CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 1CVE-2023-26860
https://notcve.org/view.php?id=CVE-2023-26860
10 Apr 2023 — SQL injection vulnerability found in PrestaShop Igbudget v.1.0.3 and before allow a remote attacker to gain privileges via the LgBudgetBudgetModuleFrontController::displayAjaxGenerateBudget component. • https://addons.prestashop.com/en/order-management/45282-save-your-carts-and-buy-later-or-send-it.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-0143 – Send PDF for Contact Form 7 < 0.9.9.2 - Contributor+ Stored XSS via Shortcode
https://notcve.org/view.php?id=CVE-2023-0143
11 Jan 2023 — The Send PDF for Contact Form 7 WordPress plugin before 0.9.9.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. The Send PDF for Contact Form 7 for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 0.9.9.1 due to insuffi... • https://wpscan.com/vulnerability/c4cd3d98-9678-49cb-9d1a-551ef8a810b9 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2015-8859
https://notcve.org/view.php?id=CVE-2015-8859
23 Jan 2017 — The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors. El paquete send en versiones anteriores a 0.11.1 para Node.js permite a atacantes obter la ruta de root a través de vectores no especificados. • http://www.openwall.com/lists/oss-security/2016/04/20/11 •