Cross site scripting

The Caldera Forms WordPress plugin before 1.9.5 does not sanitise and escape the Form Name before outputting it in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24896

The CVE-2021-24896 entry concerns the WordPress Caldera Forms plugin prior to 1.9.5. The vulnerability arises because the plugin fails to sanitise and escape the Form Name before outputting it in HTML attributes, enabling Cross-Site Scripting (XSS) by high-privilege users even when unfiltered_htm...

CVE-2021-24896 Caldera forms < 1.9.5 - Admin+ Stored Cross-Site Scripting

The Caldera Forms WordPress plugin before 1.9.5 does not sanitise and escape the Form Name before outputting it in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. Caldera Forms Plugin is a WordPress open source application plugin. WordPress Caldera Forms Plugins prior to 1.9.5...

WordPress Caldera Forms plugin <= 1.9.4 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Dhananjay Garg in WordPress Caldera Forms plugin versions = 1.9.4. Solution Update the WordPress Caldera Forms plugin to the latest available version at least 1.9.5...

Caldera forms < 1.9.5 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape the Form Name before outputting it in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC Create/edit a form, and put the following payload in the Form Name vi...

Caldera forms < 1.9.5 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape the Form Name before outputting it in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. Create/edit a form, and put the following payload in the Form Name via th...

Exploit for CVE-2021-22146

cve-2021-22146 I found during a internal pentest...

CVE-2020-19907

A command injection vulnerability in the sandcat plugin of Caldera 2.3.1 and earlier allows authenticated attackers to execute any command or service...

CVE-2020-19907

A command injection vulnerability in the sandcat plugin of Caldera 2.3.1 and earlier allows authenticated attackers to execute any command or service...

Command injection

A command injection vulnerability in the sandcat plugin of Caldera 2.3.1 and earlier allows authenticated attackers to execute any command or service...

CVE-2020-19907

The CVE-2020-19907 entry describes a command-injection vulnerability in the sandcat plugin of Caldera versions 2.3.1 and earlier . The root cause is not elaborated beyond the vulnerable plugin allowing an authenticated attacker to execute arbitrary commands or services. Impact is scoped to an aut...

CVE-2020-19907

A command injection vulnerability in the sandcat plugin of Caldera 2.3.1 and earlier allows authenticated attackers to execute any command or service...

Caldera 操作系统命令注入漏洞

Caldera is a suite of software from the French company Caldera that enables color management, imaging and processing solutions for printer devices. A security vulnerability exists in Caldera versions 2.3.1 and earlier, where an authenticated attacker executes any command or service...

PT-2021-10417 · Sandcat +1 · Sandcat +1

Name of the Vulnerable Software and Affected Versions: Caldera versions 2.3.1 and earlier Description: A command injection issue in the sandcat plugin allows authenticated attackers to execute any command or service. Recommendations: For Caldera versions 2.3.1 and earlier, at the moment, there is...

Caldera Cross-Site Scripting Vulnerability

Caldera is a suite of software from the French company Caldera that provides color management, imaging and processing solutions for printer devices. A cross-site scripting vulnerability exists in Caldera version 2.7.0. The vulnerability stems from a lack of proper validation of client-side data b...

CVE-2020-14462

CALDERA 2.7.0 allows XSS via the Operation Name box...

CVE-2020-14462

CALDERA 2.7.0 allows XSS via the Operation Name box...

Cross site scripting

CALDERA 2.7.0 allows XSS via the Operation Name box...

CVE-2020-14462

CVE-2020-14462 concerns CALDERA 2.7.0 with a cross-site scripting (XSS) vulnerability in the WEB application, arising from lack of proper validation of client-side data in the Operation Name box. Multiple connected sources (CNVD-2021-22479, RH: Red Hat, NVD, OSV, CNVD) describe it as a Caldera XS...