An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retrieve files from the groupware's shared file feature.

A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a user who accesses a website using the affected product.

Checkov by Prisma Cloud: OS Command Injection Vulnerability

Checkov by Prisma Cloud: Code Execution via Auto-Loaded Configuration File

Cortex XDR Broker VM: Privilege Escalation Vulnerability

Site Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Injection via Form Signature

Registration Form for WooCommerce 1.1.0 - 1.1.2 - Contributor+ Privilege Escalation via Unvalidated tgwcfb_id

zipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 - Unauthenticated Arbitrary Option Deletion

miniOrange 2FA (Free & Pro) - 2FA Bypass via Session-Scoped OTP Lockout

miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator