The WordPress LayerSlider Plugin installed on the remote host is affected by an SQL Injection.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.39, 7.0.x prior to 7.0.33, 7.1.x prior to 7.1.25, 7.2.x prior to 7.2.13 or 7.3.x prior to 7.3.0. It is, therefore, affected by multiple vulnerabilities:

 - An arbitrary command injection vulnerability exists in the imap_open function due to improper filters for mailbox names prior to passing them to rsh or ssh commands. An authenticated, remote attacker can exploit this by sending a specially crafted IMAP server name to cause the execution of arbitrary commands on the target system. (CVE-2018-19518)

 - A heap buffer over-read exists in the phar_parse_pharfile function. An unauthenticated, remote attacker can exploit this to read allocated or unallocated memory past the actual data when trying to parse a .phar file. (CVE-2018-20783)

 - A NULL pointer dereference on Windows. An unauthenticated, remote attacker can exploit this to crash the application and perform a denial of service. (CVE-2018-19395)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Apache Struts 2.x to 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted 'action:', 'redirect:', or 'redirectAction:' prefix.

This mechanism was intended to help with attaching navigational information to buttons within forms.

ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol or the password reset feature. For example, an unauthenticated attacker can perform character-by-character retrieval of password hashes, or retrieve a session token or a private key.

The version of CraftCMS installed on the remote host is vulnerable to a Remote Code Execution (RCE) in the action endpoint.

According to its self-reported version number, the Atlassian Bitbucket application running on the remote host is affected by a command injection vulnerability. A remote attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and Data Center instance has enabled "Allow public signup".

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

CrushFTP versions prior to 10.7.1 and 11.x < 11.1.0 are vulnerable to a "VFS Sandbox Escape" allowing a remote attacker with low privileges to read files from the file system outside the sandbox.

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities :

 - An XML External Entity (XXE) vulnerability exists in the media library affecting PHP 8.

 - A data exposure vulnerability exists in the REST API.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
114258	LayerSlider Plugin for WordPress 7.9.11 < 7.10.1 SQL Injection	Web App Scanning	Component Vulnerability	4/12/2024	4/12/2024	high
98880	PHP 5.6.x < 5.6.39 Multiple vulnerabilities	Web App Scanning	Component Vulnerability	1/31/2019	6/1/2023	high
98881	PHP 7.0.x < 7.0.33 Multiple vulnerabilities	Web App Scanning	Component Vulnerability	1/31/2019	6/1/2023	high
98883	PHP 7.2.x < 7.2.13 Multiple vulnerabilities	Web App Scanning	Component Vulnerability	1/31/2019	6/1/2023	high
112741	Apache Struts 2.x < 2.3.15.1 Remote Code Execution (S2-016)	Web App Scanning	Component Vulnerability	4/12/2021	9/7/2021	critical
112973	ForgeRock OpenAM LDAP Injection	Web App Scanning	Component Vulnerability	9/13/2021	9/13/2021	high
114030	CraftCMS < 4.4.15 Remote Code Execution	Web App Scanning	Component Vulnerability	9/20/2023	10/5/2023	critical
113440	Atlassian Bitbucket 7.7.x < 7.17.12 Command Injection	Web App Scanning	Component Vulnerability	11/24/2022	3/14/2023	critical
113441	Atlassian Bitbucket 7.18.x < 7.21.6 Command Injection	Web App Scanning	Component Vulnerability	11/24/2022	3/14/2023	critical
114273	CrushFTP < 10.7.1 / 11.x < 11.1.0 VFS Sandbox Escape	Web App Scanning	Component Vulnerability	4/23/2024	4/24/2024	critical
112754	WordPress 5.7.x < 5.7.1 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	4/16/2021	3/14/2023	medium

Detections

Analytics

Plugins Search

high

high

high

high

critical

high

critical

critical

critical

critical

medium