CVE-2023-29130

A vulnerability has been identified in SIMATIC CN 4100 All versions V2.5. Affected device consists of improper access controls in the configuration files that leads to privilege escalation. An attacker could gain admin access with this vulnerability leading to complete device control...

CVE-2023-3225 Float menu < 5.0.3 - Admin+ Stored Cross-Site Scripting

The Float menu WordPress plugin before 5.0.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-2967 TinyMCE Custom Styles < 1.1.4 - Admin+ Stored Cross-Site Scripting

The TinyMCE Custom Styles WordPress plugin before 1.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-1780

The CVE-2023-1780 affects the Companion Sitemap Generator WordPress plugin (versions before 4.5.3). It stems from not sanitising/escaping certain parameters before echoing them in pages, causing a Reflected Cross‑Site Scripting (XSS) vulnerability that could affect high‑privilege users (e.g., adm...

CVE-2023-37065

Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the session category management section...

CVE-2023-37064

Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the extra fields management section...

Design/Logic Flaw

Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the course categories' definition...

Design/Logic Flaw

Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the classes/usergroups management section...

Design/Logic Flaw

Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the careers & promotions management section...

Design/Logic Flaw

Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the skills wheel...

Design/Logic Flaw

Chamilo 1.11.x up to 1.11.20 allows users with an admin privilege account to insert XSS in the languages management section...

Design/Logic Flaw

Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the extra fields management section...

CVE-2023-37065

Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the session category management section...

CVE-2023-37061

Chamilo 1.11.x up to 1.11.20 allows users with an admin privilege account to insert XSS in the languages management section...

CVE-2023-37066

Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the skills wheel...

CVE-2023-37064

Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the extra fields management section...

CVE-2023-37065

Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the session category management section...

CVE-2023-37067

CVE-2023-37067 affects Chamilo LMS 1.11.x up to 1.11.20. The vulnerability allows an admin-privileged user to inject cross-site scripting (XSS) in the classes/usergroups management section. The public-facing materials describe the issue as an admin-level XSS risk, but explicit exploit details, af...

PT-2023-25779 · Chamilo · Chamilo

Name of the Vulnerable Software and Affected Versions: Chamilo versions 1.11.x up to 1.11.20 Description: The issue allows users with admin privilege accounts to insert XSS in the skills wheel. This can be exploited by users with administrative privileges. Recommendations: For Chamilo versions...

CVE-2023-37061

Chamilo LMS (1.11.x up to 1.11.20) is vulnerable to a cross-site scripting (XSS) issue in the languages management section that can be triggered by users with an admin privilege account. The vulnerability is documented across multiple sources, but concrete fixes or patched versions are not consis...