Threat database

43 threats

Threat database
Severity	CVSS	Signals	Threat	Source	Published
Medium	6.4	EPSS 0.3%	CVE-2024-3672BA Book Everything · Cross-site Scripting Medium6.4EPSS 0.3%2024-04-16CVE Database V5CVE-2024-3672 The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'all-items' shortcode in all versions up to, and including, 1.6.8 due to insufficient input sanitization and output escaping on user supplied attributes such as 'classes'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-32576 is likely a duplicate of this issue. EPSS 0.3%Vulnerability bookingalgorithms #cwe-79	CVE Database V5	2024-04-16
High	8.5	EPSS 0.6%	CVE-2024-32125BA Book Everything · SQL Injection High8.5EPSS 0.6%2024-04-15CVE Database V5CVE-2024-32125 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Booking Algorithms BA Book Everything.This issue affects BA Book Everything: from n/a through 1.6.4. EPSS 0.6%Vulnerability Booking Algorithms #cwe-89	CVE Database V5	2024-04-15
Medium	5.9	EPSS 0.3%	CVE-2023-46595Algosec FireFlow · Cross-site Scripting Medium5.9EPSS 0.3%2023-11-02CVE Database V5CVE-2023-46595 Net-NTLM leak via HTML injection in FireFlow VisualFlow workflow editor allows an attacker to obtain victim’s domain credentials and Net-NTLM hash which can lead to relay domain attacks. Fixed in A32.20 (b570 or above), A32.50 (b390 or above) EPSS 0.3%Vulnerability Algosec #cwe-79	CVE Database V5	2023-11-02

Showing 41–43 of 43 results