96 matches found
PHPGurukul Pre-School Enrollment System 注入漏洞
PHPGurukul Pre-School Enrollment System is a web-based preschool enrollment system from PHPGurukul, Inc. An injection vulnerability exists in version 1.0 of the PHPGurukul Pre-School Enrollment System, which stems from the fact that incorrect manipulation of the parameters classname/capacity can...
CVE-2024-5424: Improper Neutralization of Input During Web Page Generation
The Gallery Blocks with Lightbox. Image Gallery, HTML5 video , YouTube, Vimeo Video Gallery and Lightbox for native gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘galleryID’ and 'className' parameters in all versions up to, and including, 3.2.1 due to...
CVE-2024-3747
The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the className parameter in the About Me block in all versions up to, and including, 2.0.39 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2024-3747
The CVE-2024-3747 issue affects Blocksy Theme for WordPress (versions up to 2.0.39). It is a Stored XSS in the About Me block via the className parameter, exploitable by authenticated users with Contributor+ privileges. The vulnerability arises from insufficient input sanitization and output esca...
CVE-2024-3747: Improper Input Validation
The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the className parameter in the About Me block in all versions up to, and including, 2.0.39 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2024-2170: Improper Neutralization of Input During Web Page Generation
The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the child page index widget in all versions up to, and including, 9.96.0.1 due to insufficient input sanitization and output escaping on user supplied attributes such as 'className.' This makes ...
CVE-2024-2124: Improper Neutralization of Input During Web Page Generation
The Translate WordPress and go Multilingual – Weglot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget/block in all versions up to, and including, 4.2.5 due to insufficient input sanitization and output escaping on user supplied attributes such as...
CVE-2024-1767: Improper Neutralization of Input During Web Page Generation
The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocks in all versions up to, and including, 2.0.26 due to insufficient input sanitization and output escaping on user supplied attributes like 'className' and 'radius'. This makes it possible for...
CVE-2023-2433
The YARPP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'className' parameter in versions up to, and including, 5.30.3 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers to inject arbitrary web scripts in page...
CVE-2023-2433
The YARPP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'className' parameter in versions up to, and including, 5.30.3 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers to inject arbitrary web scripts in page...
CVE-2023-2433
The YARPP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'className' parameter in versions up to, and including, 5.30.3 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers to inject arbitrary web scripts in page...
CVE-2023-2433: Improper Neutralization of Input During Web Page Generation
The YARPP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'className' parameter in versions up to, and including, 5.30.3 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers to inject arbitrary web scripts in page...
PT-2023-19525 · WordPress · Yarpp
Name of the Vulnerable Software and Affected Versions: YARPP plugin for WordPress versions up to, and including, 5.30.3 Description: The issue arises from insufficient input sanitization and output escaping, allowing contributor-level attackers to inject arbitrary web scripts via the className...
WordPress Plugin YARPP 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress...
Student Attendance Management System Cross-Site Scripting Vulnerability
Student Attendance Management System is a student attendance management system. The vulnerability is caused by the lack of effective filtering and escaping of user-supplied data in the className parameter of the createClass.php file, which can be exploited to cause cross-site scripting attacks...
CVE-2022-4053 Student Attendance Management System createClass.php cross site scripting
A vulnerability was found in Student Attendance Management System. It has been classified as problematic. Affected is an unknown function of the file createClass.php. The manipulation of the argument className leads to cross site scripting. It is possible to launch the attack remotely. The exploi...
PT-2022-25411 · Unknown · Attendance Management System
Name of the Vulnerable Software and Affected Versions: Student Attendance Management System affected versions not specified Description: A vulnerability was found in the Student Attendance Management System, classified as problematic. It affects an unknown function of the file createClass.php. Th...
CVE-2022-4053: Improper Neutralization
A vulnerability was found in Student Attendance Management System. It has been classified as problematic. Affected is an unknown function of the file createClass.php. The manipulation of the argument className leads to cross site scripting. It is possible to launch the attack remotely. The exploi...
Typesetter cross-site scripting vulnerability (CNVD-2021-49146)
Typesetter is an open source CMS written in PHP with True WYSIWYG editing and flat file storage. Typesetter suffers from a cross-site scripting vulnerability. The vulnerability can be exploited to conduct cross-site scripting attacks via the className and Description fields in...