CVE-2021-34539

An issue was discovered in CubeCoders AMP before 2.1.1.8. A lack of validation of the Java Version setting means that an unintended executable path can be set. The result is that high-privileged users can trigger code execution...

PT-2021-20535

Name of the Vulnerable Software and Affected Versions: CubeCoders AMP versions prior to 2.1.1.8 Description: The issue is related to a lack of validation of the Java Version setting, which allows an unintended executable path to be set. This results in high-privileged users being able to trigger...

CVE-2021-34539: Exposure of Resource to Wrong Sphere

An issue was discovered in CubeCoders AMP before 2.1.1.8. A lack of validation of the Java Version setting means that an unintended executable path can be set. The result is that high-privileged users can trigger code execution...

Cross site scripting

The iFlyChat WordPress plugin before 4.7.0 does not sanitise its APP ID setting before outputting it back in the page, leading to an authenticated Stored Cross-Site Scripting issue...

PT-2021-15880

Name of the Vulnerable Software and Affected Versions Easy Preloader WordPress plugin versions 1.0.0 and earlier Description The issue is related to the lack of sanitization in the setting fields of the plugin, leading to authenticated Stored Cross-Site scripting issues. This can be exploited by...

PT-2021-15879

Name of the Vulnerable Software and Affected Versions iFlyChat WordPress plugin versions prior to 4.7.0 Description The issue is related to an authenticated Stored Cross-Site Scripting problem. It occurs because the APP ID setting is not properly sanitized before being outputted back in the page...

CVE-2021-24344: Improper Neutralization of Input During Web Page Generation

The Easy Preloader WordPress plugin through 1.0.0 does not sanitise its setting fields, leading to authenticated admin+ Stored Cross-Site scripting issues...

CVE-2021-24343: Improper Neutralization of Input During Web Page Generation

The iFlyChat WordPress plugin before 4.7.0 does not sanitise its APP ID setting before outputting it back in the page, leading to an authenticated Stored Cross-Site Scripting issue...

CVE-2020-27377

A cross-site scripting XSS vulnerability was discovered in the Administrator panel on the 'Setting News' module on CMS Made Simple 2.2.14 which allows an attacker to execute arbitrary web scripts...

CVE-2020-27377

A cross-site scripting XSS vulnerability was discovered in the Administrator panel on the 'Setting News' module on CMS Made Simple 2.2.14 which allows an attacker to execute arbitrary web scripts...

Cross site scripting

A cross-site scripting XSS vulnerability was discovered in the Administrator panel on the 'Setting News' module on CMS Made Simple 2.2.14 which allows an attacker to execute arbitrary web scripts...

CVE-2020-27377

A cross-site scripting XSS vulnerability was discovered in the Administrator panel on the 'Setting News' module on CMS Made Simple 2.2.14 which allows an attacker to execute arbitrary web scripts...

CVE-2021-24331

The Smooth Scroll Page Up/Down Buttons WordPress plugin before 1.4 did not properly sanitise and validate its settings, such as psbdistance, psbbuttonsize, psbspeed, only validating them client side. This could allow high privilege users such as admin to set XSS payloads in them...

CVE-2020-26670

A vulnerability has been discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary commands through a crafted request sent to the server via the 'Create a New Setting' function...

PT-2021-11387

Name of the Vulnerable Software and Affected Versions: CMS Made Simple version 2.2.14 Description: A cross-site scripting XSS issue was found in the Administrator panel on the 'Setting News' module, allowing an attacker to execute arbitrary web scripts. Recommendations: For CMS Made Simple versio...

CVE-2020-26670: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary commands through a crafted request sent to the server via the 'Create a New Setting' function...

CVE-2020-27377: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability was discovered in the Administrator panel on the 'Setting News' module on CMS Made Simple 2.2.14 which allows an attacker to execute arbitrary web scripts...

PT-2021-11256

Name of the Vulnerable Software and Affected Versions: BigTree CMS versions 4.4.10 and earlier Description: A vulnerability has been discovered that allows an authenticated attacker to execute arbitrary commands through a crafted request sent to the server via the 'Create a New Setting' function...

CVE-2021-33506

jitsi-meet-prosody in Jitsi Meet before 2.0.5963-1 does not ensure that restrictroomcreation is set by default. This can allow an attacker to circumvent conference moderation...

Jitsi Meet jitsi-meet-prosody安全漏洞

8X8 Docker Jitsi Meet is a tool for building Jitsi Meet videoconferencing solutions in Docker from 8x8 USA. A security vulnerability exists in jitsi-meet-prosody in versions of Jitsi Meet prior to 5026, which stems from an uncertainty in the default setting of restrictroomcreation. No detailed...