1078 matches found
TuiTse-TsuSin Cross-Site Scripting Vulnerability
ithuan TuiTse-TsuSin is a library from the Chinese company ithuan. A cross-site scripting vulnerability exists in TuiTse-TsuSin versions prior to 1.3.2, which stems from an html injection vulnerability when using tuitsehtml without quoting input...
GHSA-M4M5-J36M-8X72 html injection vulnerability in the `tuitse_html` function.
Impact When using tuitsehtml without quoting the input, there is a html injection vulnerability. It should use the django version django.utils.html.formathtml, instead of string.format Patches Upgrade to version 1.3.2. Workarounds Sanitizing Taigi input with HTML quotation. References...
html injection vulnerability in the `tuitse_html` function.
Impact When using tuitsehtml without quoting the input, there is a html injection vulnerability. It should use the django version django.utils.html.formathtml, instead of string.format Patches Upgrade to version 1.3.2. Workarounds Sanitizing Taigi input with HTML quotation. References...
PT-2024-13240 · WordPress · My Account Page Editor
Name of the Vulnerable Software and Affected Versions: My Account Page Editor WordPress plugin versions prior to 1.3.2 Description: The issue allows any authenticated users to upload arbitrary files to the server, leading to remote code execution RCE. This is due to the lack of validation for the...
PT-2026-20360
Name of the Vulnerable Software and Affected Versions zlib versions prior to 1.3.2 Description The software contains an issue where CPU consumption can occur through the crc32 combine64 and crc32 combine gen64 functions. This is due to the x2nmodp function potentially performing right shifts with...
CVE-2023-47525
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in A WP Life Event Monster – Event Management, Tickets Booking, Upcoming Event allows Stored XSS.This issue affects Event Monster – Event Management, Tickets Booking, Upcoming Event: from n/a through...
AZL-32229 CVE-2023-48795 affecting package terraform for versions less than 1.3.2-25
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted from the extension negotiation message, and a client and server may consequently end up with a connecti...
PT-2023-30498 · WordPress · Softlab Integrate Google Drive
Name of the Vulnerable Software and Affected Versions: SoftLab Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Gallery, and Manage Your Google Drive Files Into Your WordPress Site versions n/a through 1.3.2 Description: The issue is related to a URL Redirection to Untrusted...
WordPress Plugin Integrate Google Drive Input Validation Error Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An input validation error...
CVE-2023-25057
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Libsyn Libsyn Publisher Hub.This issue affects Libsyn Publisher Hub: from n/a through 1.3.2...
CVE-2023-47808
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Christina Uechi Add Widgets to Page plugin = 1.3.2 versions...
WordPress PayTR Taksit Tablosu Plugin <= 1.3.1 is vulnerable to Broken Access Control
Software PayTR Taksit Tablosu Type Plugin Vulnerable versions = 1.3.1 Fixed in 1.3.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-47847 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 9835cf00a16a Credits Abdi Pranata Required...
WordPress ARI Stream Quiz Plugin <= 1.3.2 is vulnerable to Content Injection
Software ARI Stream Quiz Type Plugin Vulnerable versions = 1.3.2 Fixed in 1.3.3 OWASP Top 10 A5: Broken Access Control Classification Content Injection CVE CVE-2023-47513 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 942a7b806fcf Credits Abdi Pranata Required privilege...
SUSE CVE-2019-10746
mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload...
CVE-2023-5250
The Grid Plus plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.3.2 via a shortcode attribute. This allows subscriber-level, and above, attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those file...
WordPress Plugin Grid Plus Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...
PT-2023-31974 · WordPress · Grid Plus
Name of the Vulnerable Software and Affected Versions: The Grid Plus plugin for WordPress versions up to, and including, 1.3.2 Description: The issue allows attackers with subscriber-level or higher access to include and execute arbitrary PHP files on the server via a shortcode attribute. This ca...
WordPress Plugin Grid Plus Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...
WordPress Grid Plus Plugin <= 1.3.2 is vulnerable to Broken Access Control
Software Grid Plus Type Plugin Vulnerable versions = 1.3.2 Fixed in 1.3.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-34014 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID dd240d0353de Credits Abdi Pranata Required privilege...