_options' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including Sberbank API key and password, PayPal Client Secret, and more keys and passwords.
The Login with phone number plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.8. This is due to missing nonce validation on the 'lwp_update_password_action' function. This makes it possible for unauthenticated attackers to change user password via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Cross Site Scripting vulnerability in WP Githuber MD plugin v.1.16.2 allows a remote attacker to execute arbitrary code via a crafted payload to the new article function.
Equipment Rental Script version 1.0 suffers from a remote SQL injection vulnerability.
Kolifa Download CMS version 1.2 suffers from an html injection vulnerability.