CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 2CVE-2023-0961 – SourceCodester Music Gallery Site GET Request view_music_details.php sql injection
https://notcve.org/view.php?id=CVE-2023-0961
A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been classified as critical. This affects an unknown part of the file view_music_details.php of the component GET Request Handler. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. • https://www.exploit-db.com/exploits/51290 https://github.com/navaidzansari/CVE_Demo/blob/main/2023/Music%20Gallery%20Site%20-%20SQL%20Injection%202.md https://vuldb.com/?ctiid.221631 https://vuldb.com/?id.221631 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 2CVE-2023-0938 – SourceCodester Music Gallery Site GET Request music_list.php sql injection
https://notcve.org/view.php?id=CVE-2023-0938
A vulnerability classified as critical has been found in SourceCodester Music Gallery Site 1.0. This affects an unknown part of the file music_list.php of the component GET Request Handler. The manipulation of the argument cid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. • https://www.exploit-db.com/exploits/51288 https://github.com/navaidzansari/CVE_Demo/blob/main/2023/Music%20Gallery%20Site%20-%20SQL%20Injection%201.md https://vuldb.com/?ctiid.221553 https://vuldb.com/?id.221553 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-0151 – uTubeVideo Gallery < 2.0.8 - Contributor+ Stored XSS
https://notcve.org/view.php?id=CVE-2023-0151
The uTubeVideo Gallery WordPress plugin before 2.0.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. The uTubeVideo Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 2.0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page • https://wpscan.com/vulnerability/d9fc6f5f-efc1-4e23-899b-e9a49330ed13 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-0060 – Responsive Gallery Grid < 2.3.9 - Contributor+ Stored XSS
https://notcve.org/view.php?id=CVE-2023-0060
The Responsive Gallery Grid WordPress plugin before 2.3.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. The Responsive Gallery Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 2.3.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page • https://wpscan.com/vulnerability/be2fc859-3158-4f06-861d-382381a7551b • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-4783 – Youtube Channel Gallery <= 2.4 - Contributor+ Stored XSS via Shortcode
https://notcve.org/view.php?id=CVE-2022-4783
The Youtube Channel Gallery WordPress plugin through 2.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks The Youtube Channel Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in versions up to, and including, 2.4 due to insufficient input sanitization and output escaping on user supplied attributes such as search_input_text. This makes it possible for authenticated attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page • https://wpscan.com/vulnerability/38e4c7fe-94d5-48b9-8659-e114cbbb4252 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •