CVE-2017-17775

Piwigo 2.9.2 has XSS via the name parameter in an admin.php?page=album-3-properties request...

CVE-2017-17775

Piwigo 2.9.2 is vulnerable to a cross-site scripting (XSS) flaw triggered by the name parameter in an admin.php?page=album-3-properties request. The issue affects the web-based photo gallery software as described in CVE-2017-17775; details in connected records confirm the vulnerability class and ...

CVE-2017-17775: Improper Neutralization of Input During Web Page Generation

Piwigo 2.9.2 has XSS via the name parameter in an admin.php?page=album-3-properties request...

PT-2017-14997

Name of the Vulnerable Software and Affected Versions Clockwork Free and Paid SMS Notifications versions 2.0.3 Two-Factor Authentication - Clockwork SMS version 1.0.2 Booking Calendar - Clockwork SMS version 1.0.5 Contact Form 7 - Clockwork SMS version 2.3.0 Fast Secure Contact Form - Clockwork S...

PT-2017-14992

Name of the Vulnerable Software and Affected Versions Piwigo version 2.9.2 Description The issue allows for XSS via the name parameter in an "admin.php?page=album-3-properties" request. Recommendations For Piwigo version 2.9.2, avoid using the name parameter in the...

CVE-2017-17780: Improper Neutralization of Input During Web Page Generation

The Clockwork SMS clockwork-test-message.php component has XSS via a crafted "to" parameter in a clockwork-test-message request to wp-admin/admin.php. This component code is found in the following WordPress plugins: Clockwork Free and Paid SMS Notifications 2.0.3, Two-Factor Authentication -...

CVE-2017-16904

The Public tologin feature in admin.php in LvyeCMS through 3.1 allows XSS via a crafted username that is mishandled during later log viewing by an administrator...

Cross site scripting

The Public tologin feature in admin.php in LvyeCMS through 3.1 allows XSS via a crafted username that is mishandled during later log viewing by an administrator...

CVE-2017-16904

The CVE concerns LvyeCMS (admin.php, Public tologin) up to version 3.1 where a crafted username enables cross-site scripting. The underlying cause is mishandling of the username during admin log viewing, allowing an attacker to inject Web script/HTML that is executed in an administrator’s view. S...

CVE-2017-16904

The Public tologin feature in admin.php in LvyeCMS through 3.1 allows XSS via a crafted username that is mishandled during later log viewing by an administrator...

PT-2017-14631

Name of the Vulnerable Software and Affected Versions LvyeCMS versions prior to 3.1 Description The issue concerns the Public tologin feature in admin.php, which allows for XSS attacks through a crafted username that is mishandled during later log viewing by an administrator. Recommendations For...

CVE-2017-16904: Improper Neutralization of Input During Web Page Generation

The Public tologin feature in admin.php in LvyeCMS through 3.1 allows XSS via a crafted username that is mishandled during later log viewing by an administrator...

PT-2017-14608 · WordPress · Updraftplus

Name of the Vulnerable Software and Affected Versions: UpdraftPlus plugin versions 1.13.12 and earlier Description: The issue allows remote PHP code execution due to a race condition in the plupload action function before deleting a file associated with the name parameter in...

PT-2017-14607 · WordPress · Updraftplus

Name of the Vulnerable Software and Affected Versions: UpdraftPlus plugin versions 1.13.12 and earlier Description: The issue concerns a Server-Side Request Forgery SSRF in the updraft ajax handler function, located in /wp-content/plugins/updraftplus/admin.php, which can be exploited via an httpg...

CVE-2017-16871: Improper Control of Generation of Code

The UpdraftPlus plugin through 1.13.12 for WordPress allows remote PHP code execution because the pluploadaction function in /wp-content/plugins/updraftplus/admin.php has a race condition before deleting a file associated with the name parameter. NOTE: the vendor reports that this does not cross ...

CVE-2017-16870: Server-Side Request Forgery (SSRF)

The UpdraftPlus plugin through 1.13.12 for WordPress has SSRF in the updraftajaxhandler function in /wp-content/plugins/updraftplus/admin.php via an httpget subaction. NOTE: the vendor reports that this does not cross a privilege boundary...

CVE-2017-15810

The PopCash.Net Code Integration Tool plugin before 1.1 for WordPress has XSS via the tab parameter to wp-admin/admin.php...

PT-2017-14240

Name of the Vulnerable Software and Affected Versions PopCash.Net Code Integration Tool plugin version prior to 1.1 Description The issue allows for XSS via the tab parameter to "wp-admin/admin.php". Recommendations For versions prior to 1.1, update to version 1.1 or later to resolve the issue...

CVE-2017-15810: Improper Neutralization of Input During Web Page Generation

The PopCash.Net Code Integration Tool plugin before 1.1 for WordPress has XSS via the tab parameter to wp-admin/admin.php...

Cross site scripting

Cross-site scripting XSS vulnerability in Best Gallery Albums Plugin before 3.0.70for WordPress allows remote attackers to inject arbitrary web script or HTML via the orderid parameter in the galleryalbumsorting page to wp-admin/admin.php...