8285 matches found
CVE-2024-11899
The Slider Pro Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sliderpro' shortcode in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...
CVE-2024-12528 WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress <= 1.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
The WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpsurveypollresults' shortcode in all versions up to, and including, 1.7.5 due to insufficient input sanitization and output escaping on use...
WordPress plugin Tabs Shortcode 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
GHSA-4X6X-8RM8-C37J Extension:TabberNeue vulnerable to Cross-site Scripting
Summary There are several sources of arbitrary, unescaped user input being used to construct HTML, which allows any user that can edit pages or otherwise render wikitext to XSS other users. Edit: Only the first XSS can be reproduced in production. Details ✅ Verified and patched in...
WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes Plugin <= 1.4.9 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Webula Patchstack Alliance in WordPress Plugin ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes versions = 1.4.9...
PT-2025-42557
Name of the Vulnerable Software and Affected Versions mediawiki affected versions not specified Description The software contains a flaw related to sanitizing data attributes. Insufficient sanitization of data attributes may lead to potential issues. Recommendations At the moment, there is no...
PT-2025-42569
Name of the Vulnerable Software and Affected Versions mediawiki affected versions not specified Description The software contains a flaw related to sanitizing attributes unwrapped from data-ve-attributes. This could potentially allow for issues related to attribute handling. Recommendations At th...
PT-2026-25885
Name of the Vulnerable Software and Affected Versions Linux kernel versions 6.6 and later Description The Linux kernel includes an issue where the fchmodat2 function, introduced in version 6.6, was not included in the audit change attributes class. Calling fchmodat2 to modify file attributes in a...
PT-2025-37980
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the XFS file system related to the handling of ENODATA errors. Specifically, the code does not properly differentiate between ENODATA errors...
CVE-2024-56587
In the Linux kernel, the following vulnerability has been resolved: leds: class: Protect brightnessshow with ledcdev-ledaccess mutex There is NULL pointer issue observed if from Process A where hid device being added which results in adding a ledcdev addition and later a another call to access of...
UBUNTU-CVE-2024-56627
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix Out-of-Bounds Read in ksmbdvfsstreamread An offset from client could be a negative value, It could lead to an out-of-bounds read from the streambuf. Note that this issue is coming when setting 'vfs objects = streamsxat...
CVE-2024-11644
The WP-SVG WordPress plugin through 0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
CVE-2024-11644
The WP-SVG WordPress plugin through 0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
CVE-2024-11644
The CVE-2024-11644 entry concerns the WP-SVG WordPress plugin (versions
CVE-2024-11644 WP-SVG <= 0.9 - Contributor+ Stored XSS via Shortcode
The WP-SVG WordPress plugin through 0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
CVE-2024-11644 WP-SVG <= 0.9 - Contributor+ Stored XSS via Shortcode
The WP-SVG WordPress plugin through 0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
PT-2024-17152 · WordPress · Wp-Svg
Name of the Vulnerable Software and Affected Versions: WP-SVG WordPress plugin versions 0.9 and prior Description: The issue concerns the WP-SVG WordPress plugin, which does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is...
The vulnerability of Backstage’s portal-building platform lies in its uncontrolled modification of object prototype attributes, allowing attackers to trigger service failures.
The vulnerability of the Backstage developer portal-building platform lies in the uncontrolled modification of object prototype attributes. Exploiting this vulnerability allows a malicious actor, operating remotely, to cause service failures by sending a specially crafted API request...