CVE-2021-24580

The Side Menu Lite WordPress plugin before 2.2.6 does not sanitise user input from the List page in the admin dashboard before using it in SQL statement, leading to a SQL Injection issue...

CVE-2021-24580

The Side Menu Lite WordPress plugin before 2.2.6 does not sanitise user input from the List page in the admin dashboard before using it in SQL statement, leading to a SQL Injection issue...

CVE-2021-24580 Side Menu Lite < 2.2.6 - Authenticated SQL Injection

The Side Menu Lite WordPress plugin before 2.2.6 does not sanitise user input from the List page in the admin dashboard before using it in SQL statement, leading to a SQL Injection issue...

PT-2021-22432 · Cachet · Cachet

Name of the Vulnerable Software and Affected Versions: Cachet versions prior to 2.5.1 Description: Cachet is an open source status page system. Authenticated users, regardless of their privileges, can leak the value of any configuration entry of the dotenv file, e.g. the application secret APP KE...

Contact Form 7 Zoho < 1.1.8 - Reflected Cross-Site Scripting

The plugin does not escape some of its filters before outputting them back in the admin dashboard, leading to Reflected Cross-Site Scripting issues PoC https://example.com/wp-admin/admin.php?page=vxcfzoho=logsdate="date="...

Contact Form Entries < 1.2.1 - Reflected Cross-Site Scripting

The plugin does not escape some of its filters before outputting them back in the admin dashboard, leading to Reflected Cross-Site Scripting issues PoC https://example.com/wp-admin/admin.php?page=vxcfleads=entriesdate="date="...

SMTP Mail < 1.2.2 - Authenticated SQL Injections

The plugin does not properly validate or escape the order and orderby parameters before using them in SQL statements, leading to SQL Injections in the admin dashboard PoC...

Recipe Card Blocks < 2.8.1 - Reflected Cross-Site Scripting

The plugin does not escape the message parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting issue PoC https://example.com/wp-admin/index.php?slactivation=false=%3Cscript%3Ealertorigin%3C%2Fscript%3E...

CVE-2021-24529

The Grid Gallery – Photo Image Grid Gallery WordPress plugin before 1.2.5 does not properly sanitize the title field for image galleries when adding them via the admin dashboard, resulting in an authenticated Stored Cross-Site Scripting vulnerability...

Cross site scripting

The Grid Gallery – Photo Image Grid Gallery WordPress plugin before 1.2.5 does not properly sanitize the title field for image galleries when adding them via the admin dashboard, resulting in an authenticated Stored Cross-Site Scripting vulnerability...

CVE-2021-24529

CVE-2021-24529 affects the WordPress plugin Grid Gallery – Photo Image Grid Gallery (versions before 1.2.5). The vulnerability is an authenticated stored Cross-Site Scripting (XSS) caused by improper sanitization of the gallery title when creating image galleries via the WordPress admin dashboard...

Wordpress Plugin Grid Gallery 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in the Wordpress...

MF Gig Calendar <= 1.1 - Reflected Cross-Site Scripting (XSS)

The plugin does not sanitise or escape the id GET parameter before outputting back in the admin dashboard when editing an Event, leading to a reflected Cross-Site Scripting issue PoC...

Smash Balloon Social Post Feed < 2.19.2 - Unauthenticated Stored XSS

The plugin does not sanitise or escape the feedID POST parameter in its feedlocator AJAX action available to both authenticated and unauthenticated users before outputting a truncated version of it in the admin dashboard, leading to an unauthenticated Stored Cross-Site Scripting issue which will ...

Email Artillery <= 4.1 - Multiple Authenticated SQL Injections

The plugin does not sanitise, validate or escape some user input before using it in SQL statements in the admin dashboard, leading to SQL Injections PoC https://example.com/wp-admin/admin.php?page=etmbu-all-posts=yesid=1%20AND%20SELECT%2042%20FROM%20SELECTSLEEP5aa...

Cross site scripting

TastyIgniter 3.0.7 allows XSS via /account, /reservation, /admin/dashboard, and /admin/systemlogs...

CVE-2021-38699

TastyIgniter 3.0.7 allows XSS via /account, /reservation, /admin/dashboard, and /admin/systemlogs...

Tastylgniter 跨站脚本漏洞

TastyIgniter is a free open source restaurant online ordering system based on Laravel PHP Framework. A cross-site scripting vulnerability exists in Tastylgniter 3.0.7, which originates from the lack of validation of user-submitted data in the /account, /reservation, /admin/dashboard, and...

Exploit for Cross-site Scripting in Tastyigniter

CVE-2021-38699 : Multiple Reflected XSS in TastyIgniter v3.0.7...

Software License Manager < 4.4.8 - Reflected Cross-Site Scripting

The plugin does not sanitise or escape the editrecord parameter before outputting it back in the page in the admin dashboard, leading to a Reflected Cross-Site Scripting issue PoC...