7306 matches found
CVE-2023-32596
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Wolfgang Ertl weebotLite plugin = 1.0.0 versions...
CVE-2023-32595
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Palasthotel by Edward Bock, Katharina Rompf Sunny Search plugin = 1.0.2 versions...
CVE-2023-32575
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in PI Websolution Product page shipping calculator for WooCommerce plugin = 1.3.25 versions...
PT-2023-23900 · Unknown · Weebotlite
Name of the Vulnerable Software and Affected Versions: weebotLite plugin versions prior to 1.0.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects the weebotLite plugin. This vulnerability requires authentication with admin+ privileges...
PT-2023-23590
Name of the Vulnerable Software and Affected Versions Netmaker versions prior to 0.17.1 Netmaker versions 0.18.0 through 0.18.5 Description A Mass assignment vulnerability was found in Netmaker that allows a non-admin user to escalate privileges to those of an admin user. The issue is patched in...
CVE-2023-32498
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Easy Form team Easy Form by AYS plugin = 1.2.0 versions...
FTP Access <= 1.0 - Subscriber+ Stored XSS
Description The plugin does not have authorisation and CSRF checks when updating its settings and is missing sanitisation as well as escaping in them, allowing any authenticated users, such as subscriber to update them with XSS payloads, which will be triggered when an admin will view the setting...
CVE-2023-31232
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in David Artiss Plugins List plugin = 2.5 versions...
CVE-2023-28690
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Marco Steinbrecher WP BrowserUpdate plugin = 4.5 versions...
CVE-2023-31091
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Pradeep Singh Dynamically Register Sidebars plugin = 1.0.1 versions...
CVE-2023-3266
A non-feature complete authentication mechanism exists in the production application allowing an attacker to bypass all authentication checks if LDAP authentication is selected.An unauthenticated attacker can leverage this vulnerability to log in to the CypberPower PowerPanel Enterprise as an...
CVE-2023-30477: Improper Neutralization of Input During Web Page Generation
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Essitco AFFILIATE Solution plugin = 1.0 versions...
PT-2023-22954 · WordPress · Icontrolwp Article Directory Redux
Name of the Vulnerable Software and Affected Versions: iControlWP Article Directory Redux plugin versions 1.0.2 and earlier Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin access can inject malicious scrip...
Advanced File Manager < 5.1.1 - Admin+ Arbitrary File/Folder Access
Description The plugin does not adequately authorize its usage on multisite installations, allowing site admin users to list and read arbitrary files and folders on the server. On a multisite installation, log in as a site admin. Notice that you are able to manage files on the server using this...
Design/Logic Flaw
A vulnerability has been identified within Serv-U 15.4 that, if exploited, allows an actor to bypass multi-factor/two-factor authentication. The actor must have administrator-level access to Serv-U to perform this action...
CVE-2023-35179 2FA/MFA Bypass Vulnerability in Serv-U 15.4
A vulnerability has been identified within Serv-U 15.4 that, if exploited, allows an actor to bypass multi-factor/two-factor authentication. The actor must have administrator-level access to Serv-U to perform this action...
CVE-2023-37388
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Sudipto Pratap Mahato Simple Light Weight Social Share plugin = 2.0 versions...
CVE-2023-36530
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Smartypants SP Project & Document Manager plugin = 4.67 versions...