Sql injection

Explore CMS v1.0 was discovered to contain a SQL injection vulnerability via a /page.php?id= request...

CVE-2022-27412

Explore CMS v1.0 was discovered to contain a SQL injection vulnerability via a /page.php?id= request...

CVE-2022-27412: Improper Neutralization of Special Elements used in an SQL Command

Explore CMS v1.0 was discovered to contain a SQL injection vulnerability via a /page.php?id= request...

PT-2022-17692

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 2.25.3 Description An issue was discovered in MantisBT, where improper escaping of a Plugin name allows execution of arbitrary code in manage plugin page.php and manage plugin uninstall.php when a crafted plugin is...

CVE-2022-0653

The Profile Builder – User Profile & User Registration Forms WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the siteurl parameter found in the /assets/misc/fallback-page.php file which allows attackers to inject arbitrary web scripts onto a...

CVE-2022-0653: Improper Neutralization of Input During Web Page Generation

The Profile Builder – User Profile & User Registration Forms WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the siteurl parameter found in the /assets/misc/fallback-page.php file which allows attackers to inject arbitrary web scripts onto a...

PT-2022-13332

Name of the Vulnerable Software and Affected Versions The Profile Builder – User Profile & User Registration Forms WordPress plugin versions up to and including 3.6.1 Description The issue arises from insufficient escaping and sanitization of the site url parameter found in the...

PT-2022-16541

Name of the Vulnerable Software and Affected Versions eliteCMS version 1.0 Description The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the "/admin/edit page.php" API endpoint. Recommendations For eliteCMS version 1.0, consider restricting access to t...

CVE-2022-0232

The User Registration, Login & Landing Pages WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the loadertext parameter found in the /includes/templates/landing-page.php file which allows attackers with administrative user access to inject arbitrary we...

CVE-2022-0232: Improper Neutralization of Input During Web Page Generation

The User Registration, Login & Landing Pages WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the loadertext parameter found in the /includes/templates/landing-page.php file which allows attackers with administrative user access to inject arbitrary we...

PT-2022-13051

Name of the Vulnerable Software and Affected Versions User Registration, Login & Landing Pages WordPress plugin versions up to and including 1.2.7 Description The issue is related to Stored Cross-Site Scripting due to insufficient escaping via the loader text parameter found in the...

CVE-2021-42367

The Variation Swatches for WooCommerce WordPress plugin is vulnerable to Stored Cross-Site Scripting via several parameters found in the /includes/class-menu-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.1.1. Due to missing authorization...

CVE-2021-42367: Improper Neutralization of Input During Web Page Generation

The Variation Swatches for WooCommerce WordPress plugin is vulnerable to Stored Cross-Site Scripting via several parameters found in the /includes/class-menu-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.1.1. Due to missing authorization...

PT-2021-20604

Name of the Vulnerable Software and Affected Versions: The Countdown and CountUp, WooCommerce Sales Timers WordPress plugin versions up to and including 1.5.7 Description: The issue is related to Cross-Site Request Forgery, which occurs due to a missing nonce check in the save theme function foun...

PT-2021-22074

Name of the Vulnerable Software and Affected Versions GNU-Mailman Integration WordPress plugin versions up to and including 1.0.6 Description The GNU-Mailman Integration WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the gm error parameter found in the...

CVE-2021-38354: Improper Neutralization of Input During Web Page Generation

The GNU-Mailman Integration WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the gmerror parameter found in the /includes/admin/mailing-lists-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.6...

Cross site scripting

The Custom Post Type Relations WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the cptrname parameter found in the /pages/admin-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0...

CVE-2021-34654 Custom Post Type Relations <= 1.0 Reflected Cross-Site Scripting

The Custom Post Type Relations WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the cptrname parameter found in the /pages/admin-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0...

PT-2021-20622

Name of the Vulnerable Software and Affected Versions: Custom Post Type Relations WordPress plugin version 1.0 and earlier Description: The issue allows attackers to inject arbitrary web scripts via the cptrname parameter found in the /pages/admin-page.php file, enabling Reflected Cross-Site...

CVE-2021-34654: Improper Neutralization of Input During Web Page Generation

The Custom Post Type Relations WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the cptrname parameter found in the /pages/admin-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0...