124 matches found
CVE-2024-12332
The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'cid' parameter in all versions up to, and including, 2.2.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...
WordPress plugin WPSchoolPress SQL注入漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin...
Security Bulletin: QRadar Pulse application add on to IBM QRadar SIEM is vulnerable to using components with known vulnerabilities
Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM has released a new version which addresses the vulnerabilities. Vulnerability Details CVEID:CVE-2024-27088 DESCRIPTION: medikoo es5-ext is vulnerable to a...
WordPress EventON Plugin <= 2.2.14 is vulnerable to Cross Site Scripting (XSS)
Software EventON Type Plugin Vulnerable versions = 2.2.14 Fixed in 2.2.15 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33940 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 63d47ec77b3d Credits Van Lyubov Required privilege Administrator...
CVE-2024-1528
CMS Made Simple version 2.2.14, does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting XSS vulnerability through /admin/moduleinterface.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted JavaScript payload to ...
CVE-2024-1528
CMS Made Simple version 2.2.14, does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting XSS vulnerability through /admin/moduleinterface.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted JavaScript payload to ...
CVE-2024-1527 Unrestricted Upload of File with Dangerous Type in CMS Made Simple
Unrestricted file upload vulnerability in CMS Made Simple, affecting version 2.2.14. This vulnerability allows an authenticated user to bypass the security measures of the upload functionality and potentially create a remote execution of commands via webshell...
CVE-2024-1527
CMS Made Simple 2.2.14 has an Unrestricted File Upload vulnerability (CVE-2024-1527). An authenticated user can bypass upload protections and potentially upload a webshell to achieve remote command execution. Multiple sources (NVD entry) describe the impact as high to critical with high confident...
CMS Made Simple Cross-Site Scripting Vulnerability
CMS Made Simple CMSMS is an open source content management system CMS by Cmsms team. The system supports role-based permission management system, wizard-based installation and update mechanism, intelligent caching mechanism and so on. A cross-site scripting vulnerability exists in CMS Made Simple...
CMS Made Simple Code Issues Vulnerabilities
CMS Made Simple CMSMS is an open source content management system CMS by Cmsms team. The system supports role-based privilege management system, wizard-based installation and update mechanism, intelligent caching mechanism and so on. A code issue vulnerability exists in CMS Made Simple version...
PT-2024-18114 · Unknown · Cms Made Simple
Name of the Vulnerable Software and Affected Versions: CMS Made Simple version 2.2.14 Description: The issue arises from insufficient encoding of user-controlled input, leading to a Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited through the /admin/moduleinterface.php...
CMS Made Simple Cross-Site Scripting Vulnerability
CMS Made Simple CMSMS is an open source content management system CMS by Cmsms team. The system supports role-based permission management system, wizard-based installation and update mechanism, intelligent caching mechanism and so on. A cross-site scripting vulnerability exists in CMS Made Simple...
PT-2024-18115 · Unknown · Cms Made Simple
Name of the Vulnerable Software and Affected Versions: CMS Made Simple version 2.2.14 Description: The issue arises from insufficient encoding of user-controlled input, leading to a Cross-Site Scripting XSS vulnerability. This can be exploited through the "/admin/adduser.php" API endpoint,...
Directory traversal
XenForo before 2.2.14 allows Directory Traversal with write access by an authenticated user who has permissions to administer styles, and uses a ZIP archive for Styles Import...
CVE-2024-25006
CVE-2024-25006 affects XenForo prior to 2.2.14. An authenticated user with permission to administer styles can trigger a Directory Traversal vulnerability when using a Styles Import ZIP, potentially exposing file access with writeable context. The entry notes a high severity (CVSS v3.1: 8.1, AV:N...
PT-2023-29865 · Unknown · Hyperledger Fabric
Name of the Vulnerable Software and Affected Versions: Hyperledger Fabric versions prior to 2.2.14 and 2.5.5 Description: The issue arises from the way Hyperledger Fabric hashes transactions in a block, which allows an adversary to manipulate the transactions without changing the computed hash of...
CVE-2020-23481
CMS Made Simple 2.2.14 was discovered to contain a cross-site scripting XSS vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Field Definition text field...
CVE-2020-22732
CMS Made Simple CMSMS 2.2.14 allows stored XSS via the Extensions Fie Picker...