CVE-2020-26564

ObjectPlanet Opinio before 7.15 allows XXE attacks via three steps: modify a .css file to have !ENTITY content, create a .xml file for a generic survey template containing a link to this .css file, and import this .xml file at the survey/admin/folderSurvey.do?action=viewImportSurvey'importFile'...

PT-2021-7558

Name of the Vulnerable Software and Affected Versions YOP Poll WordPress plugin versions prior to 6.3.1 Description The issue is related to a stored Cross-Site Scripting problem in the Admin preview module. It arises due to insufficient validation of question and answer text parameters in the...

CVE-2011-5210

Directory traversal vulnerability in admin/preview.php in Limny 3.0.0 allows remote attackers to read arbitrary files via a ..%2F encoded dot dot slash in the theme parameter...

CVE-2011-5210

CVE-2011-5210 affects Limny 3.0.0, where a directory traversal is possible in admin/preview.php via the theme parameter (encoded ..%2F) to read arbitrary files. Multiple sources (NVD, OpenVAS) confirm the vulnerability and link to Limny 3.0.0 players; OpenVAS describes it as a global directory tr...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in apps/admin/handlers/preview.php in Elefant CMS 1.0.x before 1.0.2-Beta and 1.1.x before 1.1.5-Beta allow remote attackers to inject arbitrary web script or HTML via the 1 title or 2 body parameter to admin/preview...

PT-2012-3183

Name of the Vulnerable Software and Affected Versions Elefant CMS versions 1.0.x through 1.0.2-Beta Elefant CMS versions 1.1.x through 1.1.5-Beta Description The issue allows remote attackers to inject arbitrary web script or HTML via the title or body parameter to the "admin/preview" endpoint...