CVE-2019-15610

Improper authorization in the Circles app 0.17.7 causes retaining access when an email address was removed from a circle...

CVE-2023-42246

creationtimestamp| type| source ---|---|--- 2025-01-13 22:11:00+00:00| seen| https://infosec.exchange/users/cve/statuses/113823335037954990 2025-01-13 22:16:58+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lfnrash5wj2s 2025-01-13 22:38:14+00:00| seen|...

WordPress Essential Addons for Elementor plugin <= 5.9.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Interactive Circles' vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'Interactive Circles' vulnerability discovered by Ngô Thiên An ancorn in WordPress Plugin Essential Addons for Elementor versions = 5.9.19...

Code injection

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and Nextcloud Enterprise Server, an attacker could insert links into circles name that would be opened when clickin...

CVE-2023-48301 Nextcloud Server HTML injection in search UI when selecting a circle with HTML in the display name

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and Nextcloud Enterprise Server, an attacker could insert links into circles name that would be opened when clickin...

HTML injection in search UI when selecting a circle with HTML in the display name

None...

PT-2023-8886 · Nextcloud +2 · Nextcloud Server +2

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions 25.0.0 through 25.0.12 Nextcloud Server versions 26.0.0 through 26.0.7 Nextcloud Server versions 27.0.0 through 27.1.2 Description: The issue is related to improper neutralization of input during web page generation,...

CVE-2023-23881

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in GreenTreeLabs Circles Gallery plugin = 1.0.10 versions...

CVE-2023-23881

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in GreenTreeLabs Circles Gallery plugin = 1.0.10 versions...

CVE-2023-23881

CVE-2023-23881 affects the WordPress Circles Gallery plugin by GreenTreeLabs (versions

CVE-2023-23881 WordPress Circles Gallery Plugin <= 1.0.10 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in GreenTreeLabs Circles Gallery plugin = 1.0.10 versions...

CVE-2023-23881 WordPress Circles Gallery Plugin <= 1.0.10 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in GreenTreeLabs Circles Gallery plugin = 1.0.10 versions...

PT-2023-19279 · Greentreelabs · Greentreelabs Circles Gallery Plugin

Name of the Vulnerable Software and Affected Versions: GreenTreeLabs Circles Gallery plugin versions 1.0.10 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For GreenTreeLabs...

WordPress plugin Circles Gallery 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Circles Gallery <= 1.0.10 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

WordPress Circles Gallery Plugin <= 1.0.10 is vulnerable to Cross Site Scripting (XSS)

Software Circles Gallery Type Plugin Vulnerable versions = 1.0.10 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23881 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 80742a31d5c5 Credits Rio Darmawan Required...

Code injection

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to versions 23.0.10 and 24.0.6 and Nextcloud Enterprise Server prior to versions 22.2.10, 23.0.10, and 24.0.6 are vulnerable to a logged-in attacker slowing down the system by...

Database resource exhaustion for logged-in users via sharee recommendations with circles

None...

CVE-2022-39330 Database resource exhaustion for logged-in users via sharee recommendations with circles

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to versions 23.0.10 and 24.0.6 and Nextcloud Enterprise Server prior to versions 22.2.10, 23.0.10, and 24.0.6 are vulnerable to a logged-in attacker slowing down the system by...

CVE-2022-39330

CVE-2022-39330 affects Nextcloud Server prior to 23.0.10 and 24.0.6, and Nextcloud Enterprise Server prior to 22.2.10, 23.0.10, 24.0.6. Description: a logged-in attacker can cause resource exhaustion (database/cpu load) by abusing sharee recommendations with the Circles feature; patches exist in ...