AppCheck

Latest CVEs · RSS

• CVE-2024-29833 2024-03-26 · CVSS 5.4
  The image upload component allows SVG files and the regular expression used to remove script tags can be bypassed by using a Cross Site Scripting payload which
• CVE-2024-29810 2024-03-26 · CVSS 5.4
  The thumb_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the thumb_u
• CVE-2024-29809 2024-03-26 · CVSS 5.4
  The image_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the image_u
• CVE-2024-29808 2024-03-26 · CVSS 5.4
  The image_id parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the image_id
• CVE-2024-29832 2024-03-26 · CVSS 6.1
  The current_url parameter of the AJAX call to the GalleryBox action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the current_
• CVE-2023-41137 2023-11-09 · CVSS 8.0
  Symmetric encryption used to protect messages between the AppsAnywhere server and client can be broken by reverse engineering the client and used to impersonate
• CVE-2023-41138 2023-11-09 · CVSS 7.5
  The AppsAnywhere macOS client-privileged helper can be tricked into executing arbitrary commands with elevated permissions by a local user process.
• CVE-2021-40186 2022-05-31 · CVSS 6.5
  The AppCheck research team identified a Server-Side Request Forgery (SSRF) vulnerability within the DNN CMS platform, formerly known as DotNetNuke. SSRF vulnera
• CVE-2022-22690 2022-01-18 · CVSS 8.6
  Within the Umbraco CMS, a configuration element named "UmbracoApplicationUrl" (or just "ApplicationUrl") is used whenever application code needs to build a URL
• CVE-2022-22691 2022-01-18 · CVSS 6.8
  The password reset component deployed within Umbraco uses the hostname supplied within the request host header when building a password reset URL. It may be pos
• CVE-2021-43991 2021-12-03 · CVSS 6.8
  The Kentico Xperience CMS version 13.0 – 13.0.43 is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability (also known as Stored or Second-Order XS
• CVE-2021-43408 2021-11-19 · CVSS 6.5
  The "Duplicate Post" WordPress plugin up to and including version 1.1.9 is vulnerable to SQL Injection. SQL injection vulnerabilities occur when client supplied
• CVE-2021-43409 2021-11-19 · CVSS 9.3
  The “WPO365 | LOGIN” WordPress plugin (up to and including version 15.3) by wpo365.com is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability (a