57 matches found
PT-2021-22849
Name of the Vulnerable Software and Affected Versions SourceCodester CASAP Automated Enrollment System version 1.0 Description Multiple Cross Site Scripting XSS vulnerabilities exist in the system via various parameters in different PHP files, including user username and category in "save...
CVE-2021-39354
The Easy Digital Downloads WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $startdate and $enddate parameters found in the /includes/admin/payments/class-payments-table.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.11.2...
PT-2021-22560
Name of the Vulnerable Software and Affected Versions: Easy Digital Downloads WordPress plugin versions up to and including 2.11.2 Description: The issue allows attackers to inject arbitrary web scripts via the start date and end date parameters found in the...
CVE-2021-39354: Improper Neutralization of Input During Web Page Generation
The Easy Digital Downloads WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $startdate and $enddate parameters found in the /includes/admin/payments/class-payments-table.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.11.2...
PT-2021-11842
Name of the Vulnerable Software and Affected Versions: FV Flowplayer Video Player plugin versions prior to 7.4.37.727 Description: The issue allows remote authenticated users to inject arbitrary web script or HTML via the fv wp fvvideoplayer src JSON field in the data parameter. This is a...
CVE-2020-35748: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in models/list-table.php in the FV Flowplayer Video Player plugin before 7.4.37.727 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the fvwpfvvideoplayersrc JSON field in the data parameter...
CVE-2019-14695
A SQL injection vulnerability exists in the Sygnoos Popup Builder plugin before 3.45 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via com/libs/Table.php because Subscribers Table ordering is...
CVE-2019-14695
A SQL injection vulnerability exists in the Sygnoos Popup Builder plugin before 3.45 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via com/libs/Table.php because Subscribers Table ordering is...
CVE-2019-14695: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability exists in the Sygnoos Popup Builder plugin before 3.45 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via com/libs/Table.php because Subscribers Table ordering is...
PT-2019-10157
Name of the Vulnerable Software and Affected Versions: LibreNMS versions prior to 1.48 Description: The issue allows SQL injection via the sorthostname parameter in the "html/ajax table.php" endpoint, which can be exploited by authenticated users during a search. Recommendations: For versions pri...
CVE-2014-6604
Cross-site scripting XSS vulnerability in class-s2-list-table.php in the Subscribe2 plugin before 10.16 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ip parameter...
CVE-2014-6604
Cross-site scripting XSS vulnerability in class-s2-list-table.php in the Subscribe2 plugin before 10.16 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ip parameter...
CVE-2014-6604: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in class-s2-list-table.php in the Subscribe2 plugin before 10.16 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ip parameter...
CVE-2017-16842: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in admin/googlesearchconsole/class-gsc-table.php in the Yoast SEO plugin before 5.8.0 for WordPress allows remote attackers to inject arbitrary web script or HTML...
Cross-site Scripting (XSS)
automattic/jetpack is vulnerable to cross-site scripting XSS attacks. The attacks are possible because it does not escape the URL parameter in class.jetpack-modules-list-table.php...
hos.com XSS vulnerability
Vulnerable URL: https://www.hos.com/php/radiochannel-table.php?channel=1"...
CVE-2017-5612
Cross-site scripting XSS vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via a crafted excerpt...
CVE-2017-5612
Cross-site scripting XSS vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via a crafted excerpt...
CVE-2017-5612
Cross-site scripting XSS vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via a crafted excerpt...
CVE-2017-5612
Cross-site scripting XSS vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via a crafted excerpt...