298 matches found
CVE-2021-38113
In addBouquet in js/bqe.js in OpenWebif aka e2openplugin-OpenWebif through 1.4.7, inserting JavaScript into the Add Bouquet feature of the Bouquet Editor i.e., bouqueteditor/api/addbouquet?name= leads to Stored XSS...
FUEL CMS 跨站脚本漏洞
FUEL CMS is a content management system based on CodeIgniter. A cross-site scripting vulnerability exists in FUEL CMS 1.4.7. An attacker can exploit this vulnerability to conduct cross-site scripting attacks bypassing filters via /fuelCM/fuel/pages/edit/1?lang=english...
FUEL CMS 安全漏洞
FUEL CMS is a content management system based on CodeIgniter. An elevation of privilege vulnerability exists in FUEL CMS 1.4.7. The vulnerability can be exploited to gain super administrator privileges via the "id" and "fuelid" parameters...
Vault Leases Created with Batch Tokens have Invalid Expiration
Summary HashiCorp Vault and Vault Enterprise versions 1.0 and newer allowed leases created with a batch token to outlive their TTL because expiration time was not scheduled correctly. This vulnerability, CVE-2020-25816, was fixed in 1.4.7 and 1.5.4. Background Vault allows the issuance of batch...
CVE-2020-22276
WeForms Wordpress Plugin 1.4.7 allows CSV injection via a form's entry...
CVE-2020-22276
The CVE-2020-22276 affects the WeForms WordPress plugin, version 1.4.7, which is vulnerable to CSV injection via a form entry. The CVSS data in the record shows a high severity (CVSS v3.1 base score 9.8, CRITICAL) with network attack vector, no authentication, and no user interaction required, im...
CVE-2020-25816
HashiCorp Vault and Vault Enterprise versions 1.0 and newer allowed leases created with a batch token to outlive their TTL because expiration time was not scheduled correctly. Fixed in 1.4.7 and 1.5.4...
PT-2020-15515 · Jenkins · Jenkins Liquibase Runner Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Liquibase Runner Plugin versions 1.4.7 and earlier Description: A missing permission check in the plugin allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. This can be done...
Remote code execution
In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, request parameters injected inside an expression evaluated by symfony/expression-language package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter,...
Sql injection
FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items...
CVE-2020-17463
FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items...
Fuel CMS 1.4.7 - 'col' SQL Injection (Authenticated)
Exploit Title: Fuel CMS 1.4.7 - 'col' SQL Injection Authenticated Google Dork: - Date: 2020-08-01 Exploit Author: Roel van Beurden Vendor Homepage: https://www.getfuelcms.com/ Software Link: https://github.com/daylightstudio/FUEL-CMS/archive/1.4.7.zip Version: 1.4.7 Tested on: Linux Ubuntu 18.04...
Fuel CMS 1.4.7 - (col) SQL Injection (Authenticated) Vulnerability
Exploit for php platform in category web applications Exploit Title: Fuel CMS 1.4.7 - 'col' SQL Injection Authenticated Exploit Author: Roel van Beurden Vendor Homepage: https://www.getfuelcms.com/ Software Link: https://github.com/daylightstudio/FUEL-CMS/archive/1.4.7.zip Version: 1.4.7 Tested o...
UBUNTU-CVE-2020-15562
An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before 1.4.7. It allows XSS via a crafted HTML e-mail message, as demonstrated by a JavaScript payload in the xmlns aka XML namespace attribute of a HEAD element when an SVG element exists...
WordPress one-click-ssl plugin cross-site request forgery vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. one-click-ssl is an SSL Transport Layer Security setup plugin that is used in it. A cross-site request forgery vulnerability exists in...
CVE-2019-15828
The one-click-ssl plugin before 1.4.7 for WordPress has CSRF...
CVE-2017-18526
The moreads-se plugin before 1.4.7 for WordPress has XSS...
CVE-2017-18526
The CVE-2017-18526 affects the WordPress Moreads‑Se plugin prior to version 1.4.7, with a cross‑site scripting (XSS) flaw. The vulnerability concerns the plugin’s handling of input leading to client‑side code execution. No exploit details are provided in the supplied documents. Remediation: upgra...